@botbuddy/cli 1.9.1 → 1.12.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.9.1",
+  "version": "1.12.2",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/api.mjs

@@ -53,25 +53,48 @@ export async function callTool(toolName, args = {}) {
 //   * { ok:true, data }        — tool result JSON (data.success may still be false)
 //   * { ok:false, auth:true }  — not authenticated / token expired
 //   * { ok:false, status }     — HTTP/JSON-RPC/transport error (status may be null)
-export async function callToolJson(toolName, args = {}, { fetchImpl = fetch, signal } = {}) {
+// BOT-1487: resolve the auth header ONCE so a caller that issues several tool
+// calls (e.g. `profile setup` does whoami → register_agent) can pin the SAME
+// credential across all of them. Without this, each callToolJson independently
+// re-reads the owner token, so a concurrent `botbuddy login` could swap the
+// bound tenant mid-sequence (a TOCTOU that would register in the wrong tenant).
+// Returns { auth } with the header object, or { error } with the structured
+// not-authenticated / token-expired receipt to return verbatim.
+export async function resolveCallAuth() {
   const owner = await resolveOwnerToken({ getConfig });
-  let auth;
   if (owner && !(owner.expiresAt && Date.now() >= owner.expiresAt)) {
-    auth = { Authorization: `Bearer ${owner.token}` };
-  } else {
-    const agentKey = await resolveAgentKey();
-    if (agentKey) {
-      auth = { "x-agent-api-key": agentKey };
-    } else if (owner) {
-      return { ok: false, auth: true, error: "token_expired" };
-    } else {
-      return { ok: false, auth: true, error: "not_authenticated" };
-    }
+    return { auth: { Authorization: `Bearer ${owner.token}` } };
+  }
+  const agentKey = await resolveAgentKey();
+  if (agentKey) return { auth: { "x-agent-api-key": agentKey } };
+  if (owner) return { error: { ok: false, auth: true, error: "token_expired" } };
+  return { error: { ok: false, auth: true, error: "not_authenticated" } };
+}
+
+// BOT-1561: a multi-membership owner credential is tenant-ambiguous without an
+// explicit pin — the server (mcpSessionIdentity, BOT-1521) fails closed, so
+// stateless REST tools/call like whoami return no tenant_id. `tenant` pins the
+// call to a specific tenant by appending ?tenant=<slug> to the endpoint (the
+// same mechanism as the documented BOTBUDDY_SERVER_URL override), letting the
+// server resolve/confirm exactly that tenant.
+function toolEndpoint(tenant) {
+  if (!tenant) return SERVER_URL;
+  const url = new URL(SERVER_URL);
+  url.searchParams.set("tenant", tenant);
+  return url.toString();
+}
+
+export async function callToolJson(toolName, args = {}, { fetchImpl = fetch, signal, auth: pinnedAuth = null, tenant = null } = {}) {
+  let auth = pinnedAuth;
+  if (!auth) {
+    const resolved = await resolveCallAuth();
+    if (resolved.error) return resolved.error;
+    auth = resolved.auth;
   }
   const body = { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: toolName, arguments: args } };
   let res;
   try {
-    res = await fetchImpl(SERVER_URL, {
+    res = await fetchImpl(toolEndpoint(tenant), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...auth },
       body: JSON.stringify(body),
@@ -80,7 +103,21 @@ export async function callToolJson(toolName, args = {}, { fetchImpl = fetch, sig
   } catch (err) {
     return { ok: false, status: null, error: `transport: ${err?.message ?? err}` };
   }
-  if (res.status === 401 || res.status === 403) return { ok: false, auth: true, status: res.status, error: "unauthorized" };
+  if (res.status === 401 || res.status === 403) {
+    // BOT-1561: a 401/403 can still carry a structured MCP error code in its
+    // JSON-RPC body (e.g. MCP_TENANT_MEMBERSHIP_REQUIRED from a connection
+    // tenant-pin refusal — index.ts serializes it as
+    // { error: { code: -32002, data: { code } } }). Surface that `code` so a
+    // caller can tell a tenant refusal apart from a plain credential failure.
+    // Best-effort: an opaque/bodyless 401/403 keeps the generic shape.
+    let code = null;
+    try {
+      const body = await res.json();
+      const raw = body?.error?.data?.code ?? body?.error?.code ?? body?.code ?? null;
+      if (typeof raw === "string" && raw) code = raw;
+    } catch { /* opaque body */ }
+    return { ok: false, auth: true, status: res.status, error: "unauthorized", ...(code ? { code } : {}) };
+  }
   let payload;
   try { payload = await res.json(); } catch { return { ok: false, status: res.status, error: "invalid_json" }; }
   if (payload.error?.message) return { ok: false, status: res.status, error: payload.error.message };

package/src/profile-bootstrap.mjs

@@ -2,7 +2,7 @@ import { hostname } from "node:os";
 import { randomUUID } from "node:crypto";
 
 import { ensureProfileCredentialBackend, readProfileIdentity, readProfileRetryIdentity, recordProfileRetryIdentity, installProfileCredential, profileCredentialEnvironment, ProfileCredentialStoreError } from "./agent-credential-store.mjs";
-import { callToolJson } from "./api.mjs";
+import { callToolJson, resolveCallAuth } from "./api.mjs";
 import { latestPublicCliCommand } from "./public-invocation.mjs";
 
 const PROFILES = Object.freeze({
@@ -27,6 +27,15 @@ export function defaultProfileAgentName(profile) {
   return `${profile}-${host || "host"}-${suffix}`;
 }
 
+// A structured MCP error code can arrive on a tool result body (`data.code`) or,
+// for a 401/403, on the top-level auth receipt (`code`) that callToolJson lifts
+// out of the JSON-RPC error body (BOT-1561). Read whichever is present.
+function structuredCode(response) {
+  if (typeof response?.data?.code === "string") return response.data.code;
+  if (typeof response?.code === "string") return response.code;
+  return null;
+}
+
 function registrationCredential(data) {
   return typeof data?.agent_api_key === "string"
     ? data.agent_api_key
@@ -38,6 +47,7 @@ function registrationCredential(data) {
 export async function bootstrapProfile(profileName, {
   name = null,
   call = callToolJson,
+  resolveAuth = resolveCallAuth,
   readIdentity = readProfileIdentity,
   readRetryIdentity = readProfileRetryIdentity,
   recordRetryIdentity = recordProfileRetryIdentity,
@@ -55,14 +65,83 @@ export async function bootstrapProfile(profileName, {
   // cannot loop forever on stale metadata.
   const reusableIdentity = existing?.tenant === profile.tenant ? existing.agentId : retryIdentity?.agentId ?? null;
   const agentName = name ?? (existing?.tenant === profile.tenant ? existing.name : retryIdentity?.name ?? defaultProfileAgentName(profileName));
+  // BOT-1487: tenancy is auth-bound after BOT-1416 — register_agent selects the
+  // tenant from the OAuth session / agent key and rejects a runtime tenant_id
+  // with MCP_TENANT_CONTEXT_IS_AUTH_ONLY. So we no longer send tenant_id; the
+  // returned tenant_id is attested against the profile's tenant below instead.
+  //
+  // register_agent is a MUTATING call (it persists the agent, its credential
+  // hash, and tenant membership). If the session is logged into another tenant,
+  // registering first and rejecting the response afterwards would leave a stray,
+  // unreachable agent in the wrong tenant on every attempt (names are randomized
+  // and the wrong-tenant path records no retry identity). So resolve the bound
+  // tenant with the read-only `whoami` FIRST and gate registration on it.
+  //
+  // Fail CLOSED (AGENTS.md — no fallbacks; non-determinism is worse than
+  // failure): the mutating register_agent runs ONLY on a positively attested
+  // tenant that matches the profile. A missing/erroring/malformed whoami never
+  // silently proceeds, because the later attestation cannot undo an agent that
+  // registration already persisted in the wrong tenant.
+  //
+  // Snapshot the credential ONCE and pin it to both whoami and register_agent.
+  // Otherwise each call re-reads the owner token, so a concurrent `botbuddy
+  // login` could swap the bound tenant between the attesting whoami and the
+  // mutating register (a TOCTOU that would register in the second tenant).
+  const pinned = await resolveAuth();
+  if (pinned?.error) throw new ProfileBootstrapError("profile_agent_required");
+  const auth = pinned?.auth ?? null;
+  // BOT-1561: a multi-tenant owner's OAuth credential is tenant-ambiguous, so an
+  // unpinned whoami returns no tenant_id and BOT-1487's gate throws
+  // profile_tenant_unverified. Each profile already knows its tenant, so pin it
+  // on BOTH calls: whoami resolves/confirms exactly that tenant (the server
+  // refuses a non-member owner → profile_credential_wrong_tenant below), and
+  // register_agent mints in the pinned tenant. Preserves BOT-1487's fail-closed
+  // + single-credential pinning guarantees.
+  const tenant = profile.tenant;
+  const identity = await call("whoami", {}, { auth, tenant });
+  const identityCode = structuredCode(identity);
+  // BOT-1561: the server refuses the pin with MCP_TENANT_MEMBERSHIP_REQUIRED
+  // (HTTP 403) when the credential cannot register in the profile's tenant —
+  // either the owner is not a member, or a tenant-bound login is sealed to a
+  // DIFFERENT tenant (resolveHintedTenant never repoints a bound credential).
+  // callToolJson now preserves that code from the 403 body; map it to the
+  // wrong-tenant outcome so setup reports the accurate, actionable failure
+  // instead of the misleading profile_tenant_unverified the swallowed 403
+  // previously produced. register_agent never runs.
+  if (identityCode === "MCP_TENANT_MEMBERSHIP_REQUIRED") {
+    throw new ProfileBootstrapError("profile_credential_wrong_tenant");
+  }
+  if (identityCode === "MCP_TENANT_SELECTION_REQUIRED" || identityCode === "MCP_TENANT_CONTEXT_IS_AUTH_ONLY") {
+    throw new ProfileBootstrapError("profile_tenant_selection_required");
+  }
+  const boundTenant = typeof identity?.data?.tenant_id === "string" ? identity.data.tenant_id : null;
+  if (!boundTenant) {
+    // whoami did not positively attest a tenant (transport/server error or a
+    // response without a string tenant_id) — refuse rather than register blind.
+    throw new ProfileBootstrapError("profile_tenant_unverified");
+  }
+  if (boundTenant !== profile.tenant) {
+    throw new ProfileBootstrapError("profile_credential_wrong_tenant");
+  }
   const args = {
     name: agentName,
     type: "codex",
-    tenant_id: profile.tenant,
     ...(reusableIdentity ? { agent_id: reusableIdentity } : {}),
   };
-  const response = await call("register_agent", args);
+  const response = await call("register_agent", args, { auth, tenant });
   const data = response?.data;
+  const responseCode = structuredCode(response);
+  // Defense-in-depth: whoami above already gated on the tenant, so register_agent
+  // should not return a tenant-context error here — but if the contract drifts,
+  // surface its own actionable recovery, not the misleading
+  // `profile_agent_required` → `botbuddy login` loop that keeps failing because
+  // login itself is fine.
+  if (responseCode === "MCP_TENANT_MEMBERSHIP_REQUIRED") {
+    throw new ProfileBootstrapError("profile_credential_wrong_tenant");
+  }
+  if (responseCode === "MCP_TENANT_CONTEXT_IS_AUTH_ONLY" || responseCode === "MCP_TENANT_SELECTION_REQUIRED") {
+    throw new ProfileBootstrapError("profile_tenant_selection_required");
+  }
   if (!response?.ok || (response.isError && data?.code !== "FRESH_CONNECTION_REQUIRED")) {
     throw new ProfileBootstrapError("profile_agent_required");
   }
@@ -126,6 +205,30 @@ export function profileBootstrapRecovery(code, profileName) {
   if (code === "profile_credential_persist_failed") {
     return `ensure ~/.botbuddy is writable and no other setup is running, then re-run: botbuddy profile setup ${profileName}`;
   }
+  if (code === "profile_credential_wrong_tenant") {
+    // BOT-1561: reached when the login is authorized for a different tenant (a
+    // tenant-bound token can't be repointed) or the owner isn't a member of the
+    // profile's tenant. The fix is to authenticate INTO the profile's tenant —
+    // not the bare login loop, which relogs into the same wrong tenant.
+    const tenant = getAgentProfile(profileName)?.tenant;
+    return tenant
+      ? `run botbuddy login and select the "${tenant}" tenant during authentication, then re-run: botbuddy profile setup ${profileName} (if you are not a member of "${tenant}", ask an admin for access)`
+      : `run botbuddy login and select the profile's tenant during authentication, then re-run: botbuddy profile setup ${profileName}`;
+  }
+  if (code === "profile_tenant_unverified") {
+    // whoami could not confirm the bound tenant, so registration was refused
+    // before any mutation. Usually transient — retry; login only if it persists.
+    return `could not confirm your tenant with the server — retry: botbuddy profile setup ${profileName} (if it persists, run botbuddy login, then re-run setup)`;
+  }
+  if (code === "profile_tenant_selection_required") {
+    // Tenancy is chosen at MCP authentication (BOT-1416), not passed to
+    // register_agent. Point the user at selecting the profile's tenant when
+    // they sign in — never the bare login loop that implies login is broken.
+    const tenant = getAgentProfile(profileName)?.tenant;
+    return tenant
+      ? `sign in and select the "${tenant}" tenant during authentication, then re-run: botbuddy profile setup ${profileName}`
+      : `sign in and select the matching tenant during authentication, then re-run: botbuddy profile setup ${profileName}`;
+  }
   return `botbuddy login && botbuddy profile setup ${profileName}`;
 }
 

package/src/botbuddy-release-repair.json

@@ -1 +0,0 @@
-{"schema_version":1,"source_version":"1.9.0","source_identity":"70b96a360d9dd5bd637dc6378a4cae6542cb0a508990f28d26c842946e6fb694"}