@tokenoftrust/cli 1.4.0-rc.2 → 1.4.0-rc.20

package/src/commands/checkout.mjs

@@ -1,330 +0,0 @@
-/**
- * `tot checkout` — clone the tenant store you're entitled to build on, with an
- * authenticated remote already configured, ready for the local loop.
- *
- *   tot checkout                      list the stores you can build on
- *   tot checkout <tenant>             show the checkout for <tenant>
- *   tot checkout <tenant> --clone DIR clone it to DIR with an authed remote
- *
- * This is the SAME MCP code path a developer gets when they switch to a tenant:
- * sign-in → client_switch(tenant) → tenant_checkout, where the MCP derives your
- * per-tenant Git user and mints a FRESH, single-active, repo-scoped push
- * credential (a later checkout for the same tenant rotates it). `tot` performs NO
- * privileged forge work itself — the MCP owns that.
- *
- * Auth is the developer's own ToT identity (the cached `tot login` session,
- * resolved via src/auth.mjs). When there's no session yet and we're on a TTY, we
- * offer to sign in right here and retry — no "run tot login, then re-run".
- *
- * Dependency-free (global fetch + `git` via child_process).
- */
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { createMcpClient } from "../mcp.mjs";
-import { establishSession, AuthUnavailableError } from "../auth.mjs";
-import { offerSignIn } from "./login.mjs";
-import { CliError, fail, formatError } from "../errors.mjs";
-import { writeNvmrc } from "../sample.mjs";
-import { emitObstacle } from "../obstacle.mjs";
-
-const execFileP = promisify(execFile);
-
-const DEFAULT_MCP_URL = "https://mcp.tokenoftrust.com";
-
-function parseArgs(argv) {
-  const a = {
-    tenant: null,
-    tag: "main",
-    clone: null,
-    mcp: null,
-    printRemote: false,
-    help: false,
-  };
-  for (let i = 0; i < argv.length; i++) {
-    const t = argv[i];
-    if (t === "--tag") a.tag = argv[++i];
-    else if (t === "--clone") a.clone = argv[++i];
-    else if (t === "--mcp") a.mcp = argv[++i];
-    else if (t === "--print-remote") a.printRemote = true;
-    else if (t === "--help" || t === "-h") a.help = true;
-    else if (!t.startsWith("--") && !a.tenant) a.tenant = t;
-  }
-  return a;
-}
-
-const USAGE = `tot checkout — clone a tenant store you can build on
-
-  tot checkout                        list the stores you can build on
-  tot checkout <tenant>               show the checkout for <tenant>
-  tot checkout <tenant> --clone <dir> clone it locally (authenticated remote configured)
-
-Options:
-  --tag <tag>       which repo (repo = "<tenant>-<tag>"). Default: main.
-  --clone <dir>     git clone the authenticated remote into <dir>.
-  --mcp <url>       MCP base URL. Default: env MCP_BASE_URL / TOT_MCP_URL, else
-                    ${DEFAULT_MCP_URL}.
-  --print-remote    also print the authenticated remote (contains a live token!).`;
-
-/** Redact known secrets from any string before it hits the terminal. */
-function makeRedactor(env) {
-  const secrets = [env.TOT_API_KEY, env.TOT_SECRET_KEY].filter(Boolean);
-  return (s) => {
-    let o = String(s);
-    for (const x of secrets) o = o.split(x).join("***");
-    return o;
-  };
-}
-
-/**
- * @param {string[]} argv - args AFTER `checkout`
- * @param {import("../context.mjs").detectContext extends (...a:any)=>infer R ? R : any} ctx
- */
-export async function run(argv, ctx) {
-  const env = process.env;
-  const args = parseArgs(argv);
-  if (args.help) {
-    console.log(USAGE);
-    return 0;
-  }
-
-  // Infer the tenant from a standalone checkout when run without one.
-  if (!args.tenant && ctx.mode === "checkout" && ctx.tenant) {
-    args.tenant = ctx.tenant;
-  }
-
-  const baseUrl = args.mcp || env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
-  const redact = makeRedactor(env);
-  const client = createMcpClient(baseUrl);
-
-  try {
-    // Attach auth in the right order relative to the handshake (developer bearer
-    // BEFORE initialize) — see establishSession. When there's no session yet and
-    // we're on a TTY, offer to sign in inline and retry once, so a not-signed-in
-    // developer isn't dead-ended at "run tot login, then re-run".
-    try {
-      await establishSession(client, { env });
-    } catch (e) {
-      if (e instanceof AuthUnavailableError && e.reason === "missing") {
-        const signedIn = await offerSignIn(client.mcpUrl, env, {});
-        if (!signedIn) throw e; // declined/non-TTY → the crisp error below
-        await establishSession(client, { env }); // retry once, in-flow
-      } else {
-        throw e;
-      }
-    }
-    console.error(`~ signed in → ${client.mcpUrl}`);
-
-    // No tenant → list the stores this identity can build on and stop.
-    if (!args.tenant) {
-      const list = await client.callTool("client_list", {});
-      printClientList(list);
-      return 0;
-    }
-
-    console.error(`~ client_switch → ${args.tenant}`);
-    console.error(
-      `~ tenant_checkout (tag=${args.tag}) — MCP mints a fresh repo-scoped credential`,
-    );
-    const res = await checkoutTenant(client, {
-      tenant: args.tenant,
-      tag: args.tag,
-      cloneDir: args.clone || null,
-      redact,
-    });
-    console.log(`\n+ checkout ready. repo: ${res.cloneUrl || res.publicUrl}`);
-
-    if (res.cloned) {
-      console.log(`+ cloned. HEAD: ${res.head}`);
-      console.log(`\nYour local working clone is at ${res.dir} with an authenticated remote.`);
-      console.log(`  cd ${res.dir} && tot dev            # run it locally with save→reload`);
-      console.log(`  (the minted token lives in .git/config; a later checkout rotates it)`);
-      return 0;
-    }
-
-    console.log(`\nPublic clone URL (no credential): ${res.publicUrl}`);
-    console.log(`Re-run with --clone <dir> to clone with the authenticated remote configured.`);
-    if (args.printRemote) {
-      console.log(
-        `\nAUTHENTICATED remote (contains a live token — handle carefully):\n${res.gitRemote}`,
-      );
-    }
-    return 0;
-  } catch (e) {
-    if (e instanceof AuthUnavailableError) {
-      console.error(formatError(e));
-      return 1;
-    }
-    if (e instanceof CliError) {
-      console.error(formatError(e));
-      return e.exitCode ?? 1;
-    }
-    console.error(fail(`checkout failed: ${redact(String(e?.message || e))}`));
-    return 1;
-  }
-}
-
-/**
- * The privileged checkout core, composable in-process (used by `tot checkout`
- * and by `tot start`): client_switch → tenant_checkout → optionally clone. The
- * MCP mints a fresh, repo-scoped push credential each time. Assumes `client` is
- * already initialized + has a validated session.
- *
- * @param {ReturnType<import("../mcp.mjs").createMcpClient>} client
- * @param {{ tenant: string, tag?: string, cloneDir?: string|null, redact?: (s:string)=>string }} opts
- * @returns {Promise<{ gitRemote: string, cloneUrl: string|null, publicUrl: string,
- *   cloned: boolean, dir: string|null, head: string|null }>}
- */
-export async function checkoutTenant(client, { tenant, tag = "main", cloneDir = null, redact = (s) => s }) {
-  await client.callTool("client_switch", { tenant });
-  const checkout = await client.callTool("tenant_checkout", { tenant, tag });
-
-  // A non-checkout result (not provisioned / not entitled / failed) must surface
-  // the MCP's human message + a concrete next step, NEVER a raw JSON.stringify
-  // dump (James's 2026-07-19 first-experience failure).
-  const err = checkoutError(checkout);
-  if (err) {
-    throw new CliError(redact(err.message), { next: err.next });
-  }
-  const gitRemote = checkout.gitRemote;
-  const cloneUrl = checkout.cloneUrl ?? null;
-  const u = new URL(gitRemote);
-  const publicUrl = `${u.protocol}//${u.host}${u.pathname}`;
-
-  if (!cloneDir) {
-    return { gitRemote, cloneUrl, publicUrl, cloned: false, dir: null, head: null };
-  }
-  const { dir, head } = await cloneRepo(gitRemote, cloneDir, redact);
-  return { gitRemote, cloneUrl, publicUrl, cloned: true, dir, head };
-}
-
-/**
- * git clone the authenticated remote into `dir`. Throws CliError on failure.
- * Runs git as a NON-BLOCKING child process (promisified execFile) so the clone
- * doesn't stall the Node event loop — `tot start` runs this inside a
- * `Promise.all([...])` alongside the renderer prefetch, and a synchronous clone
- * would serialize what's meant to overlap.
- */
-async function cloneRepo(gitRemote, dir, redact) {
-  const git = async (cargs) => (await execFileP("git", cargs)).stdout.toString();
-  console.log(`+ git clone → ${dir}`);
-  try {
-    await git(["clone", gitRemote, dir]);
-  } catch (e) {
-    // Beacon the cockpit before we surface the error — covers this path for both
-    // `tot checkout` and `tot start` (which clones through here). Awaited so the
-    // packet lands before the process prints + exits; swallowed either way.
-    await emitObstacle("clone-failed");
-    throw new CliError(`clone failed: ${redact(String(e.stderr || e.message || e))}`, {
-      next: `check the target dir is empty and you can reach the remote, then re-run`,
-    });
-  }
-  const head = (await git(["-C", dir, "log", "-1", "--oneline"])).trim();
-  writeNvmrc(dir); // version-manager hooks land on a supported Node on cd
-  return { dir, head };
-}
-
-/**
- * Classify a `tenant_checkout` tool result: null when it's a genuine, usable
- * checkout (carries a gitRemote), otherwise a human { message, next } pair so
- * callers surface the MCP's own words + a concrete next step instead of dumping
- * raw JSON (James's 2026-07-19 first-experience failure: a not-provisioned store
- * printed JSON.stringify(checkout)). callTool unwraps the tool result to its
- * structuredContent / parsed text, so a failure surfaces as an error-ish status
- * ('forbidden' | 'invalid_input' | 'checkout_failed' | 'error'), a `message`, or
- * simply a missing gitRemote. When the repo isn't provisioned yet we speak to the
- * INVITED DEVELOPER ("your store isn't set up yet"), not the operator — dropping
- * the `repo_provision` jargon the MCP aims at whoever provisions. Any other
- * failure surfaces the MCP's own message. Pure + exported so it's unit-tested
- * without any I/O.
- * @param {unknown} checkout
- * @returns {{ message: string, next: string }|null}
- */
-export function checkoutError(checkout) {
-  const c = checkout && typeof checkout === "object" && !Array.isArray(checkout) ? checkout : null;
-  if (c && c.gitRemote) return null; // a usable checkout — never an error
-  const msg =
-    (c && (c.message || (typeof c.error === "string" ? c.error : c.error?.message))) ||
-    (c && typeof c.raw === "string" && c.raw.trim() ? c.raw.trim() : null) ||
-    null;
-  // The store's repo isn't provisioned yet — it isn't set up for this developer.
-  if (typeof msg === "string" && /not provisioned/i.test(msg)) {
-    return {
-      message: "your store isn't set up on Token of Trust yet",
-      next: "ask your Token of Trust contact to finish setting up your store, then re-run",
-    };
-  }
-  return {
-    message: msg || "the store checkout couldn't be completed",
-    next: "confirm you're entitled to this store — `tot checkout` (lists your stores)",
-  };
-}
-
-/**
- * Normalize the (shape-varying) `client_list` response into a plain, sorted
- * list of the stores this identity can build on. Shared by `tot checkout`'s
- * listing and `tot start`'s auto-pick so both read the same fields.
- * @param {unknown} list
- * @returns {Array<{ id: string, name: string, raw: any }>}
- */
-export function normalizeStores(list) {
-  const rows = Array.isArray(list) ? list : list?.clients || list?.tenants || [];
-  if (!Array.isArray(rows)) return [];
-  return rows
-    .map((r) => ({
-      id: r?.tenant || r?.id || r?.clientId || r?.appDomain || null,
-      name: r?.displayName || r?.name || "",
-      raw: r,
-    }))
-    .filter((r) => r.id);
-}
-
-/**
- * Detect whether a `client_list` tool result is an ERROR result rather than a
- * genuinely empty-but-successful store list — so callers surface it (identity +
- * origin + reason, per fb-1783905718950-f45zg9) instead of collapsing it to an
- * empty list and dead-ending at "ask for an invite". callTool unwraps a tool
- * result to its structuredContent / parsed text, so an error surfaces as a
- * status other than ok/success, an `error`/`isError` field, or an unparseable
- * `raw` text blob. A response that carries a resolvable store array (even empty)
- * is always a success. Returns a short human reason, or null when it's not an
- * error. Pure + exported so it's unit-tested without any I/O.
- * @param {unknown} list
- * @returns {string|null}
- */
-export function storeListError(list) {
-  if (list == null || typeof list !== "object" || Array.isArray(list)) return null;
-  // A resolvable store array present → it succeeded, never an error.
-  if (Array.isArray(list.clients) || Array.isArray(list.tenants)) return null;
-  const msg =
-    list.message ||
-    (typeof list.error === "string" ? list.error : list.error?.message) ||
-    null;
-  if (list.isError) return msg || "the store list request returned an error";
-  if (typeof list.status === "string" && !/^(ok|success)$/i.test(list.status)) {
-    return msg || `the store list request returned status "${list.status}"`;
-  }
-  if (list.error) return msg || "the store list request returned an error";
-  if (typeof list.raw === "string" && list.raw.trim()) return list.raw.trim();
-  return null;
-}
-
-function printClientList(list) {
-  const err = storeListError(list);
-  const stores = normalizeStores(list);
-  if (err && stores.length === 0) {
-    console.log(`\nCouldn't list your stores: ${err}`);
-    console.log("Run `tot whoami` to check your session, or `tot login` again.");
-    return;
-  }
-  if (stores.length === 0) {
-    console.log("\nNo stores available to build on for this identity yet.");
-    console.log("If you were just invited, it may still be propagating — try again in a minute.");
-    if (list && !Array.isArray(list)) console.log(JSON.stringify(list, null, 2));
-    return;
-  }
-  console.log("\nStores you can build on:\n");
-  for (const s of stores) {
-    console.log(`  ${s.id}${s.name ? `  — ${s.name}` : ""}`);
-  }
-  console.log(`\nNext:  tot checkout <tenant> --clone <dir>`);
-}