@tokenoftrust/cli 1.3.1-rc.1 → 1.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "1.3.1-rc.1",
+  "version": "1.3.2",
   "description": "Token of Trust developer CLI — check out a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",
@@ -36,6 +36,7 @@
     "registry": "https://registry.npmjs.org"
   },
   "scripts": {
-    "test": "node --test"
+    "test": "node --test",
+    "prepublishOnly": "node ../../scripts/build/check-cli-clean.mjs ."
   }
 }

package/src/commands/dev.mjs

@@ -49,6 +49,7 @@ import {
   scaffoldSample, isSampleCheckout, sampleConfig,
   resolveRendererSource as resolveLocalRendererSource, newestCachedRunner, SAMPLE_DIR_NAME,
 } from "../sample.mjs";
+import { startHeartbeatFromEnv } from "../dev-heartbeat.mjs";
 
 /** The published runner image (--docker fallback). Override with --image / TOT_DEV_IMAGE. */
 const DEFAULT_DEV_IMAGE =
@@ -307,7 +308,14 @@ export function bootNativeEnv(args) {
 }
 
 export function bootNative(runnerDir, workspace, port, url, args) {
-  const handle = spawnNativeDev(runnerDir, workspace, port, { stdio: "inherit", env: bootNativeEnv(args) });
+  const bridgeEnv = bootNativeEnv(args);
+  const handle = spawnNativeDev(runnerDir, workspace, port, { stdio: "inherit", env: bridgeEnv });
+
+  // Heartbeat the hosted cockpit (G1) with the CLI version + this live localhost
+  // URL while the runner runs — CLI-side, using the SAME bridge credential the
+  // runner's file-save path uses (no-op in --sample, which threads no credential).
+  const stopHeartbeat = startHeartbeatFromEnv(bridgeEnv, { url });
+  handle.done.finally(() => stopHeartbeat());
 
   // Auto-open the browser the moment the server answers (D). Non-blocking so
   // Ctrl-C / logs are unaffected; --no-open suppresses it.
@@ -986,6 +994,12 @@ async function runContainer(workspace, args, ctx) {
 
   const handle = await spawnDevContainer(plan, args, { stdio: "inherit" });
 
+  // Heartbeat the hosted cockpit (G1) CLI-side while the container runs — the
+  // container reports file-saves via the threaded env, but the CLI owns the
+  // version + live URL. Same bridge credential (activityBridgeEnv), no-op absent.
+  const stopHeartbeat = startHeartbeatFromEnv(activityBridgeEnv(), { url: plan.url });
+  handle.done.finally(() => stopHeartbeat());
+
   // Auto-open the browser the moment the server answers (D). Non-blocking so
   // Ctrl-C / logs are unaffected; --no-open suppresses it.
   if (!args.noOpen) {

package/src/commands/start.mjs

@@ -64,6 +64,7 @@ import {
   activityBridgeEnv, NativeArtifactUnavailableError,
 } from "./dev.mjs";
 import { scaffoldSample, isSampleCheckout, sampleConfig, SAMPLE_DIR_NAME } from "../sample.mjs";
+import { startHeartbeatFromEnv } from "../dev-heartbeat.mjs";
 import { IDEAS } from "./ideas.mjs";
 
 const DEFAULT_MCP_URL = "https://mcp.tokenoftrust.com";
@@ -226,6 +227,7 @@ export async function run(argv, ctx) {
     // above; wait for the server, open the browser (C/D).
     const ctxDev = detectContext(dir);
     let url, handle;
+    const bridgeEnv = activityBridgeEnv(env);
     if (runtime.useDocker) {
       const plan = buildContainerPlan(dir, devArgs, ctxDev);
       url = plan.url;
@@ -234,9 +236,15 @@ export async function run(argv, ctx) {
     } else {
       url = deriveUrl(ctxDev.config || {}, devArgs.port).url;
       console.log(`  → starting dev … ${url}`);
-      handle = spawnNativeDev(runtime.runnerDir, dir, devArgs.port, { stdio: "piped", env: activityBridgeEnv(env) });
+      handle = spawnNativeDev(runtime.runnerDir, dir, devArgs.port, { stdio: "piped", env: bridgeEnv });
     }
 
+    // Heartbeat the hosted cockpit (G1) with the CLI version + this live localhost
+    // URL for the life of the run — CLI-side, using the cached bridge credential
+    // (no-op when none is cached). The runner keeps reporting file-saves itself.
+    const stopHeartbeat = startHeartbeatFromEnv(bridgeEnv, { url });
+    handle.done.finally(() => stopHeartbeat());
+
     // The runner's stdio is "piped" (its logs are held until the aha), so this
     // boot would otherwise be a silent 5–60s gap. Tick a spinner over it.
     const up = await waitForBoot(url, handle);
@@ -666,23 +674,28 @@ function connectClaude() {
  * hidden. Ctrl-C still tears the server down (the child owns the TTY signals).
  */
 function streamDevLogs(child) {
-  // Startup churn + tool internals — never user-facing.
+  // Startup churn + tool internals — never user-facing. Matched AFTER stripping
+  // the runner/Vite "HH:MM:SS " timestamp prefix (see `body` below), so a
+  // timestamped internal line like "10:50:17 [vite] connected" is still dropped.
   const NOISE =
-    /^\s*(\[@astrojs|astro\s+v[\d.]|┃|▲|watching for file changes|Scope: all \d|copy-tenant-assets:|.*dependency optimized|.*optimized dependencies changed|.*program reload|\[vite\] connected|\d+ deprecated|Packages:\s*\+|Progress:\s*resolved|Downloading @|node_modules\/|devDependencies:|\+\s+\w+@|Done in \d)/i;
+    /^(\[vite\]|\[types\]|\[@astrojs|\[WARN\]|▲|┃|astro\s+v[\d.]|(Local|Network)\s+http|watching for file changes|Scope: all \d|copy-tenant-assets:|.*dependency optimized|.*optimized dependencies changed|.*program reload|\d+ deprecated|Packages:\s*\+|Progress:\s*resolved|Downloading @|node_modules\/|devDependencies:|\+\s+\w+@|Done in \d)/i;
   // A real save-triggered reload (not startup "program reload" churn).
   const RELOAD = /(hmr update|page reload)/i;
   let reloadPending = null;
   const emit = (line) => {
     const t = line.replace(/\s+$/, "");
     if (!t) return;
-    if (RELOAD.test(t)) {
+    // The runner/Vite prefix most lines with an "HH:MM:SS " (or ".mmm ")
+    // timestamp — strip it before matching so the filters catch them.
+    const body = t.replace(/^\d{1,2}:\d{2}:\d{2}(\.\d+)?\s+/, "").replace(/^\s+/, "");
+    if (RELOAD.test(body)) {
       if (reloadPending) return; // debounce a burst into one line
       reloadPending = setTimeout(() => { reloadPending = null; }, 1000);
       if (reloadPending.unref) reloadPending.unref();
       process.stdout.write("  ↻ your store reloaded\n");
       return;
     }
-    if (NOISE.test(t)) return;
+    if (NOISE.test(body)) return;
     process.stdout.write(`  ${t}\n`);
   };
   lineStream(child.stdout, emit);

package/src/dev-heartbeat.mjs

@@ -0,0 +1,92 @@
+/**
+ * CLI-side heartbeat for the local→hosted activity bridge (G1).
+ *
+ * While `tot dev` / `tot start` is running, the CLI (which knows its own
+ * version, the resolved runner version, the port + tenant, and the cached
+ * activity-bridge credential) POSTs a periodic heartbeat to the hosted
+ * `/api/dev/activity` endpoint. The hosted cockpit turns the latest heartbeat
+ * into a LIVE, clickable local-dev link + the running CLI version.
+ *
+ * It emits CLI-side (not from the runner) because the CLI is the one process
+ * that holds ALL of {version, port, tenant, bridge credential} — the runner
+ * keeps emitting file-save events as before. Same bearer + same endpoint as the
+ * file-save path; no new secret.
+ *
+ * Contract (identical posture to the runner's file-save bridge): best-effort,
+ * NEVER throws or blocks, the interval timer is unref'd so it can't hold the
+ * process open, and with no bridge credential (a bare `tot login`, an older
+ * session, or the zero-login `--sample` path) it's a silent no-op.
+ * Dependency-free (global fetch, Node 20+).
+ */
+import { CLI_VERSION, clientPackages } from "./mcp.mjs";
+
+/** ~10s between beats — frequent enough that the cockpit's ~30s live window
+ * tolerates a missed beat without the badge flapping, cheap enough to ignore. */
+const HEARTBEAT_INTERVAL_MS = 10_000;
+
+/**
+ * POST one heartbeat body, best-effort. No-op (returns undefined) without both
+ * an activity URL and a bearer token. Never throws — a failed/offline hosted
+ * worker just means the cockpit doesn't light up this beat.
+ * @param {{ activityUrl?: string, token?: string, url?: string,
+ *   cliVersion?: string, runnerVersion?: string|null }} args
+ */
+export function postHeartbeat({ activityUrl, token, url, cliVersion, runnerVersion } = {}) {
+  if (!activityUrl || !token) return undefined;
+  /** @type {Record<string, unknown>} */
+  const body = { event: "heartbeat", cliVersion, at: Date.now() };
+  if (runnerVersion) body.runnerVersion = runnerVersion;
+  if (url) body.url = url;
+  return fetch(`${String(activityUrl).replace(/\/+$/, "")}/api/dev/activity`, {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+    body: JSON.stringify(body),
+  }).catch(() => {
+    /* best-effort — hosted panel just won't show this beat */
+  });
+}
+
+/**
+ * Start beating every `intervalMs` until the returned stop() is called. Fires
+ * one beat IMMEDIATELY so the cockpit lights up without waiting a full interval.
+ * Returns a no-op stop() when there's no bridge credential (sample / not-signed-
+ * in), so callers can wire it unconditionally.
+ * @param {{ activityUrl?: string, token?: string, url?: string,
+ *   cliVersion?: string, runnerVersion?: string|null, intervalMs?: number }} [opts]
+ * @returns {() => void} stop the heartbeat (idempotent).
+ */
+export function startDevHeartbeat({
+  activityUrl,
+  token,
+  url,
+  cliVersion = CLI_VERSION,
+  runnerVersion,
+  intervalMs = HEARTBEAT_INTERVAL_MS,
+} = {}) {
+  if (!activityUrl || !token) return () => {}; // no bridge / sample mode → no-op
+  const beat = () => postHeartbeat({ activityUrl, token, url, cliVersion, runnerVersion });
+  beat();
+  const timer = setInterval(beat, intervalMs);
+  if (typeof timer.unref === "function") timer.unref();
+  return () => clearInterval(timer);
+}
+
+/**
+ * Convenience wrapper for the runner-spawn sites: start a heartbeat from the
+ * same bridge env that's threaded to the runner ({TOT_DEV_ACTIVITY_URL,
+ * TOT_DEV_ACTIVITY_TOKEN}, or {} for the `--sample` path — which yields a no-op,
+ * exactly the desired "never leak a real credential from sample" behavior). The
+ * runner version defaults to whatever `tot dev` resolved this invocation
+ * (clientPackages().runner — null until the runner is resolved).
+ * @param {{ TOT_DEV_ACTIVITY_URL?: string, TOT_DEV_ACTIVITY_TOKEN?: string }} bridgeEnv
+ * @param {{ url?: string, runnerVersion?: string|null }} [opts]
+ * @returns {() => void} stop the heartbeat.
+ */
+export function startHeartbeatFromEnv(bridgeEnv, { url, runnerVersion } = {}) {
+  return startDevHeartbeat({
+    activityUrl: bridgeEnv?.TOT_DEV_ACTIVITY_URL,
+    token: bridgeEnv?.TOT_DEV_ACTIVITY_TOKEN,
+    url,
+    runnerVersion: runnerVersion ?? clientPackages().runner,
+  });
+}

package/src/sample.mjs

@@ -9,16 +9,19 @@
  * regulated tenant's identity so the runner's tenant registry resolves it with
  * its `compliance` block on.
  *
- * WHY GIANTVAPES (not a novel synthetic domain): compliance + catalog are
- * resolved by the RUNNER's tenant registry (apps/storefront/src/config/tenants.ts),
- * keyed by domain. `giantvapes.com` is a registered 21+/PACT vape store WITH a
- * `compliance` block and a 50-product catalog fixture baked into the runner, so
- * the sample lights up age-gate + nicotine warning + a populated catalog with
- * zero server. A truly novel domain (e.g. "sample.example") is unclaimed → the
- * runner falls back to HOME_TENANT (siteType "marketing", NO compliance, empty
- * catalog), which would defeat the whole "the free taste still does compliance"
- * goal — so we deliberately borrow giantvapes' identity for the sample. It's the
- * smallest of the vapor tenants (448K), so it keeps the npm tarball light.
+ * WHY sample-store.example (a FICTIONAL store, not a real merchant): compliance
+ * is resolved by the RUNNER's SANITIZED tenant registry
+ * (apps/storefront/src/config/tenants.ts — rewritten at build time by
+ * scripts/build/build-runner.mjs), keyed by domain. The runner registers ONE
+ * generic sample tenant, `sample-store.example`, that carries a `compliance`
+ * block (minAge 21, nicotineWarning), so the sample lights up the age-gate +
+ * nicotine warning off a NON-merchant identity with zero server. The bundled
+ * template below (`template/sample-store/`) is neutral, fictional "Sample Vapor
+ * Co." content — no real merchant's brand, copy, or assets ship here.
+ *
+ * (Earlier this borrowed a real vape merchant's identity + content to get a
+ * populated catalog; that leaked private merchant IP into public npm and was
+ * replaced — see the H1/H2 runner-sanitization work — with this generic sample.)
  *
  * Dependency-free (node:fs + node:path only).
  */
@@ -30,10 +33,10 @@ import { dirname, join, resolve } from "node:path";
 
 const here = dirname(fileURLToPath(import.meta.url)); // packages/cli/src
 
-/** The tenant identity the sample borrows so compliance + catalog resolve (see module doc). */
-export const SAMPLE_TENANT = "giantvapes";
+/** The generic sample tenant the runner registers with a compliance block (see module doc). */
+export const SAMPLE_TENANT = "sample-store.example";
 /** Dotted scope → the runner's path-prefix route + registry lookup (must contain a dot per context.mjs). */
-export const SAMPLE_SCOPE = "giantvapes.com";
+export const SAMPLE_SCOPE = "sample-store.example";
 /** Default directory name scaffolded when the user doesn't name one. */
 export const SAMPLE_DIR_NAME = "sample-store";