@tokenoftrust/cli 2.0.27 → 2.0.28

package/bin/tot.mjs

@@ -27,6 +27,10 @@ import {
   recordDiagnostic,
   resetInvocationDiagnostics,
 } from "../src/diagnostics.mjs";
+import {
+  nativeWindowsRefuseMessage,
+  shouldRefuseNativeWindows,
+} from "../src/platform.mjs";
 
 const BUILD_ORDER = ["clone", "validate", "dev", "preview"];
 
@@ -99,6 +103,14 @@ async function dispatch(cmd, rest, ctx) {
     return cmd ? 0 : 2;
   }
 
+  // Native Windows: refuse before login/--device/start burn cycles on a host the
+  // local loop cannot run on. doctor/feedback/ideas stay available so the gate
+  // itself is discoverable. WSL reports as linux and passes through.
+  if (shouldRefuseNativeWindows(cmd)) {
+    process.stderr.write(nativeWindowsRefuseMessage(cmd));
+    return 2;
+  }
+
   if (cmd === "start") {
     const { run } = await import("../src/commands/start.mjs");
     return run(rest, ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.0.27",
+  "version": "2.0.28",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/doctor.mjs

@@ -25,6 +25,11 @@ import { join } from "node:path";
 import { hasLegacyOperatorEnv, legacyOperatorEnvAdvisory } from "../auth.mjs";
 import { MIN_NODE, nodeMeetsFloor } from "../ensure-node.mjs";
 import { clientPackages, osLabel } from "../mcp.mjs";
+import {
+  isNativeWindows,
+  nativeWindowsDetail,
+  shouldAttemptDoctorAutoLogin,
+} from "../platform.mjs";
 import { defaultCredentialsPath, readCredentials, isExpired } from "../token-store.mjs";
 import { dockerAvailable, tryStartDocker, RENDERER_CACHE_ROOT, rendererArtifactComplete } from "./dev.mjs";
 import { loginAndCache } from "./login.mjs";
@@ -68,14 +73,12 @@ export function collectChecks(_ctx, env = process.env) {
 
   // Native Windows isn't a supported host for the local loop (the runner install
   // + tar extraction assume a POSIX toolchain) — WSL is, and reports as linux
-  // here. Say so up front instead of letting `tot dev` fail with an opaque ENOENT.
-  const nativeWindows = process.platform === "win32";
+  // here. Say so up front instead of letting `tot login` / `tot dev` fail opaquely.
+  const nativeWindows = isNativeWindows();
   checks.push({
     name: "supported platform",
     pass: !nativeWindows,
-    detail: nativeWindows
-      ? "native Windows isn't supported yet — run tot inside WSL (https://learn.microsoft.com/windows/wsl/install)"
-      : "macOS / Linux / WSL",
+    detail: nativeWindows ? nativeWindowsDetail() : "macOS / Linux / WSL",
     blocking: true,
   });
 
@@ -178,13 +181,17 @@ async function applyFixes(checks, env) {
 
   const auth = checks.find((c) => c.name === "auth identity");
   if (auth && !auth.pass) {
-    const mcpUrl = env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
-    console.log("  ~ not signed in — opening the browser to sign in…");
-    try {
-      await loginAndCache(mcpUrl, env, { log: (m) => console.log(`  ${m}`) });
-      console.log("  ✓ signed in");
-    } catch (e) {
-      console.log(`  ~ couldn't sign in automatically (${e?.message || e}) — run \`tot login\``);
+    if (!shouldAttemptDoctorAutoLogin()) {
+      console.log(`  ~ not signed in — skipping auto-login (${nativeWindowsDetail()})`);
+    } else {
+      const mcpUrl = env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
+      console.log("  ~ not signed in — opening the browser to sign in…");
+      try {
+        await loginAndCache(mcpUrl, env, { log: (m) => console.log(`  ${m}`) });
+        console.log("  ✓ signed in");
+      } catch (e) {
+        console.log(`  ~ couldn't sign in automatically (${e?.message || e}) — run \`tot login\``);
+      }
     }
   }
 }

package/src/commands/login.mjs

@@ -24,6 +24,7 @@ import { defaultCredentialsPath, readCredentials, writeCredentials } from "../to
 import { openBrowser } from "../open.mjs";
 import { fail } from "../errors.mjs";
 import { cockpitRecoveryUrl, normalizeEmailHint, redactEmailForHint, emailFromJwt } from "../auth.mjs";
+import { loginFailureNext } from "../platform.mjs";
 import { isInteractive, promptYesNo } from "../prompt.mjs";
 import { versionStamp } from "../mcp.mjs";
 
@@ -293,9 +294,7 @@ export async function run(argv, _ctx) {
     console.error(
       fail(
         `sign-in didn't complete: ${e?.message || e}`,
-        args.device
-          ? "re-run `tot login --device` and approve the code."
-          : "re-run `tot login` and finish the browser sign-in (approve the request) — or try `tot login --device`.",
+        loginFailureNext({ device: args.device }),
       ),
     );
     return 1;

package/src/platform.mjs

@@ -0,0 +1,91 @@
+/**
+ * Host-platform readiness for the local loop.
+ *
+ * Native Windows is unsupported (runner install + tar extraction assume a POSIX
+ * toolchain). WSL reports as `linux` and is the supported path on a Windows box.
+ * Keep the check + copy in ONE place so doctor, the CLI gate, and login recovery
+ * hints cannot drift.
+ */
+
+export const WSL_INSTALL_URL = "https://learn.microsoft.com/windows/wsl/install";
+
+/**
+ * True when this process is native Windows (not WSL).
+ * @param {string} [platform] Node `process.platform` value (defaults to current).
+ */
+export function isNativeWindows(platform = process.platform) {
+  return platform === "win32";
+}
+
+/**
+ * One-line detail used by `tot doctor` and CliError footers.
+ * @param {{ url?: string }} [opts]
+ */
+export function nativeWindowsDetail(opts = {}) {
+  const url = opts.url ?? WSL_INSTALL_URL;
+  return `native Windows isn't supported yet — run tot inside WSL (${url})`;
+}
+
+/**
+ * Multi-line refuse message printed before exit. Names the attempted command so
+ * a pasted invite (`tot login --code … && tot start`) still points at WSL.
+ * @param {string} [command] e.g. "login", "start"
+ */
+export function nativeWindowsRefuseMessage(command) {
+  const verb = command ? `tot ${command}` : "tot";
+  return (
+    `✗ ${nativeWindowsDetail()}\n` +
+    `  → next: install WSL, open an Ubuntu (or other Linux) terminal, install Node 24 LTS + git there,\n` +
+    `    then re-run \`${verb}\` inside WSL — don't keep retrying login/--device on native Windows.\n`
+  );
+}
+
+/**
+ * Commands that are safe / useful to run on native Windows so the developer can
+ * learn the gate (`doctor`) or report friction (`feedback`) without a false start.
+ */
+export const NATIVE_WINDOWS_ALLOWED_COMMANDS = new Set([
+  "help",
+  "--help",
+  "-h",
+  "--version",
+  "-v",
+  "version",
+  "doctor",
+  "feedback",
+  "ideas",
+]);
+
+/**
+ * @param {string | null | undefined} command
+ * @param {string} [platform] Node `process.platform` value (defaults to current).
+ * @returns {boolean} true when this command must refuse on native Windows
+ */
+export function shouldRefuseNativeWindows(command, platform = process.platform) {
+  if (!isNativeWindows(/** @type {string} */ (platform))) return false;
+  const cmd = String(command ?? "").trim();
+  if (!cmd) return false; // bare `tot` → help
+  return !NATIVE_WINDOWS_ALLOWED_COMMANDS.has(cmd);
+}
+
+/**
+ * Recovery hint after a failed `tot login`. Never steers native Windows at
+ * `--device` — that path still can't run the local loop on win32.
+ * @param {{ device?: boolean, platform?: string }} [opts]
+ */
+export function loginFailureNext(opts = {}) {
+  const platform = /** @type {string} */ (opts.platform ?? process.platform);
+  if (isNativeWindows(platform)) return nativeWindowsDetail();
+  return opts.device
+    ? "re-run `tot login --device` and approve the code."
+    : "re-run `tot login` and finish the browser sign-in (approve the request) — or try `tot login --device`.";
+}
+
+/**
+ * `tot doctor --fix` must not open OAuth on native Windows — the session
+ * would be unusable for the local loop, and the browser hop burns a cycle.
+ * @param {string} [platform] Node `process.platform` value (defaults to current).
+ */
+export function shouldAttemptDoctorAutoLogin(platform = process.platform) {
+  return !isNativeWindows(/** @type {string} */ (platform));
+}