@botbuddy/cli 1.9.1 → 1.9.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.9.1",
+  "version": "1.9.2",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/api.mjs

@@ -53,20 +53,30 @@ export async function callTool(toolName, args = {}) {
 //   * { ok:true, data }        — tool result JSON (data.success may still be false)
 //   * { ok:false, auth:true }  — not authenticated / token expired
 //   * { ok:false, status }     — HTTP/JSON-RPC/transport error (status may be null)
-export async function callToolJson(toolName, args = {}, { fetchImpl = fetch, signal } = {}) {
+// BOT-1487: resolve the auth header ONCE so a caller that issues several tool
+// calls (e.g. `profile setup` does whoami → register_agent) can pin the SAME
+// credential across all of them. Without this, each callToolJson independently
+// re-reads the owner token, so a concurrent `botbuddy login` could swap the
+// bound tenant mid-sequence (a TOCTOU that would register in the wrong tenant).
+// Returns { auth } with the header object, or { error } with the structured
+// not-authenticated / token-expired receipt to return verbatim.
+export async function resolveCallAuth() {
   const owner = await resolveOwnerToken({ getConfig });
-  let auth;
   if (owner && !(owner.expiresAt && Date.now() >= owner.expiresAt)) {
-    auth = { Authorization: `Bearer ${owner.token}` };
-  } else {
-    const agentKey = await resolveAgentKey();
-    if (agentKey) {
-      auth = { "x-agent-api-key": agentKey };
-    } else if (owner) {
-      return { ok: false, auth: true, error: "token_expired" };
-    } else {
-      return { ok: false, auth: true, error: "not_authenticated" };
-    }
+    return { auth: { Authorization: `Bearer ${owner.token}` } };
+  }
+  const agentKey = await resolveAgentKey();
+  if (agentKey) return { auth: { "x-agent-api-key": agentKey } };
+  if (owner) return { error: { ok: false, auth: true, error: "token_expired" } };
+  return { error: { ok: false, auth: true, error: "not_authenticated" } };
+}
+
+export async function callToolJson(toolName, args = {}, { fetchImpl = fetch, signal, auth: pinnedAuth = null } = {}) {
+  let auth = pinnedAuth;
+  if (!auth) {
+    const resolved = await resolveCallAuth();
+    if (resolved.error) return resolved.error;
+    auth = resolved.auth;
   }
   const body = { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: toolName, arguments: args } };
   let res;

package/src/botbuddy-release-repair.json

@@ -1 +1 @@
-{"schema_version":1,"source_version":"1.9.0","source_identity":"70b96a360d9dd5bd637dc6378a4cae6542cb0a508990f28d26c842946e6fb694"}
+{"schema_version":1,"source_version":"1.9.0","source_identity":"8bc02282f116b4857951c61a187ad7894c3153b36559b46cd171df24b0af98c4"}

package/src/profile-bootstrap.mjs

@@ -2,7 +2,7 @@ import { hostname } from "node:os";
 import { randomUUID } from "node:crypto";
 
 import { ensureProfileCredentialBackend, readProfileIdentity, readProfileRetryIdentity, recordProfileRetryIdentity, installProfileCredential, profileCredentialEnvironment, ProfileCredentialStoreError } from "./agent-credential-store.mjs";
-import { callToolJson } from "./api.mjs";
+import { callToolJson, resolveCallAuth } from "./api.mjs";
 import { latestPublicCliCommand } from "./public-invocation.mjs";
 
 const PROFILES = Object.freeze({
@@ -38,6 +38,7 @@ function registrationCredential(data) {
 export async function bootstrapProfile(profileName, {
   name = null,
   call = callToolJson,
+  resolveAuth = resolveCallAuth,
   readIdentity = readProfileIdentity,
   readRetryIdentity = readProfileRetryIdentity,
   recordRetryIdentity = recordProfileRetryIdentity,
@@ -55,14 +56,60 @@ export async function bootstrapProfile(profileName, {
   // cannot loop forever on stale metadata.
   const reusableIdentity = existing?.tenant === profile.tenant ? existing.agentId : retryIdentity?.agentId ?? null;
   const agentName = name ?? (existing?.tenant === profile.tenant ? existing.name : retryIdentity?.name ?? defaultProfileAgentName(profileName));
+  // BOT-1487: tenancy is auth-bound after BOT-1416 — register_agent selects the
+  // tenant from the OAuth session / agent key and rejects a runtime tenant_id
+  // with MCP_TENANT_CONTEXT_IS_AUTH_ONLY. So we no longer send tenant_id; the
+  // returned tenant_id is attested against the profile's tenant below instead.
+  //
+  // register_agent is a MUTATING call (it persists the agent, its credential
+  // hash, and tenant membership). If the session is logged into another tenant,
+  // registering first and rejecting the response afterwards would leave a stray,
+  // unreachable agent in the wrong tenant on every attempt (names are randomized
+  // and the wrong-tenant path records no retry identity). So resolve the bound
+  // tenant with the read-only `whoami` FIRST and gate registration on it.
+  //
+  // Fail CLOSED (AGENTS.md — no fallbacks; non-determinism is worse than
+  // failure): the mutating register_agent runs ONLY on a positively attested
+  // tenant that matches the profile. A missing/erroring/malformed whoami never
+  // silently proceeds, because the later attestation cannot undo an agent that
+  // registration already persisted in the wrong tenant.
+  //
+  // Snapshot the credential ONCE and pin it to both whoami and register_agent.
+  // Otherwise each call re-reads the owner token, so a concurrent `botbuddy
+  // login` could swap the bound tenant between the attesting whoami and the
+  // mutating register (a TOCTOU that would register in the second tenant).
+  const pinned = await resolveAuth();
+  if (pinned?.error) throw new ProfileBootstrapError("profile_agent_required");
+  const auth = pinned?.auth ?? null;
+  const identity = await call("whoami", {}, { auth });
+  const identityCode = typeof identity?.data?.code === "string" ? identity.data.code : null;
+  if (identityCode === "MCP_TENANT_SELECTION_REQUIRED" || identityCode === "MCP_TENANT_CONTEXT_IS_AUTH_ONLY") {
+    throw new ProfileBootstrapError("profile_tenant_selection_required");
+  }
+  const boundTenant = typeof identity?.data?.tenant_id === "string" ? identity.data.tenant_id : null;
+  if (!boundTenant) {
+    // whoami did not positively attest a tenant (transport/server error or a
+    // response without a string tenant_id) — refuse rather than register blind.
+    throw new ProfileBootstrapError("profile_tenant_unverified");
+  }
+  if (boundTenant !== profile.tenant) {
+    throw new ProfileBootstrapError("profile_credential_wrong_tenant");
+  }
   const args = {
     name: agentName,
     type: "codex",
-    tenant_id: profile.tenant,
     ...(reusableIdentity ? { agent_id: reusableIdentity } : {}),
   };
-  const response = await call("register_agent", args);
+  const response = await call("register_agent", args, { auth });
   const data = response?.data;
+  // Defense-in-depth: whoami above already gated on the tenant, so register_agent
+  // should not return a tenant-context error here — but if the contract drifts,
+  // surface its own actionable recovery, not the misleading
+  // `profile_agent_required` → `botbuddy login` loop that keeps failing because
+  // login itself is fine.
+  if (data?.code === "MCP_TENANT_CONTEXT_IS_AUTH_ONLY" || data?.code === "MCP_TENANT_SELECTION_REQUIRED") {
+    throw new ProfileBootstrapError("profile_tenant_selection_required");
+  }
   if (!response?.ok || (response.isError && data?.code !== "FRESH_CONNECTION_REQUIRED")) {
     throw new ProfileBootstrapError("profile_agent_required");
   }
@@ -126,6 +173,20 @@ export function profileBootstrapRecovery(code, profileName) {
   if (code === "profile_credential_persist_failed") {
     return `ensure ~/.botbuddy is writable and no other setup is running, then re-run: botbuddy profile setup ${profileName}`;
   }
+  if (code === "profile_tenant_unverified") {
+    // whoami could not confirm the bound tenant, so registration was refused
+    // before any mutation. Usually transient — retry; login only if it persists.
+    return `could not confirm your tenant with the server — retry: botbuddy profile setup ${profileName} (if it persists, run botbuddy login, then re-run setup)`;
+  }
+  if (code === "profile_tenant_selection_required") {
+    // Tenancy is chosen at MCP authentication (BOT-1416), not passed to
+    // register_agent. Point the user at selecting the profile's tenant when
+    // they sign in — never the bare login loop that implies login is broken.
+    const tenant = getAgentProfile(profileName)?.tenant;
+    return tenant
+      ? `sign in and select the "${tenant}" tenant during authentication, then re-run: botbuddy profile setup ${profileName}`
+      : `sign in and select the matching tenant during authentication, then re-run: botbuddy profile setup ${profileName}`;
+  }
   return `botbuddy login && botbuddy profile setup ${profileName}`;
 }