@tokenoftrust/cli 1.4.0-rc.2 → 1.4.0-rc.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "1.4.0-rc.2",
+  "version": "1.4.0-rc.3",
   "description": "Token of Trust developer CLI — check out a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/login.mjs

@@ -25,6 +25,7 @@ import { openBrowser } from "../open.mjs";
 import { fail } from "../errors.mjs";
 import { cockpitRecoveryUrl, normalizeEmailHint, redactEmailForHint, emailFromJwt } from "../auth.mjs";
 import { isInteractive, promptYesNo } from "../prompt.mjs";
+import { versionStamp } from "../mcp.mjs";
 
 const DEFAULT_MCP_URL = "https://mcp.tokenoftrust.com";
 
@@ -255,6 +256,10 @@ export async function run(argv, _ctx) {
     return 0;
   }
 
+  // Show which CLI/runtime is actually running BEFORE anything else — the first thing
+  // a "why did sign-in behave oddly" investigation needs (e.g. a stale shadowing `tot`).
+  console.error(versionStamp());
+
   const mcpUrl = args.mcp || env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
 
   if (args.code) {

package/src/oauth.mjs

@@ -84,8 +84,15 @@ export async function registerClient(
     headers: { "Content-Type": "application/json", Accept: "application/json" },
     body: JSON.stringify({
       client_name: CLIENT_NAME,
+      // Include the device-code grant: the browserless rendezvous + B3 device flows
+      // redeem their device_code at /oauth/token with this grant, so a client
+      // registered WITHOUT it gets "unauthorized_client: grant_type is invalid".
+      grant_types: [
+        "authorization_code",
+        "refresh_token",
+        "urn:ietf:params:oauth:grant-type:device_code",
+      ],
       redirect_uris: [redirectUri],
-      grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
       token_endpoint_auth_method: "none",
       scope: SCOPE,
@@ -355,7 +362,6 @@ export async function attachRendezvous(attachEndpoint, { rendezvousCode, clientI
  */
 export async function rendezvousLoginFlow({
   mcpUrl,
-  clientId,
   code,
   fetchImpl = fetch,
   log = () => {},
@@ -363,7 +369,12 @@ export async function rendezvousLoginFlow({
   now = () => Date.now(),
 }) {
   const meta = await discoverMetadata(mcpUrl, fetchImpl);
-  const resolvedClientId = clientId || (await registerClient(meta.registration_endpoint, LOOPBACK_REDIRECT, fetchImpl));
+  // Always register a FRESH client for a rendezvous sign-in — do NOT reuse a cached
+  // clientId. A client cached by an older CLI build was registered without the
+  // device-code grant, so /oauth/token would reject the device grant with
+  // "unauthorized_client". Registration is cheap and a rendezvous has no consent
+  // screen to re-trigger (unlike the loopback/device flows, which reuse the cache).
+  const resolvedClientId = await registerClient(meta.registration_endpoint, LOOPBACK_REDIRECT, fetchImpl);
   const { verifier, challenge } = generatePkce();
 
   const attach = await attachRendezvous(