@tokenoftrust/cli 1.3.0-rc.3 → 1.3.0-rc.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "1.3.0-rc.3",
+  "version": "1.3.0-rc.4",
   "description": "Token of Trust developer CLI — check out a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/auth.mjs

@@ -119,6 +119,7 @@ export async function resolveDeveloperSession(client, env, deps = {}) {
         { hint: "run `tot login` to sign in again." },
       );
     }
+    const prior = creds;
     creds = credentialsFromToken({
       mcpUrl: creds.mcpUrl,
       clientId: creds.clientId,
@@ -128,6 +129,15 @@ export async function resolveDeveloperSession(client, env, deps = {}) {
       token: { ...refreshed, refresh_token: refreshed.refresh_token || creds.refreshToken },
       now,
     });
+    // credentialsFromToken only returns the OAuth shape — it knows nothing about
+    // activityToken/activityUrl, a SEPARATE credential (storefront-issued, cached
+    // by `tot login --code`; see token-store.mjs). Carry it across a silent
+    // refresh, or a routine near-expiry refresh permanently and silently kills
+    // the activity bridge (the invite code that could re-mint it is single-use).
+    if (prior.activityToken && prior.activityUrl) {
+      creds.activityToken = prior.activityToken;
+      creds.activityUrl = prior.activityUrl;
+    }
     writeCredentials(path, creds);
   }
 

package/src/commands/dev.mjs

@@ -240,7 +240,7 @@ function runMonorepo(ctx, argv) {
     console.error(`✗ expected the dev runner at ${script} but it's missing.`);
     return 2;
   }
-  const env = { ...process.env, ...activityBridgeEnv() };
+  const env = { ...process.env, ...activityBridgeEnv(process.env) };
   return new Promise((resolvePromise) => {
     const child = spawn(process.execPath, [script, ...argv], { stdio: "inherit", env });
     child.on("exit", (code) => resolvePromise(code ?? 0));
@@ -289,10 +289,24 @@ async function runNative(workspace, args, ctx) {
  * promise. Shared by the authenticated native path (runNative) and the
  * zero-login sample path (runSample) so both boot identically.
  */
-function bootNative(runnerDir, workspace, port, url, args) {
-  // activityBridgeEnv() is a no-op {} for the zero-login sample path (no cached
-  // credential exists there) — safe to always thread it through.
-  const handle = spawnNativeDev(runnerDir, workspace, port, { stdio: "inherit", env: activityBridgeEnv() });
+/**
+ * The env bootNative threads into the spawned runner. NEVER thread a real
+ * developer's activity-bridge credential into the zero-login --sample run:
+ * activityBridgeEnv() reads ~/.tot/credentials.json unconditionally, so a
+ * developer who's ever run `tot login --code` and then runs `tot dev --sample`
+ * (the "free taste"/demo path) would otherwise leak their real credential,
+ * posting fake sample-store activity to their real hosted /dev panel —
+ * contradicting the sample banner's "no login, no ToT account, nothing
+ * published" claim. Exported + pure (besides the credentials-file read) so
+ * this gate is testable without spawning a real process.
+ * @param {{ sample?: boolean }} args
+ */
+export function bootNativeEnv(args) {
+  return args.sample ? {} : activityBridgeEnv();
+}
+
+export function bootNative(runnerDir, workspace, port, url, args) {
+  const handle = spawnNativeDev(runnerDir, workspace, port, { stdio: "inherit", env: bootNativeEnv(args) });
 
   // Auto-open the browser the moment the server answers (D). Non-blocking so
   // Ctrl-C / logs are unaffected; --no-open suppresses it.

package/src/commands/login.mjs

@@ -100,8 +100,9 @@ export async function loginAndCache(mcpUrl, env = process.env, { log = () => {},
       creds = await deviceLoginFlow({ mcpUrl, clientId, log });
     }
   }
-  writeCredentials(path, creds);
-  return creds;
+  const merged = mergeActivityBridge(prior, mcpUrl, creds);
+  writeCredentials(path, merged);
+  return merged;
 }
 
 /**
@@ -115,7 +116,24 @@ export async function redeemAndCache(mcpUrl, code, env = process.env) {
   const prior = readCredentials(path);
   const clientId = prior && prior.mcpUrl === mcpUrl ? prior.clientId : undefined;
   const creds = await redeemCodeFlow({ mcpUrl, clientId, code });
-  writeCredentials(path, creds);
+  const merged = mergeActivityBridge(prior, mcpUrl, creds);
+  writeCredentials(path, merged);
+  return merged;
+}
+
+/**
+ * `loginFlow`/`deviceLoginFlow`/`redeemCodeFlow` all return the bare OAuth shape —
+ * none of them know about activityToken/activityUrl, a SEPARATE credential this
+ * same file caches via cacheActivityBridge. A bare re-login (no --code) after a
+ * prior --code sign-in would otherwise silently drop it on the next `writeCredentials`
+ * (a full-object overwrite, not a merge) — carry it forward when re-authing against
+ * the SAME mcpUrl (a different MCP means a different session; the old bridge
+ * credential no longer applies).
+ */
+export function mergeActivityBridge(prior, mcpUrl, creds) {
+  if (prior?.mcpUrl === mcpUrl && prior.activityToken && prior.activityUrl) {
+    return { ...creds, activityToken: prior.activityToken, activityUrl: prior.activityUrl };
+  }
   return creds;
 }
 

package/src/commands/start.mjs

@@ -436,7 +436,12 @@ async function prefetchRuntime(client, devArgs, env, runtime, ctx) {
       console.log(`  ~ entitled renderer unavailable (${e.message}) — using the public runner (no Docker).`);
       runtime.runnerDir = await ensureSampleRenderer(devArgs, ctx, { env });
     } catch (e2) {
-      console.log(`  ~ public runner unavailable (${e2?.message || e2}) — falling back to the Docker runner.`);
+      // Only an actual "can't reach the public runner" failure should fall to
+      // Docker — anything else (a real bug in ensureSampleRenderer/pickRunnerVersion,
+      // say) would otherwise be silently masked behind a confusing Docker fallback
+      // that may not even be installed. Mirrors dev.mjs's runStandalone.
+      if (!(e2 instanceof NativeArtifactUnavailableError)) throw e2;
+      console.log(`  ~ public runner unavailable (${e2.message}) — falling back to the Docker runner.`);
       runtime.useDocker = true;
       await prefetchDockerLogin(client, devArgs, env);
     }