@tokenoftrust/cli 1.4.0-rc.22 → 1.4.0-rc.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "1.4.0-rc.22",
+  "version": "1.4.0-rc.24",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/submit.mjs

@@ -444,6 +444,41 @@ export function baseCommitsBehind(git, branch) {
   }
 }
 
+/**
+ * Resolve the git ref to diff HEAD against for the candidate's file patch (and its
+ * summary). The candidate PR is `preview + your file changes`, and `candidate_open`
+ * SERVER-CUTS the candidate branch back to the current preview tip and re-applies the
+ * patch — so the patch MUST be the FULL delta of your branch vs its fork point off
+ * `preview`, never "what changed since my last candidate push". Diffing against your
+ * own candidate tracking ref is what silently produced an empty patch (and the wrong
+ * "no file changes" skip, so no PR opened) after a push that landed but failed to open
+ * its PR: that ref already equals HEAD, so the since-last-push delta is empty even
+ * though the change vs preview is 19 files. Prefer the merge-base (fork point) with
+ * `origin/<baseBranch>`; fall back to the candidate tracking ref, then HEAD~1, then ""
+ * (single-commit `git show`) when no base ref resolves. Pure git I/O via the injected
+ * runner — unit-tested.
+ * @param {(cargs:string[])=>string} git
+ * @param {string} ref  the candidate ref (e.g. "candidate/local-abc")
+ * @param {string} [baseBranch]  the preview base branch (default FRESHNESS_BASE_BRANCH)
+ * @returns {string}
+ */
+export function resolvePatchBase(git, ref, baseBranch = FRESHNESS_BASE_BRANCH) {
+  const verify = (r) => {
+    try { return git(["rev-parse", "--verify", "--quiet", r]).trim(); } catch { return ""; }
+  };
+  const previewRef = `refs/remotes/origin/${baseBranch}`;
+  if (verify(previewRef)) {
+    try {
+      const forkPoint = git(["merge-base", "HEAD", previewRef]).trim();
+      if (forkPoint) return forkPoint;
+    } catch { /* unrelated histories — fall through */ }
+  }
+  const trackingRef = `refs/remotes/origin/${ref}`;
+  if (verify(trackingRef)) return trackingRef;
+  if (verify("HEAD~1")) return "HEAD~1";
+  return "";
+}
+
 // ─── born-rebased at submit (unit c3 — shift-left prevention #2) ─────────────────
 
 /** The three strategies the born-rebased rebuild accepts, mirroring `tot accept
@@ -1355,12 +1390,12 @@ export async function run(argv, ctx, { verb = "preview" } = {}) {
   };
   function buildSummaryAndPatch(ref) {
     const headSubject = gitSafe(["log", "-1", "--format=%s"]).trim();
-    const trackingRef = `refs/remotes/origin/${ref}`;
-    const base = gitSafe(["rev-parse", "--verify", "--quiet", trackingRef]).trim()
-      ? trackingRef
-      : gitSafe(["rev-parse", "--verify", "--quiet", "HEAD~1"]).trim()
-        ? "HEAD~1"
-        : "";
+    // Diff against the fork point off `preview` — the FULL branch delta — so the patch
+    // is complete for candidate_open's server-cut (which resets the branch to preview
+    // and re-applies this patch). NOT the candidate's own tracking ref: after a push
+    // that landed but failed to open its PR, that ref equals HEAD → empty patch →
+    // wrong "no file changes" → no PR. See resolvePatchBase.
+    const base = resolvePatchBase(gitSafe, ref);
     const statusCmd = base ? ["diff", "--name-status", `${base}..HEAD`] : ["show", "--name-status", "--format=", "HEAD"];
     const patchEntries = parseNameStatus(gitSafe(statusCmd));
     const files = patchEntries.map((e) => e.path);

package/src/git-credential.mjs

@@ -19,7 +19,8 @@
  */
 import { homedir } from "node:os";
 import { createHash } from "node:crypto";
-import { join } from "node:path";
+import { join, dirname } from "node:path";
+import { mkdirSync, writeFileSync, chmodSync } from "node:fs";
 import { readCredentials, writeCredentials } from "./token-store.mjs";
 
 /** The git config value that routes credential requests through `tot` — the
@@ -141,20 +142,96 @@ export function writeCachedCredential(filePath, { username, password }, { now =
   writeCredentials(filePath, { username, password, mintedAt: now });
 }
 
+/** Single-quote a string for safe interpolation into the /bin/sh shim. Pure. */
+function shq(s) {
+  return `'${String(s).replace(/'/g, `'\\''`)}'`;
+}
+
+/** Absolute path to the stable, node-version-independent credential-helper shim
+ *  under `~/.tot/bin` (honors `TOT_HOME`). A checkout's git config points at THIS by
+ *  absolute path — never a bare `!tot` — so `nvm use` (which swaps the per-node `tot`)
+ *  can't silently redirect forge auth to an older/missing CLI. Pure. */
+export function forgeShimPath(env = process.env) {
+  const home = env.TOT_HOME || homedir();
+  return join(home, ".tot", "bin", "tot-git-credential");
+}
+
+/** The shim's contents: pin the ABSOLUTE node + CLI entry active at write time, with a
+ *  PATH-search fallback for node, and FAIL LOUD to stderr (never silently) when no node
+ *  is found — so a broken helper says how to fix itself instead of yielding an opaque
+ *  "Repository not found". Pure — unit-tested. */
+export function renderForgeShim(nodePath, entryPath) {
+  return [
+    "#!/bin/sh",
+    "# Managed by tot — stable forge credential helper (regenerated each run; do not edit).",
+    "# Decouples git auth from which node/tot is active in the shell (nvm-proof).",
+    `NODE=${shq(nodePath)}`,
+    '[ -x "$NODE" ] || NODE="$(command -v node 2>/dev/null)"',
+    'if [ -z "$NODE" ]; then',
+    '  echo "tot: no node runtime for the git credential helper — reinstall: npm i -g @tokenoftrust/cli@latest" >&2',
+    "  exit 1",
+    "fi",
+    `exec "$NODE" ${shq(entryPath)} git-credential "$@"`,
+    "",
+  ].join("\n");
+}
+
+/** Write/refresh the shim (0700 dir, 0755 file). Best-effort — returns the shim path,
+ *  or "" if it couldn't be written (caller then falls back to the bare `!tot` helper). */
+export function writeForgeShim(env = process.env, nodePath = process.execPath, entryPath = process.argv[1]) {
+  try {
+    if (!nodePath || !entryPath) return "";
+    const p = forgeShimPath(env);
+    mkdirSync(dirname(p), { recursive: true, mode: 0o700 });
+    writeFileSync(p, renderForgeShim(nodePath, entryPath), { mode: 0o755 });
+    chmodSync(p, 0o755);
+    return p;
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Install (or refresh) the HOST-SCOPED forge credential helper on a checkout so that:
+ *  - it runs the stable `~/.tot` shim by ABSOLUTE path (nvm-proof), not a bare `!tot`;
+ *  - a leading EMPTY reset value clears any inherited GLOBAL helper for this host — the
+ *    fix for `credential.helper = osxkeychain` (every Mac dev) running first, returning
+ *    a stale forge cred, and shadowing our helper so `git pull` 404s even after login.
+ * Idempotent: a no-op when the host-scoped list is already `["", <ourHelper>]`. Returns
+ * whether it changed anything. `writeShim` is injected for tests. Pure git I/O otherwise.
+ * @returns {boolean} changed
+ */
+export function installForgeCredentialHelper(git, {
+  host, env = process.env, nodePath = process.execPath, entryPath = process.argv[1],
+  writeShim = writeForgeShim,
+} = {}) {
+  if (!host) return false;
+  const shim = writeShim(env, nodePath, entryPath);
+  const helperValue = shim ? `!${shim}` : CREDENTIAL_HELPER;
+  const key = `credential.https://${host}.helper`;
+  let raw = null;
+  try { raw = git(["config", "--local", "--get-all", key]); } catch { raw = null; }
+  // git prints one value per line (an empty value = an empty line); our desired list is
+  // ["", helperValue] → "\n<helperValue>". Already correct ⇒ nothing to do.
+  if (raw !== null && raw.replace(/\n+$/, "") === `\n${helperValue}`) return false;
+  try { git(["config", "--local", "--unset-all", key]); } catch { /* none set yet */ }
+  git(["config", "--local", "--add", key, ""]);            // reset: clear inherited (osxkeychain) for this host
+  git(["config", "--local", "--add", key, helperValue]);   // our helper is now the sole one
+  return true;
+}
+
 /**
- * Self-heal a LEGACY checkout: if `origin`'s remote still carries an
- * embedded token (the pre-u10 `tot clone` shape, or one predating `tot
- * login` entirely), strip it — rewriting the remote to the tokenless public
- * URL — and install the credential helper so future git operations mint
- * fresh creds through `tot` instead of relying on a token that silently
- * expires. Meant to be called at the top of every command that touches git,
- * best-effort (the caller decides how to handle a thrown error — this never
- * blocks the actual command on a migration hiccup). A no-op on an
- * already-migrated, tokenless, or non-http(s) (e.g. ssh) remote.
+ * Self-heal a LEGACY checkout, best-effort: strip any embedded token from `origin`
+ * (the pre-u10 shape whose token silently expires), then install the stable, host-scoped
+ * credential helper (see installForgeCredentialHelper) so future git ops mint fresh creds
+ * through the `~/.tot` shim — nvm-proof and un-shadowable by osxkeychain. Called at the top
+ * of every command that touches git. A no-op on an already-migrated remote; leaves a
+ * non-http(s) (e.g. ssh) remote entirely alone. Never blocks the command on a hiccup.
  * @param {(cargs:string[])=>string} git  a `git -C <workspace>` runner
+ * @param {{ env?: NodeJS.ProcessEnv, nodePath?: string, entryPath?: string, writeShim?: typeof writeForgeShim }} [opts]
  * @returns {{ migrated: boolean }}
  */
-export function ensureTokenlessRemote(git) {
+export function ensureTokenlessRemote(git, opts = {}) {
   let remote;
   try {
     remote = git(["remote", "get-url", "origin"]).trim();
@@ -162,8 +239,10 @@ export function ensureTokenlessRemote(git) {
     return { migrated: false }; // no `origin` (or not a git repo) — nothing to migrate
   }
   let migrated = false;
+  let host = "";
   try {
     const u = new URL(remote);
+    host = u.host;
     if (u.password) {
       git(["remote", "set-url", "origin", `${u.protocol}//${u.host}${u.pathname}`]);
       migrated = true;
@@ -171,15 +250,6 @@ export function ensureTokenlessRemote(git) {
   } catch {
     return { migrated }; // not a parseable URL (e.g. an ssh remote) — leave it alone entirely
   }
-  let helper = "";
-  try {
-    helper = git(["config", "--local", "--get", "credential.helper"]).trim();
-  } catch {
-    /* unset — falls through to configuring it below */
-  }
-  if (helper !== CREDENTIAL_HELPER) {
-    git(["config", "--local", "credential.helper", CREDENTIAL_HELPER]);
-    migrated = true;
-  }
+  if (installForgeCredentialHelper(git, { ...opts, host })) migrated = true;
   return { migrated };
 }