@tokenoftrust/cli 1.3.2 → 1.3.3-rc.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "1.3.2",
+  "version": "1.3.3-rc.1",
   "description": "Token of Trust developer CLI — check out a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/dev.mjs

@@ -314,7 +314,8 @@ export function bootNative(runnerDir, workspace, port, url, args) {
   // Heartbeat the hosted cockpit (G1) with the CLI version + this live localhost
   // URL while the runner runs — CLI-side, using the SAME bridge credential the
   // runner's file-save path uses (no-op in --sample, which threads no credential).
-  const stopHeartbeat = startHeartbeatFromEnv(bridgeEnv, { url });
+  // `cwd` (the checkout root) lets the cockpit show the FULL path to edit.
+  const stopHeartbeat = startHeartbeatFromEnv(bridgeEnv, { url, cwd: workspace });
   handle.done.finally(() => stopHeartbeat());
 
   // Auto-open the browser the moment the server answers (D). Non-blocking so
@@ -997,7 +998,7 @@ async function runContainer(workspace, args, ctx) {
   // Heartbeat the hosted cockpit (G1) CLI-side while the container runs — the
   // container reports file-saves via the threaded env, but the CLI owns the
   // version + live URL. Same bridge credential (activityBridgeEnv), no-op absent.
-  const stopHeartbeat = startHeartbeatFromEnv(activityBridgeEnv(), { url: plan.url });
+  const stopHeartbeat = startHeartbeatFromEnv(activityBridgeEnv(), { url: plan.url, cwd: plan.workspace });
   handle.done.finally(() => stopHeartbeat());
 
   // Auto-open the browser the moment the server answers (D). Non-blocking so

package/src/dev-heartbeat.mjs

@@ -29,14 +29,22 @@ const HEARTBEAT_INTERVAL_MS = 10_000;
  * an activity URL and a bearer token. Never throws — a failed/offline hosted
  * worker just means the cockpit doesn't light up this beat.
  * @param {{ activityUrl?: string, token?: string, url?: string,
- *   cliVersion?: string, runnerVersion?: string|null }} args
+ *   cliVersion?: string, runnerVersion?: string|null, editor?: string|null }} args
  */
-export function postHeartbeat({ activityUrl, token, url, cliVersion, runnerVersion } = {}) {
+export function postHeartbeat({ activityUrl, token, url, cliVersion, runnerVersion, editor, cwd } = {}) {
   if (!activityUrl || !token) return undefined;
   /** @type {Record<string, unknown>} */
   const body = { event: "heartbeat", cliVersion, at: Date.now() };
   if (runnerVersion) body.runnerVersion = runnerVersion;
   if (url) body.url = url;
+  // The developer's terminal $EDITOR (if set) — lets the cockpit suggest the exact
+  // "open this file" command (e.g. `code content/home.html`). Never a secret; a
+  // no-op when unset (the cockpit falls back to a generic hint).
+  if (editor) body.editor = editor;
+  // The project directory (the checkout root) — lets the cockpit show the FULL path
+  // to the file to edit so the command works from any directory. The dev's own local
+  // path (low sensitivity, like `url`); absent → the cockpit uses a relative path.
+  if (cwd) body.cwd = cwd;
   return fetch(`${String(activityUrl).replace(/\/+$/, "")}/api/dev/activity`, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
@@ -52,7 +60,8 @@ export function postHeartbeat({ activityUrl, token, url, cliVersion, runnerVersi
  * Returns a no-op stop() when there's no bridge credential (sample / not-signed-
  * in), so callers can wire it unconditionally.
  * @param {{ activityUrl?: string, token?: string, url?: string,
- *   cliVersion?: string, runnerVersion?: string|null, intervalMs?: number }} [opts]
+ *   cliVersion?: string, runnerVersion?: string|null, editor?: string|null,
+ *   cwd?: string|null, intervalMs?: number }} [opts]
  * @returns {() => void} stop the heartbeat (idempotent).
  */
 export function startDevHeartbeat({
@@ -61,32 +70,52 @@ export function startDevHeartbeat({
   url,
   cliVersion = CLI_VERSION,
   runnerVersion,
+  editor,
+  cwd,
   intervalMs = HEARTBEAT_INTERVAL_MS,
 } = {}) {
   if (!activityUrl || !token) return () => {}; // no bridge / sample mode → no-op
-  const beat = () => postHeartbeat({ activityUrl, token, url, cliVersion, runnerVersion });
+  const beat = () => postHeartbeat({ activityUrl, token, url, cliVersion, runnerVersion, editor, cwd });
   beat();
   const timer = setInterval(beat, intervalMs);
   if (typeof timer.unref === "function") timer.unref();
   return () => clearInterval(timer);
 }
 
+/**
+ * Resolve the developer's terminal editor command for the "open this file"
+ * cockpit hint — VISUAL wins over EDITOR (the POSIX convention: VISUAL is the
+ * full-screen editor, EDITOR the line-editor fallback). Returns the trimmed
+ * command (which may carry flags, e.g. "code --wait") or undefined when neither
+ * is set — in which case the cockpit shows a generic hint instead of a wrong one.
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string|undefined}
+ */
+export function resolveEditor(env = process.env) {
+  const e = String(env?.VISUAL || env?.EDITOR || "").trim();
+  return e || undefined;
+}
+
 /**
  * Convenience wrapper for the runner-spawn sites: start a heartbeat from the
  * same bridge env that's threaded to the runner ({TOT_DEV_ACTIVITY_URL,
  * TOT_DEV_ACTIVITY_TOKEN}, or {} for the `--sample` path — which yields a no-op,
  * exactly the desired "never leak a real credential from sample" behavior). The
  * runner version defaults to whatever `tot dev` resolved this invocation
- * (clientPackages().runner — null until the runner is resolved).
+ * (clientPackages().runner — null until the runner is resolved). The editor comes
+ * from the CLI's own env (VISUAL/EDITOR) so the cockpit can suggest the exact
+ * open-file command.
  * @param {{ TOT_DEV_ACTIVITY_URL?: string, TOT_DEV_ACTIVITY_TOKEN?: string }} bridgeEnv
- * @param {{ url?: string, runnerVersion?: string|null }} [opts]
+ * @param {{ url?: string, runnerVersion?: string|null, cwd?: string|null, env?: NodeJS.ProcessEnv }} [opts]
  * @returns {() => void} stop the heartbeat.
  */
-export function startHeartbeatFromEnv(bridgeEnv, { url, runnerVersion } = {}) {
+export function startHeartbeatFromEnv(bridgeEnv, { url, runnerVersion, cwd, env = process.env } = {}) {
   return startDevHeartbeat({
     activityUrl: bridgeEnv?.TOT_DEV_ACTIVITY_URL,
     token: bridgeEnv?.TOT_DEV_ACTIVITY_TOKEN,
     url,
     runnerVersion: runnerVersion ?? clientPackages().runner,
+    editor: resolveEditor(env),
+    cwd,
   });
 }

package/src/validate.mjs

@@ -96,6 +96,28 @@ function validateRawHtmlBody(html) {
   if (!html.includes("<")) return "no markup tags found";
   return null;
 }
+/**
+ * Does the tenant provide chrome to wrap body-only fragments? True when it ships
+ * EITHER a hand-authored `content/chrome.html`, OR a `content/chrome.json` that
+ * opts into the canonical shared chrome. Mirrors the serve-time resolution in
+ * apps/storefront getChromeHtml() → parseChromeConfig(): an opted-in config is
+ * rendered into the wrapper (renderRawChrome), so a fragment is NOT served naked.
+ * Kept in step with lib/chrome/parseConfig.ts's opt-in gate.
+ */
+function providesChrome(contentDir) {
+  if (existsSync(join(contentDir, "chrome.html"))) return true;
+  const configPath = join(contentDir, "chrome.json");
+  if (!existsSync(configPath)) return false;
+  const { value } = readJsonSafe(configPath);
+  if (value == null || typeof value !== "object") return false;
+  if (value.sharedChrome !== true) return false;
+  const brand = value.brand;
+  if (brand == null || typeof brand !== "object" || typeof brand.label !== "string") return false;
+  if (!Array.isArray(value.nav)) return false;
+  const footer = value.footer;
+  if (footer == null || typeof footer !== "object" || !Array.isArray(footer.columns)) return false;
+  return true;
+}
 
 // --- filesystem helpers ------------------------------------------------------
 function readJsonSafe(path) {
@@ -186,8 +208,7 @@ export function validateTenant(tenantDir, opts = {}) {
   }
 
   // 4. raw HTML documents — validate + portability + resolution
-  const chromePath = join(contentDir, "chrome.html");
-  const hasChrome = existsSync(chromePath);
+  const hasChrome = providesChrome(contentDir);
   const htmlFiles = walk(contentDir, (p) => p.endsWith(".html"));
   const pageTargets = buildPageTargetSet(contentDir, pagesDir);
 
@@ -204,8 +225,8 @@ export function validateTenant(tenantDir, opts = {}) {
     if (!base && !isFullDocument(html) && !hasChrome) {
       findings.push(
         mk(ERROR, "html-fragment", r,
-          "is an HTML fragment but the tenant ships no content/chrome.html to wrap it — it will serve unwrapped/naked",
-          "make it a full <!doctype html> document, or add content/chrome.html with <!--PAGE_BODY-->"),
+          "is an HTML fragment but the tenant ships no chrome to wrap it — it will serve unwrapped/naked",
+          "make it a full <!doctype html> document, add a content/chrome.json with \"sharedChrome\": true (brand + nav + footer), or add content/chrome.html with <!--PAGE_BODY-->"),
       );
     }
     if (STYLE_OPEN_WITH_ATTRS_RE.test(html)) {