@tokenoftrust/cli 1.3.0-rc.2 → 1.3.0-rc.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "1.3.0-rc.2",
+  "version": "1.3.0-rc.4",
   "description": "Token of Trust developer CLI — check out a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/auth.mjs

@@ -119,6 +119,7 @@ export async function resolveDeveloperSession(client, env, deps = {}) {
         { hint: "run `tot login` to sign in again." },
       );
     }
+    const prior = creds;
     creds = credentialsFromToken({
       mcpUrl: creds.mcpUrl,
       clientId: creds.clientId,
@@ -128,6 +129,15 @@ export async function resolveDeveloperSession(client, env, deps = {}) {
       token: { ...refreshed, refresh_token: refreshed.refresh_token || creds.refreshToken },
       now,
     });
+    // credentialsFromToken only returns the OAuth shape — it knows nothing about
+    // activityToken/activityUrl, a SEPARATE credential (storefront-issued, cached
+    // by `tot login --code`; see token-store.mjs). Carry it across a silent
+    // refresh, or a routine near-expiry refresh permanently and silently kills
+    // the activity bridge (the invite code that could re-mint it is single-use).
+    if (prior.activityToken && prior.activityUrl) {
+      creds.activityToken = prior.activityToken;
+      creds.activityUrl = prior.activityUrl;
+    }
     writeCredentials(path, creds);
   }
 

package/src/commands/dev.mjs

@@ -205,23 +205,42 @@ async function runNativePublic(workspace, args, ctx) {
   return bootNative(runnerDir, workspace, port, url, args);
 }
 
+/**
+ * Read the hosted-activity-bridge credential (minted alongside the invite's
+ * browserless `tot login --code` paste — see login.mjs's cacheActivityBridge)
+ * and shape it as the two env vars dev-loop-state.mjs's postActivity reads.
+ * Returns {} when absent (an older cached session, a bare `tot login`, or the
+ * zero-login --sample path) — the local loop runs exactly the same either way,
+ * it just has no hosted signal to report. EVERY path that spawns the runner
+ * (native monorepo, native standalone, Docker) must thread this in, or the
+ * developer's hosted /dev panel never lights up even though they cached a
+ * valid bridge credential at login.
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {{TOT_DEV_ACTIVITY_TOKEN?: string, TOT_DEV_ACTIVITY_URL?: string}}
+ */
+export function activityBridgeEnv(env = process.env) {
+  const creds = readCredentials(defaultCredentialsPath(env));
+  if (!creds?.activityToken || !creds?.activityUrl) return {};
+  return { TOT_DEV_ACTIVITY_TOKEN: creds.activityToken, TOT_DEV_ACTIVITY_URL: creds.activityUrl };
+}
+
+/**
+ * Flatten an env object into repeated `-e KEY=VAL` docker-run args. Pure, so the
+ * Docker activity-bridge threading is testable without a real Docker daemon.
+ * @param {Record<string, string>} env
+ * @returns {string[]}
+ */
+export function dockerEnvArgs(env) {
+  return Object.entries(env).flatMap(([k, v]) => ["-e", `${k}=${v}`]);
+}
+
 function runMonorepo(ctx, argv) {
   const script = join(ctx.repoRoot, "scripts", "tot-dev.mjs");
   if (!existsSync(script)) {
     console.error(`✗ expected the dev runner at ${script} but it's missing.`);
     return 2;
   }
-  // Thread the hosted-activity-bridge credential (if this cached session has one —
-  // minted alongside the invite's cli-signin-code paste) so the spawned tot-dev.mjs
-  // can report file-save activity up to the developer's own hosted /dev panel.
-  // Best-effort: an older cached session (or a bare `tot login`) simply has
-  // neither field, and the local loop runs exactly as before with no hosted signal.
-  const creds = readCredentials(defaultCredentialsPath(process.env));
-  const env = { ...process.env };
-  if (creds?.activityToken && creds?.activityUrl) {
-    env.TOT_DEV_ACTIVITY_TOKEN = creds.activityToken;
-    env.TOT_DEV_ACTIVITY_URL = creds.activityUrl;
-  }
+  const env = { ...process.env, ...activityBridgeEnv(process.env) };
   return new Promise((resolvePromise) => {
     const child = spawn(process.execPath, [script, ...argv], { stdio: "inherit", env });
     child.on("exit", (code) => resolvePromise(code ?? 0));
@@ -270,8 +289,24 @@ async function runNative(workspace, args, ctx) {
  * promise. Shared by the authenticated native path (runNative) and the
  * zero-login sample path (runSample) so both boot identically.
  */
-function bootNative(runnerDir, workspace, port, url, args) {
-  const handle = spawnNativeDev(runnerDir, workspace, port, { stdio: "inherit" });
+/**
+ * The env bootNative threads into the spawned runner. NEVER thread a real
+ * developer's activity-bridge credential into the zero-login --sample run:
+ * activityBridgeEnv() reads ~/.tot/credentials.json unconditionally, so a
+ * developer who's ever run `tot login --code` and then runs `tot dev --sample`
+ * (the "free taste"/demo path) would otherwise leak their real credential,
+ * posting fake sample-store activity to their real hosted /dev panel —
+ * contradicting the sample banner's "no login, no ToT account, nothing
+ * published" claim. Exported + pure (besides the credentials-file read) so
+ * this gate is testable without spawning a real process.
+ * @param {{ sample?: boolean }} args
+ */
+export function bootNativeEnv(args) {
+  return args.sample ? {} : activityBridgeEnv();
+}
+
+export function bootNative(runnerDir, workspace, port, url, args) {
+  const handle = spawnNativeDev(runnerDir, workspace, port, { stdio: "inherit", env: bootNativeEnv(args) });
 
   // Auto-open the browser the moment the server answers (D). Non-blocking so
   // Ctrl-C / logs are unaffected; --no-open suppresses it.
@@ -758,17 +793,19 @@ function runPnpmInstall(runnerDir) {
  * auto-open-browser logic works unchanged for either runtime. Exported (and
  * `stdio` overridable) so `tot start` can pipe the logs instead of inheriting.
  */
-export function spawnNativeDev(runnerDir, workspace, port, { stdio = "inherit" } = {}) {
+export function spawnNativeDev(runnerDir, workspace, port, { stdio = "inherit", env = {} } = {}) {
   const script = join(runnerDir, "scripts", "tot-dev.mjs");
   // Translate the same "inherit"|"piped" contract spawnDevContainer honors:
   // "piped" means stdin ignored + stdout/stderr captured so `tot start` can hold
   // the prompt on stdin and stream the logs after the aha. child_process.spawn
   // doesn't understand the bare string "piped", so map it to the array here.
   const stdioArr = stdio === "piped" ? ["ignore", "pipe", "pipe"] : stdio;
+  // `env` (e.g. activityBridgeEnv()) merges OVER process.env — {} is a pure
+  // passthrough, identical to the old no-env-key behavior.
   const child = spawn(
     process.execPath,
     [script, "--workspace", workspace, "--port", port],
-    { cwd: runnerDir, stdio: stdioArr },
+    { cwd: runnerDir, stdio: stdioArr, env: { ...process.env, ...env } },
   );
   const handle = { child, exited: false, done: null };
   handle.done = new Promise((resolvePromise) => {
@@ -874,6 +911,10 @@ export function buildContainerPlan(workspace, args, _ctx) {
     "CHOKIDAR_USEPOLLING=1",
     "-e",
     "CHOKIDAR_INTERVAL=300",
+    // Docker containers don't inherit the host env — thread the activity-bridge
+    // credential explicitly (see activityBridgeEnv), or the Docker runtime never
+    // reports to the developer's hosted /dev panel even when native would.
+    ...dockerEnvArgs(activityBridgeEnv()),
     image,
   ];
 

package/src/commands/login.mjs

@@ -100,8 +100,9 @@ export async function loginAndCache(mcpUrl, env = process.env, { log = () => {},
       creds = await deviceLoginFlow({ mcpUrl, clientId, log });
     }
   }
-  writeCredentials(path, creds);
-  return creds;
+  const merged = mergeActivityBridge(prior, mcpUrl, creds);
+  writeCredentials(path, merged);
+  return merged;
 }
 
 /**
@@ -115,7 +116,24 @@ export async function redeemAndCache(mcpUrl, code, env = process.env) {
   const prior = readCredentials(path);
   const clientId = prior && prior.mcpUrl === mcpUrl ? prior.clientId : undefined;
   const creds = await redeemCodeFlow({ mcpUrl, clientId, code });
-  writeCredentials(path, creds);
+  const merged = mergeActivityBridge(prior, mcpUrl, creds);
+  writeCredentials(path, merged);
+  return merged;
+}
+
+/**
+ * `loginFlow`/`deviceLoginFlow`/`redeemCodeFlow` all return the bare OAuth shape —
+ * none of them know about activityToken/activityUrl, a SEPARATE credential this
+ * same file caches via cacheActivityBridge. A bare re-login (no --code) after a
+ * prior --code sign-in would otherwise silently drop it on the next `writeCredentials`
+ * (a full-object overwrite, not a merge) — carry it forward when re-authing against
+ * the SAME mcpUrl (a different MCP means a different session; the old bridge
+ * credential no longer applies).
+ */
+export function mergeActivityBridge(prior, mcpUrl, creds) {
+  if (prior?.mcpUrl === mcpUrl && prior.activityToken && prior.activityUrl) {
+    return { ...creds, activityToken: prior.activityToken, activityUrl: prior.activityUrl };
+  }
   return creds;
 }
 

package/src/commands/start.mjs

@@ -60,7 +60,7 @@ import {
   buildContainerPlan, spawnDevContainer, dockerAvailable, tryStartDocker,
   resolveDevImage, isPrivateRegistryImage, ensureRegistryLogin,
   ensureRendererArtifact, ensureSampleRenderer, spawnNativeDev, deriveUrl,
-  NativeArtifactUnavailableError,
+  activityBridgeEnv, NativeArtifactUnavailableError,
 } from "./dev.mjs";
 import { scaffoldSample, isSampleCheckout, sampleConfig, SAMPLE_DIR_NAME } from "../sample.mjs";
 import { IDEAS } from "./ideas.mjs";
@@ -233,7 +233,7 @@ export async function run(argv, ctx) {
     } else {
       url = deriveUrl(ctxDev.config || {}, devArgs.port).url;
       console.log(`  → starting dev … ${url}`);
-      handle = spawnNativeDev(runtime.runnerDir, dir, devArgs.port, { stdio: "piped" });
+      handle = spawnNativeDev(runtime.runnerDir, dir, devArgs.port, { stdio: "piped", env: activityBridgeEnv(env) });
     }
 
     const up = await Promise.race([
@@ -436,7 +436,12 @@ async function prefetchRuntime(client, devArgs, env, runtime, ctx) {
       console.log(`  ~ entitled renderer unavailable (${e.message}) — using the public runner (no Docker).`);
       runtime.runnerDir = await ensureSampleRenderer(devArgs, ctx, { env });
     } catch (e2) {
-      console.log(`  ~ public runner unavailable (${e2?.message || e2}) — falling back to the Docker runner.`);
+      // Only an actual "can't reach the public runner" failure should fall to
+      // Docker — anything else (a real bug in ensureSampleRenderer/pickRunnerVersion,
+      // say) would otherwise be silently masked behind a confusing Docker fallback
+      // that may not even be installed. Mirrors dev.mjs's runStandalone.
+      if (!(e2 instanceof NativeArtifactUnavailableError)) throw e2;
+      console.log(`  ~ public runner unavailable (${e2.message}) — falling back to the Docker runner.`);
       runtime.useDocker = true;
       await prefetchDockerLogin(client, devArgs, env);
     }

package/src/token-store.mjs

@@ -14,8 +14,9 @@
  * to a different one. `activityToken`/`activityUrl` are a SEPARATE credential
  * (storefront-issued, not MCP OAuth) that `tot login --code` caches when the
  * invite paste carries it — see commands/login.mjs `cacheActivityBridge` and
- * commands/dev.mjs `runMonorepo`, which threads them to the local dev-loop
- * process so it can report file saves to the developer's hosted /dev panel.
+ * commands/dev.mjs `activityBridgeEnv`, which every runner-spawning path (native
+ * monorepo, native standalone, Docker) threads in so the local dev-loop process
+ * can report file saves to the developer's hosted /dev panel.
  * Dependency-free (node:fs/os/path).
  *
  * `TOT_HOME` overrides the home dir (used by tests to point at a temp dir).