@tokenoftrust/cli 1.3.1-rc.2 → 1.3.3-rc.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "1.3.1-rc.2",
+  "version": "1.3.3-rc.0",
   "description": "Token of Trust developer CLI — check out a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",
@@ -36,6 +36,7 @@
     "registry": "https://registry.npmjs.org"
   },
   "scripts": {
-    "test": "node --test"
+    "test": "node --test",
+    "prepublishOnly": "node ../../scripts/build/check-cli-clean.mjs ."
   }
 }

package/src/commands/dev.mjs

@@ -314,7 +314,8 @@ export function bootNative(runnerDir, workspace, port, url, args) {
   // Heartbeat the hosted cockpit (G1) with the CLI version + this live localhost
   // URL while the runner runs — CLI-side, using the SAME bridge credential the
   // runner's file-save path uses (no-op in --sample, which threads no credential).
-  const stopHeartbeat = startHeartbeatFromEnv(bridgeEnv, { url });
+  // `cwd` (the checkout root) lets the cockpit show the FULL path to edit.
+  const stopHeartbeat = startHeartbeatFromEnv(bridgeEnv, { url, cwd: workspace });
   handle.done.finally(() => stopHeartbeat());
 
   // Auto-open the browser the moment the server answers (D). Non-blocking so
@@ -997,7 +998,7 @@ async function runContainer(workspace, args, ctx) {
   // Heartbeat the hosted cockpit (G1) CLI-side while the container runs — the
   // container reports file-saves via the threaded env, but the CLI owns the
   // version + live URL. Same bridge credential (activityBridgeEnv), no-op absent.
-  const stopHeartbeat = startHeartbeatFromEnv(activityBridgeEnv(), { url: plan.url });
+  const stopHeartbeat = startHeartbeatFromEnv(activityBridgeEnv(), { url: plan.url, cwd: plan.workspace });
   handle.done.finally(() => stopHeartbeat());
 
   // Auto-open the browser the moment the server answers (D). Non-blocking so

package/src/dev-heartbeat.mjs

@@ -29,14 +29,22 @@ const HEARTBEAT_INTERVAL_MS = 10_000;
  * an activity URL and a bearer token. Never throws — a failed/offline hosted
  * worker just means the cockpit doesn't light up this beat.
  * @param {{ activityUrl?: string, token?: string, url?: string,
- *   cliVersion?: string, runnerVersion?: string|null }} args
+ *   cliVersion?: string, runnerVersion?: string|null, editor?: string|null }} args
  */
-export function postHeartbeat({ activityUrl, token, url, cliVersion, runnerVersion } = {}) {
+export function postHeartbeat({ activityUrl, token, url, cliVersion, runnerVersion, editor, cwd } = {}) {
   if (!activityUrl || !token) return undefined;
   /** @type {Record<string, unknown>} */
   const body = { event: "heartbeat", cliVersion, at: Date.now() };
   if (runnerVersion) body.runnerVersion = runnerVersion;
   if (url) body.url = url;
+  // The developer's terminal $EDITOR (if set) — lets the cockpit suggest the exact
+  // "open this file" command (e.g. `code content/home.html`). Never a secret; a
+  // no-op when unset (the cockpit falls back to a generic hint).
+  if (editor) body.editor = editor;
+  // The project directory (the checkout root) — lets the cockpit show the FULL path
+  // to the file to edit so the command works from any directory. The dev's own local
+  // path (low sensitivity, like `url`); absent → the cockpit uses a relative path.
+  if (cwd) body.cwd = cwd;
   return fetch(`${String(activityUrl).replace(/\/+$/, "")}/api/dev/activity`, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
@@ -52,7 +60,8 @@ export function postHeartbeat({ activityUrl, token, url, cliVersion, runnerVersi
  * Returns a no-op stop() when there's no bridge credential (sample / not-signed-
  * in), so callers can wire it unconditionally.
  * @param {{ activityUrl?: string, token?: string, url?: string,
- *   cliVersion?: string, runnerVersion?: string|null, intervalMs?: number }} [opts]
+ *   cliVersion?: string, runnerVersion?: string|null, editor?: string|null,
+ *   cwd?: string|null, intervalMs?: number }} [opts]
  * @returns {() => void} stop the heartbeat (idempotent).
  */
 export function startDevHeartbeat({
@@ -61,32 +70,52 @@ export function startDevHeartbeat({
   url,
   cliVersion = CLI_VERSION,
   runnerVersion,
+  editor,
+  cwd,
   intervalMs = HEARTBEAT_INTERVAL_MS,
 } = {}) {
   if (!activityUrl || !token) return () => {}; // no bridge / sample mode → no-op
-  const beat = () => postHeartbeat({ activityUrl, token, url, cliVersion, runnerVersion });
+  const beat = () => postHeartbeat({ activityUrl, token, url, cliVersion, runnerVersion, editor, cwd });
   beat();
   const timer = setInterval(beat, intervalMs);
   if (typeof timer.unref === "function") timer.unref();
   return () => clearInterval(timer);
 }
 
+/**
+ * Resolve the developer's terminal editor command for the "open this file"
+ * cockpit hint — VISUAL wins over EDITOR (the POSIX convention: VISUAL is the
+ * full-screen editor, EDITOR the line-editor fallback). Returns the trimmed
+ * command (which may carry flags, e.g. "code --wait") or undefined when neither
+ * is set — in which case the cockpit shows a generic hint instead of a wrong one.
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string|undefined}
+ */
+export function resolveEditor(env = process.env) {
+  const e = String(env?.VISUAL || env?.EDITOR || "").trim();
+  return e || undefined;
+}
+
 /**
  * Convenience wrapper for the runner-spawn sites: start a heartbeat from the
  * same bridge env that's threaded to the runner ({TOT_DEV_ACTIVITY_URL,
  * TOT_DEV_ACTIVITY_TOKEN}, or {} for the `--sample` path — which yields a no-op,
  * exactly the desired "never leak a real credential from sample" behavior). The
  * runner version defaults to whatever `tot dev` resolved this invocation
- * (clientPackages().runner — null until the runner is resolved).
+ * (clientPackages().runner — null until the runner is resolved). The editor comes
+ * from the CLI's own env (VISUAL/EDITOR) so the cockpit can suggest the exact
+ * open-file command.
  * @param {{ TOT_DEV_ACTIVITY_URL?: string, TOT_DEV_ACTIVITY_TOKEN?: string }} bridgeEnv
- * @param {{ url?: string, runnerVersion?: string|null }} [opts]
+ * @param {{ url?: string, runnerVersion?: string|null, cwd?: string|null, env?: NodeJS.ProcessEnv }} [opts]
  * @returns {() => void} stop the heartbeat.
  */
-export function startHeartbeatFromEnv(bridgeEnv, { url, runnerVersion } = {}) {
+export function startHeartbeatFromEnv(bridgeEnv, { url, runnerVersion, cwd, env = process.env } = {}) {
   return startDevHeartbeat({
     activityUrl: bridgeEnv?.TOT_DEV_ACTIVITY_URL,
     token: bridgeEnv?.TOT_DEV_ACTIVITY_TOKEN,
     url,
     runnerVersion: runnerVersion ?? clientPackages().runner,
+    editor: resolveEditor(env),
+    cwd,
   });
 }

package/src/sample.mjs

@@ -9,16 +9,19 @@
  * regulated tenant's identity so the runner's tenant registry resolves it with
  * its `compliance` block on.
  *
- * WHY GIANTVAPES (not a novel synthetic domain): compliance + catalog are
- * resolved by the RUNNER's tenant registry (apps/storefront/src/config/tenants.ts),
- * keyed by domain. `giantvapes.com` is a registered 21+/PACT vape store WITH a
- * `compliance` block and a 50-product catalog fixture baked into the runner, so
- * the sample lights up age-gate + nicotine warning + a populated catalog with
- * zero server. A truly novel domain (e.g. "sample.example") is unclaimed → the
- * runner falls back to HOME_TENANT (siteType "marketing", NO compliance, empty
- * catalog), which would defeat the whole "the free taste still does compliance"
- * goal — so we deliberately borrow giantvapes' identity for the sample. It's the
- * smallest of the vapor tenants (448K), so it keeps the npm tarball light.
+ * WHY sample-store.example (a FICTIONAL store, not a real merchant): compliance
+ * is resolved by the RUNNER's SANITIZED tenant registry
+ * (apps/storefront/src/config/tenants.ts — rewritten at build time by
+ * scripts/build/build-runner.mjs), keyed by domain. The runner registers ONE
+ * generic sample tenant, `sample-store.example`, that carries a `compliance`
+ * block (minAge 21, nicotineWarning), so the sample lights up the age-gate +
+ * nicotine warning off a NON-merchant identity with zero server. The bundled
+ * template below (`template/sample-store/`) is neutral, fictional "Sample Vapor
+ * Co." content — no real merchant's brand, copy, or assets ship here.
+ *
+ * (Earlier this borrowed a real vape merchant's identity + content to get a
+ * populated catalog; that leaked private merchant IP into public npm and was
+ * replaced — see the H1/H2 runner-sanitization work — with this generic sample.)
  *
  * Dependency-free (node:fs + node:path only).
  */
@@ -30,10 +33,10 @@ import { dirname, join, resolve } from "node:path";
 
 const here = dirname(fileURLToPath(import.meta.url)); // packages/cli/src
 
-/** The tenant identity the sample borrows so compliance + catalog resolve (see module doc). */
-export const SAMPLE_TENANT = "giantvapes";
+/** The generic sample tenant the runner registers with a compliance block (see module doc). */
+export const SAMPLE_TENANT = "sample-store.example";
 /** Dotted scope → the runner's path-prefix route + registry lookup (must contain a dot per context.mjs). */
-export const SAMPLE_SCOPE = "giantvapes.com";
+export const SAMPLE_SCOPE = "sample-store.example";
 /** Default directory name scaffolded when the user doesn't name one. */
 export const SAMPLE_DIR_NAME = "sample-store";