@tokenoftrust/cli 1.4.0-rc.2 → 1.4.0-rc.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "1.4.0-rc.2",
+  "version": "1.4.0-rc.4",
   "description": "Token of Trust developer CLI — check out a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/login.mjs

@@ -25,6 +25,7 @@ import { openBrowser } from "../open.mjs";
 import { fail } from "../errors.mjs";
 import { cockpitRecoveryUrl, normalizeEmailHint, redactEmailForHint, emailFromJwt } from "../auth.mjs";
 import { isInteractive, promptYesNo } from "../prompt.mjs";
+import { versionStamp } from "../mcp.mjs";
 
 const DEFAULT_MCP_URL = "https://mcp.tokenoftrust.com";
 
@@ -255,6 +256,10 @@ export async function run(argv, _ctx) {
     return 0;
   }
 
+  // Show which CLI/runtime is actually running BEFORE anything else — the first thing
+  // a "why did sign-in behave oddly" investigation needs (e.g. a stale shadowing `tot`).
+  console.error(versionStamp());
+
   const mcpUrl = args.mcp || env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
 
   if (args.code) {

package/src/commands/start.mjs

@@ -57,6 +57,7 @@ import { CliError, fail, formatError, exitCodeFor } from "../errors.mjs";
 import { openBrowser, waitForServer, firstFreePort } from "../open.mjs";
 import { startProgress } from "../progress.mjs";
 import { defaultLastTenantPath, readLastTenant, writeLastTenant } from "../last-tenant.mjs";
+import { readCredentials, defaultCredentialsPath } from "../token-store.mjs";
 import { collectChecks } from "./doctor.mjs";
 import { normalizeStores, storeListError, checkoutTenant } from "./checkout.mjs";
 import {
@@ -161,6 +162,24 @@ export function decideStartMode({ sampleFlag, hasSession }) {
   return hasSession ? "authed" : "sample";
 }
 
+/**
+ * The MCP base URL the cached session was minted on — what `tot login` stored in the
+ * credentials file (honoring TOT_PROFILE via defaultCredentialsPath). Lets `tot start`
+ * (and callers) FOLLOW wherever the developer signed in rather than defaulting to prod,
+ * which would look up a session on the wrong MCP and report "not signed in". Returns
+ * null when there's no cached session or it can't be read (falls through to the default).
+ * @param {NodeJS.ProcessEnv} env
+ * @returns {string|null}
+ */
+export function cachedMcpUrl(env) {
+  try {
+    const creds = readCredentials(defaultCredentialsPath(env));
+    return creds && typeof creds.mcpUrl === "string" && creds.mcpUrl ? creds.mcpUrl : null;
+  } catch {
+    return null;
+  }
+}
+
 /** @param {string[]} argv @param {any} ctx */
 export async function run(argv, ctx) {
   const env = process.env;
@@ -178,7 +197,11 @@ export async function run(argv, ctx) {
   }
 
   try {
-    const baseUrl = args.mcp || env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
+    // Resolve the MCP: an explicit flag / env wins, then the MCP the cached session was
+    // minted on (what `tot login` stored — so `start` FOLLOWS wherever you signed in
+    // instead of defaulting to prod and reporting "not signed in"), then the prod default.
+    const baseUrl =
+      args.mcp || env.MCP_BASE_URL || env.TOT_MCP_URL || cachedMcpUrl(env) || DEFAULT_MCP_URL;
     const client = createMcpClient(baseUrl);
 
     // Resolve a session, tolerating a no-session / no-network condition so we can

package/src/oauth.mjs

@@ -84,8 +84,15 @@ export async function registerClient(
     headers: { "Content-Type": "application/json", Accept: "application/json" },
     body: JSON.stringify({
       client_name: CLIENT_NAME,
+      // Include the device-code grant: the browserless rendezvous + B3 device flows
+      // redeem their device_code at /oauth/token with this grant, so a client
+      // registered WITHOUT it gets "unauthorized_client: grant_type is invalid".
+      grant_types: [
+        "authorization_code",
+        "refresh_token",
+        "urn:ietf:params:oauth:grant-type:device_code",
+      ],
       redirect_uris: [redirectUri],
-      grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
       token_endpoint_auth_method: "none",
       scope: SCOPE,
@@ -355,7 +362,6 @@ export async function attachRendezvous(attachEndpoint, { rendezvousCode, clientI
  */
 export async function rendezvousLoginFlow({
   mcpUrl,
-  clientId,
   code,
   fetchImpl = fetch,
   log = () => {},
@@ -363,7 +369,12 @@ export async function rendezvousLoginFlow({
   now = () => Date.now(),
 }) {
   const meta = await discoverMetadata(mcpUrl, fetchImpl);
-  const resolvedClientId = clientId || (await registerClient(meta.registration_endpoint, LOOPBACK_REDIRECT, fetchImpl));
+  // Always register a FRESH client for a rendezvous sign-in — do NOT reuse a cached
+  // clientId. A client cached by an older CLI build was registered without the
+  // device-code grant, so /oauth/token would reject the device grant with
+  // "unauthorized_client". Registration is cheap and a rendezvous has no consent
+  // screen to re-trigger (unlike the loopback/device flows, which reuse the cache).
+  const resolvedClientId = await registerClient(meta.registration_endpoint, LOOPBACK_REDIRECT, fetchImpl);
   const { verifier, challenge } = generatePkce();
 
   const attach = await attachRendezvous(