@tokenoftrust/cli 1.0.0

package/src/commands/checkout.mjs

@@ -0,0 +1,233 @@
+/**
+ * `tot checkout` — clone the tenant store you're entitled to build on, with an
+ * authenticated remote already configured, ready for the local loop.
+ *
+ *   tot checkout                      list the stores you can build on
+ *   tot checkout <tenant>             show the checkout for <tenant>
+ *   tot checkout <tenant> --clone DIR clone it to DIR with an authed remote
+ *
+ * This is the SAME MCP code path a developer/operator gets when they switch to a
+ * tenant: credential/sign-in → client_switch(tenant) → tenant_checkout, where
+ * the MCP derives your per-tenant Git user and mints a FRESH, single-active,
+ * repo-scoped push credential (a later checkout for the same tenant rotates it).
+ * `tot` performs NO privileged forge work itself — the MCP owns that.
+ *
+ * Auth is resolved through src/auth.mjs: operator creds (our dogfooding / CI) or
+ * the developer's own ToT identity (workstream #2). This command doesn't care
+ * which — it just needs a validated session.
+ *
+ * Dependency-free (global fetch + `git` via child_process).
+ */
+import { execFileSync } from "node:child_process";
+import { createMcpClient } from "../mcp.mjs";
+import { resolveSession, AuthUnavailableError } from "../auth.mjs";
+import { CliError, fail, formatError } from "../errors.mjs";
+
+const DEFAULT_MCP_URL = "https://mcp.tokenoftrust.com";
+
+function parseArgs(argv) {
+  const a = {
+    tenant: null,
+    tag: "main",
+    clone: null,
+    mcp: null,
+    identity: null, // "operator" | "developer" — override auto-selection
+    printRemote: false,
+    help: false,
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const t = argv[i];
+    if (t === "--tag") a.tag = argv[++i];
+    else if (t === "--clone") a.clone = argv[++i];
+    else if (t === "--mcp") a.mcp = argv[++i];
+    else if (t === "--identity") a.identity = argv[++i];
+    else if (t === "--print-remote") a.printRemote = true;
+    else if (t === "--help" || t === "-h") a.help = true;
+    else if (!t.startsWith("--") && !a.tenant) a.tenant = t;
+  }
+  return a;
+}
+
+const USAGE = `tot checkout — clone a tenant store you can build on
+
+  tot checkout                        list the stores you can build on
+  tot checkout <tenant>               show the checkout for <tenant>
+  tot checkout <tenant> --clone <dir> clone it locally (authenticated remote configured)
+
+Options:
+  --tag <tag>       which repo (repo = "<tenant>-<tag>"). Default: main.
+  --clone <dir>     git clone the authenticated remote into <dir>.
+  --mcp <url>       MCP base URL. Default: env MCP_BASE_URL / TOT_MCP_URL, else
+                    ${DEFAULT_MCP_URL}.
+  --identity <who>  force "operator" or "developer" auth (default: auto).
+  --print-remote    also print the authenticated remote (contains a live token!).`;
+
+/** Redact known secrets from any string before it hits the terminal. */
+function makeRedactor(env) {
+  const secrets = [env.TOT_API_KEY, env.TOT_SECRET_KEY].filter(Boolean);
+  return (s) => {
+    let o = String(s);
+    for (const x of secrets) o = o.split(x).join("***");
+    return o;
+  };
+}
+
+/**
+ * @param {string[]} argv - args AFTER `checkout`
+ * @param {import("../context.mjs").detectContext extends (...a:any)=>infer R ? R : any} ctx
+ */
+export async function run(argv, ctx) {
+  const env = process.env;
+  const args = parseArgs(argv);
+  if (args.help) {
+    console.log(USAGE);
+    return 0;
+  }
+
+  // Infer the tenant from a standalone checkout when run without one.
+  if (!args.tenant && ctx.mode === "checkout" && ctx.tenant) {
+    args.tenant = ctx.tenant;
+  }
+
+  const baseUrl = args.mcp || env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
+  const redact = makeRedactor(env);
+  const client = createMcpClient(baseUrl);
+
+  try {
+    await client.initialize();
+    const session = await resolveSession(client, {
+      env,
+      prefer: args.identity || undefined,
+    });
+    console.error(`~ signed in (${session.identity}) → ${client.mcpUrl}`);
+
+    // No tenant → list the stores this identity can build on and stop.
+    if (!args.tenant) {
+      const list = await client.callTool("client_list", {});
+      printClientList(list);
+      return 0;
+    }
+
+    console.error(`~ client_switch → ${args.tenant}`);
+    console.error(
+      `~ tenant_checkout (tag=${args.tag}) — MCP mints a fresh repo-scoped credential`,
+    );
+    const res = await checkoutTenant(client, {
+      tenant: args.tenant,
+      tag: args.tag,
+      cloneDir: args.clone || null,
+      redact,
+    });
+    console.log(`\n+ checkout ready. repo: ${res.cloneUrl || res.publicUrl}`);
+
+    if (res.cloned) {
+      console.log(`+ cloned. HEAD: ${res.head}`);
+      console.log(`\nYour local working clone is at ${res.dir} with an authenticated remote.`);
+      console.log(`  cd ${res.dir} && tot dev            # run it locally with save→reload`);
+      console.log(`  (the minted token lives in .git/config; a later checkout rotates it)`);
+      return 0;
+    }
+
+    console.log(`\nPublic clone URL (no credential): ${res.publicUrl}`);
+    console.log(`Re-run with --clone <dir> to clone with the authenticated remote configured.`);
+    if (args.printRemote) {
+      console.log(
+        `\nAUTHENTICATED remote (contains a live token — handle carefully):\n${res.gitRemote}`,
+      );
+    }
+    return 0;
+  } catch (e) {
+    if (e instanceof AuthUnavailableError) {
+      console.error(formatError(e));
+      return 1;
+    }
+    if (e instanceof CliError) {
+      console.error(formatError(e));
+      return e.exitCode ?? 1;
+    }
+    console.error(fail(`checkout failed: ${redact(String(e?.message || e))}`));
+    return 1;
+  }
+}
+
+/**
+ * The privileged checkout core, composable in-process (used by `tot checkout`
+ * and by `tot start`): client_switch → tenant_checkout → optionally clone. The
+ * MCP mints a fresh, repo-scoped push credential each time. Assumes `client` is
+ * already initialized + has a validated session.
+ *
+ * @param {ReturnType<import("../mcp.mjs").createMcpClient>} client
+ * @param {{ tenant: string, tag?: string, cloneDir?: string|null, redact?: (s:string)=>string }} opts
+ * @returns {Promise<{ gitRemote: string, cloneUrl: string|null, publicUrl: string,
+ *   cloned: boolean, dir: string|null, head: string|null }>}
+ */
+export async function checkoutTenant(client, { tenant, tag = "main", cloneDir = null, redact = (s) => s }) {
+  await client.callTool("client_switch", { tenant });
+  const checkout = await client.callTool("tenant_checkout", { tenant, tag });
+
+  const gitRemote = checkout?.gitRemote;
+  const cloneUrl = checkout?.cloneUrl ?? null;
+  if (!gitRemote) {
+    throw new CliError(
+      `tenant_checkout returned no gitRemote for ${tenant}: ${redact(JSON.stringify(checkout))}`,
+      { next: "confirm you're entitled to this store — `tot checkout` (lists your stores)" },
+    );
+  }
+  const u = new URL(gitRemote);
+  const publicUrl = `${u.protocol}//${u.host}${u.pathname}`;
+
+  if (!cloneDir) {
+    return { gitRemote, cloneUrl, publicUrl, cloned: false, dir: null, head: null };
+  }
+  const { dir, head } = cloneRepo(gitRemote, cloneDir, redact);
+  return { gitRemote, cloneUrl, publicUrl, cloned: true, dir, head };
+}
+
+/** git clone the authenticated remote into `dir`. Throws CliError on failure. */
+function cloneRepo(gitRemote, dir, redact) {
+  const git = (cargs) =>
+    execFileSync("git", cargs, { stdio: ["ignore", "pipe", "pipe"] }).toString();
+  console.log(`+ git clone → ${dir}`);
+  try {
+    git(["clone", gitRemote, dir]);
+  } catch (e) {
+    throw new CliError(`clone failed: ${redact(String(e.stderr || e.message || e))}`, {
+      next: `check the target dir is empty and you can reach the remote, then re-run`,
+    });
+  }
+  const head = git(["-C", dir, "log", "-1", "--oneline"]).trim();
+  return { dir, head };
+}
+
+/**
+ * Normalize the (shape-varying) `client_list` response into a plain, sorted
+ * list of the stores this identity can build on. Shared by `tot checkout`'s
+ * listing and `tot start`'s auto-pick so both read the same fields.
+ * @param {unknown} list
+ * @returns {Array<{ id: string, name: string, raw: any }>}
+ */
+export function normalizeStores(list) {
+  const rows = Array.isArray(list) ? list : list?.clients || list?.tenants || [];
+  if (!Array.isArray(rows)) return [];
+  return rows
+    .map((r) => ({
+      id: r?.tenant || r?.id || r?.clientId || r?.appDomain || null,
+      name: r?.displayName || r?.name || "",
+      raw: r,
+    }))
+    .filter((r) => r.id);
+}
+
+function printClientList(list) {
+  const stores = normalizeStores(list);
+  if (stores.length === 0) {
+    console.log("\nNo stores available to build on for this identity yet.");
+    if (list && !Array.isArray(list)) console.log(JSON.stringify(list, null, 2));
+    return;
+  }
+  console.log("\nStores you can build on:\n");
+  for (const s of stores) {
+    console.log(`  ${s.id}${s.name ? `  — ${s.name}` : ""}`);
+  }
+  console.log(`\nNext:  tot checkout <tenant> --clone <dir>`);
+}