@tokenoftrust/cli 1.4.0-rc.2 → 1.4.0-rc.21

package/src/commands/doctor.mjs

@@ -1,7 +1,7 @@
 /**
  * `tot doctor` — is this machine ready to run the loop?
  *
- * Standalone (unlike the in-monorepo doctor): checks the things `tot checkout`
+ * Standalone (unlike the in-monorepo doctor): checks the things `tot clone`
  * and `tot dev`/`tot start` actually need — Node, git, an MCP URL, whether an
  * auth identity is available, and Docker — plus reports the detected context
  * so a developer knows which mode `tot` will use here.
@@ -187,7 +187,8 @@ export async function run(argv, ctx) {
   }
   console.log(
     failed === 0
-      ? "\n✔ Ready. Try: tot start   (checks out your store and runs it), or tot checkout\n"
+      ? "\n✔ Ready. Try: tot start   (checks out your store and runs it), or tot clone." +
+        "\n  The loop: tot dev → tot preview → tot ship.\n"
       : args.fix
         ? `\n✖ ${failed} check(s) still failing — see the exact next command(s) above, then re-run \`tot doctor\`.\n`
         : `\n✖ ${failed} check(s) failed — try \`tot doctor --fix\`, or fix the above, then re-run \`tot doctor\`.\n`,
@@ -199,5 +200,5 @@ function describeContext(ctx) {
   if (ctx.mode === "monorepo") return `storefront monorepo (${ctx.repoRoot})`;
   if (ctx.mode === "checkout")
     return `tenant checkout${ctx.tenant ? ` for "${ctx.tenant}"` : ""} (${ctx.workspacePath})`;
-  return "loose (not inside a checkout — `tot checkout <tenant> --clone <dir>` to get one)";
+  return "loose (not inside a checkout — `tot clone <tenant>` to get one)";
 }

package/src/commands/git-credential.mjs

@@ -0,0 +1,180 @@
+/**
+ * `tot git-credential` — git's own credential-helper protocol (see `git help
+ * gitcredentials`), implemented over the developer's cached `tot login`
+ * session (unit u10, workstream tot-merge-conflict-resolution-ux). `tot
+ * clone` configures a fresh checkout's `credential.helper` to run this (see
+ * ../git-credential.mjs's CREDENTIAL_HELPER), so `git fetch`/`git push`/`git
+ * pull` — run DIRECTLY by the developer, not just through `tot preview` —
+ * transparently mint a fresh forge token instead of ever needing one
+ * persisted in `.git/config`. This is the fix for the "the panel-prescribed
+ * `git fetch origin` fails even after `tot login`" dead-end: `tot login`
+ * only ever refreshed the CLI's OWN MCP session, never the token baked into
+ * a checkout's remote URL at clone time.
+ *
+ * git invokes this with ONE positional arg (`get`/`store`/`erase`) and the
+ * request on stdin (key=value lines, blank-line/EOF terminated). Only `get`
+ * does real work — this CLI never persists a forge credential of its own
+ * beyond the short-lived cache in ../git-credential.mjs, so `store`/`erase`
+ * are no-ops (git calls them after a successful/failed auth respectively; we
+ * just drain stdin and exit 0, the correct behavior for a stateless helper).
+ *
+ * FAILS SILENT, NEVER LOUD: `get` prints NOTHING and exits non-zero on any
+ * problem (not signed in, MCP unreachable, cwd isn't a recognizable tenant
+ * checkout) — git then falls through to its next configured helper or its
+ * own prompt, exactly as if this helper weren't configured. A stack trace or
+ * a malformed credential line here would otherwise corrupt EVERY git
+ * operation in the checkout. It also NEVER triggers an interactive sign-in —
+ * this runs as a non-interactive subprocess of `git`, so a missing session
+ * fails through rather than trying to open a browser mid-`git fetch`.
+ *
+ * Dependency-free (global fetch + `git`, via the same MCP client + auth
+ * module every other command uses).
+ */
+import { readFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { createMcpClient } from "../mcp.mjs";
+import { establishSession } from "../auth.mjs";
+import { checkoutTenant } from "./clone.mjs";
+import { detectContext } from "../context.mjs";
+import { repoNameFromRemote, tagFromRepoName } from "./submit.mjs";
+import {
+  parseCredentialInput, formatCredentialOutput, splitAuthedRemote,
+  credentialCachePath, readCachedCredential, writeCachedCredential,
+} from "../git-credential.mjs";
+
+const DEFAULT_MCP_URL = "https://mcp.tokenoftrust.com";
+
+/** Does `remoteUrl`'s host equal `host` (case-insensitive)? An unparseable or
+ *  missing remote URL never matches — fail closed. Exported for testing. */
+export function hostMatches(remoteUrl, host) {
+  if (!remoteUrl || !host) return false;
+  try {
+    // scp-like remotes (git@host:owner/repo.git) have no scheme — synthesize one so URL can parse the host.
+    const normalized = /^[^/]+@[^/:]+:/.test(remoteUrl) ? `ssh://${remoteUrl.replace(":", "/")}` : remoteUrl;
+    return new URL(normalized).host.toLowerCase() === host.toLowerCase();
+  } catch {
+    return false;
+  }
+}
+
+/** Read the credential request git writes to stdin — blocking is correct
+ *  here: git writes the request then closes its end, so this returns as
+ *  soon as it's fully sent. Never blocks on an interactive terminal (git
+ *  NEVER attaches a TTY to a credential helper's stdin — only a human
+ *  poking at this command directly by hand would) and never throws (an
+ *  unreadable/absent stdin is treated as an empty request). Exported so a
+ *  test can inject a canned request instead of touching real fd 0. */
+export function readStdin() {
+  if (process.stdin.isTTY) return "";
+  try {
+    return readFileSync(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Mint (or reuse a cached) forge credential for the tenant the CURRENT
+ * directory checks out — the same `tenant_checkout` MCP call `tot clone`
+ * itself uses, so the credential is exactly as push-capable. Returns null on
+ * ANY failure (wrong dir, not signed in, MCP unreachable) rather than
+ * throwing — `get` treats null as "say nothing, exit non-zero".
+ *
+ * `createClient`/`establish`/`checkout` are injected (default to the real MCP
+ * client + auth + clone.mjs's checkoutTenant) purely so this is testable
+ * without a live MCP — same DI shape as chooseChangeId's injected `mint` /
+ * resolveDeveloperSession's injected `fetchImpl` elsewhere in this CLI.
+ * SCOPED TO THE CHECKOUT'S OWN REMOTE: `expectedHost` (git's requested host,
+ * from the credential-helper request) is checked against the host of this
+ * checkout's `origin` remote before a credential is ever minted or returned
+ * — a `get` for any OTHER host returns null (silent fail), never handing the
+ * tenant's forge token to a host this checkout doesn't itself push to. This
+ * matters because `credential.helper` is invoked per-URL by git, and a
+ * globally-scoped helper (or a checkout with a submodule / unrelated remote)
+ * must not become a way to exfiltrate the token to an arbitrary host.
+ * @param {{
+ *   env?: NodeJS.ProcessEnv, cwd?: string, expectedHost?: string|null,
+ *   createClient?: typeof createMcpClient,
+ *   establish?: typeof establishSession,
+ *   checkout?: typeof checkoutTenant,
+ * }} [opts]
+ * @returns {Promise<{username:string,password:string}|null>}
+ */
+export async function mintOrCacheCredential({
+  env = process.env, cwd = process.cwd(), expectedHost = null,
+  createClient = createMcpClient, establish = establishSession, checkout = checkoutTenant,
+} = {}) {
+  const ctx = detectContext(cwd);
+  if (ctx.mode !== "checkout" || !ctx.tenant) return null;
+
+  const git = (cargs) =>
+    execFileSync("git", ["-C", ctx.workspacePath, ...cargs], { stdio: ["ignore", "pipe", "pipe"] }).toString();
+  let originUrl = null;
+  let repoName = null;
+  try {
+    originUrl = git(["remote", "get-url", "origin"]).trim();
+    repoName = repoNameFromRemote(originUrl);
+  } catch {
+    /* fall through — tagFromRepoName degrades to "main" on a null repo name */
+  }
+  if (expectedHost && !hostMatches(originUrl, expectedHost)) return null;
+  const tag = tagFromRepoName(repoName, ctx.tenant);
+
+  const cachePath = credentialCachePath(ctx.tenant, tag, env);
+  const cached = readCachedCredential(cachePath);
+  if (cached) return { username: cached.username, password: cached.password };
+
+  const baseUrl = env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
+  const client = createClient(baseUrl);
+  try {
+    await establish(client, { env });
+  } catch {
+    return null; // not signed in (or session unrefreshable) — nothing this helper can do
+  }
+  try {
+    const res = await checkout(client, { tenant: ctx.tenant, tag, cloneDir: null });
+    const cred = splitAuthedRemote(res.gitRemote || "");
+    if (!cred) return null;
+    const fresh = { username: cred.username, password: cred.token };
+    writeCachedCredential(cachePath, fresh);
+    return fresh;
+  } catch {
+    return null; // MCP unreachable / tenant_checkout refused — say nothing, exit non-zero
+  }
+}
+
+const USAGE = `tot git-credential — git credential-helper protocol over your \`tot login\` session
+
+  Configured automatically by \`tot clone\` (credential.helper = !tot git-credential)
+  in every checkout it creates — you should never need to run this by hand.
+  See \`git help gitcredentials\` for the protocol this implements.`;
+
+/**
+ * @param {string[]} argv  argv[0] is git's operation: get|store|erase
+ * @param {any} _ctx  unused — this command derives its OWN context from cwd
+ *   (mintOrCacheCredential), since git invokes it with the credentialed
+ *   repo's directory as cwd, which may differ from wherever `tot` itself
+ *   was dispatched from.
+ * @param {{ env?: NodeJS.ProcessEnv, cwd?: string, readStdin?: typeof readStdin }
+ *   & Parameters<typeof mintOrCacheCredential>[0]} [opts]
+ */
+export async function run(argv, _ctx, opts = {}) {
+  const { env = process.env, readStdin: read = readStdin } = opts;
+  const op = argv[0];
+  if (!op || op === "--help" || op === "-h") {
+    console.log(USAGE);
+    return op ? 0 : 2;
+  }
+  // git always writes a request to stdin, even for store/erase — drain it either way
+  // so the subprocess exits cleanly instead of leaving git's write blocked on a full pipe.
+  const request = parseCredentialInput(read());
+
+  if (op !== "get") return 0; // store/erase: stateless, nothing to persist or drop.
+
+  const cred = await mintOrCacheCredential({ ...opts, expectedHost: request.host });
+  if (!cred) return 1; // silent — let git fall through to its next helper / its own prompt.
+  process.stdout.write(formatCredentialOutput({
+    protocol: request.protocol, host: request.host, username: cred.username, password: cred.password,
+  }));
+  return 0;
+}