@tokenoftrust/cli 2.0.6 → 2.0.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.0.6",
+  "version": "2.0.8",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/clone.mjs

@@ -46,7 +46,7 @@
  *
  * Dependency-free (global fetch + `git` via child_process).
  */
-import { execFile } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import { createMcpClient } from "../mcp.mjs";
 import { establishSession, AuthUnavailableError } from "../auth.mjs";
@@ -54,7 +54,7 @@ import { offerSignIn } from "./login.mjs";
 import { CliError, fail, formatError } from "../errors.mjs";
 import { writeNvmrc } from "../sample.mjs";
 import { emitObstacle } from "../obstacle.mjs";
-import { CREDENTIAL_HELPER, splitAuthedRemote, basicAuthExtraHeader } from "../git-credential.mjs";
+import { splitAuthedRemote, basicAuthExtraHeader, installForgeCredentialHelper } from "../git-credential.mjs";
 
 const execFileP = promisify(execFile);
 
@@ -366,11 +366,19 @@ async function cloneRepo(gitRemote, dir, redact) {
       next: `check the target dir is empty and you can reach the remote, then re-run`,
     });
   }
+  // Install the HOST-SCOPED helper, not a bare `credential.helper`. A bare one is appended to
+  // whatever is inherited, and on a Mac that inherits `credential.helper = osxkeychain` — which
+  // runs FIRST, answers with a stale forge credential, and shadows ours. Gitea reports the
+  // resulting unauthorized fetch as "Repository not found", so a freshly cloned checkout looks
+  // like a missing repo rather than a credential problem. The host-scoped form writes
+  // ["", <helper>]: the empty reset clears the inherited helper for this host only.
   try {
-    await git(["-C", dir, "config", "--local", "credential.helper", CREDENTIAL_HELPER]);
+    const gitSync = (/** @type {string[]} */ cargs) =>
+      execFileSync("git", ["-C", dir, ...cargs], { encoding: "utf8" });
+    installForgeCredentialHelper(gitSync, { host: new URL(gitRemote).host });
   } catch {
-    // Best-effort — a checkout missing the helper still WORKS (the token just
-    // isn't self-healing yet); the next `tot preview`/`tot sync` migrates it.
+    // Best-effort — never fail a good clone over credential plumbing. The next
+    // `tot preview`/`tot sync` installs it, and the fetch that needs it says why.
   }
   const head = (await git(["-C", dir, "log", "-1", "--oneline"])).trim();
   writeNvmrc(dir); // version-manager hooks land on a supported Node on cd

package/src/commands/sync.mjs

@@ -166,8 +166,13 @@ export async function run(argv, ctx) {
   // used to 401 even right after signing back in. Best-effort, never blocks sync.
   try {
     ensureTokenlessRemote(git);
-  } catch {
-    /* best-effort — see above */
+  } catch (e) {
+    // Best-effort, but never SILENT: this call installs the host-scoped credential helper, and
+    // without it the fetch below fails as "Repository not found" — Gitea's wording for an
+    // unauthorized read. Swallowing the reason turns a credential problem into a phantom
+    // missing repo, with nothing pointing back here.
+    console.error(`~ could not repair this checkout's forge credentials: ${e?.message || e}`);
+    console.error("  a fetch failure below is likely this, not a missing repo.");
   }
 
   // Refuse a dirty tree up front — a merge on top of uncommitted edits is how

package/src/git-credential.mjs

@@ -159,7 +159,15 @@ export function forgeShimPath(env = process.env) {
 /** The shim's contents: pin the ABSOLUTE node + CLI entry active at write time, with a
  *  PATH-search fallback for node, and FAIL LOUD to stderr (never silently) when no node
  *  is found — so a broken helper says how to fix itself instead of yielding an opaque
- *  "Repository not found". Pure — unit-tested. */
+ *  "Repository not found". Pure — unit-tested.
+ *
+ *  The pinned ENTRY gets the same fail-loud treatment as NODE, because the path pinned at
+ *  write time can stop existing: running the CLI from a dev checkout or a git worktree pins
+ *  the shim to THAT tree, and reaping it breaks forge git auth for every checkout on the
+ *  machine — including ones created by the globally-installed `tot`. Unguarded, the failure
+ *  surfaces three layers away as a raw node MODULE_NOT_FOUND followed by git's
+ *  "could not read Username" / "Repository not found", which names neither the stale path
+ *  nor the fix. */
 export function renderForgeShim(nodePath, entryPath) {
   return [
     "#!/bin/sh",
@@ -171,7 +179,18 @@ export function renderForgeShim(nodePath, entryPath) {
     '  echo "tot: no node runtime for the git credential helper — reinstall: npm i -g @tokenoftrust/cli@latest" >&2',
     "  exit 1",
     "fi",
-    `exec "$NODE" ${shq(entryPath)} git-credential "$@"`,
+    `ENTRY=${shq(entryPath)}`,
+    'if [ ! -f "$ENTRY" ]; then',
+    '  echo "tot: the git credential helper points at a CLI that no longer exists:" >&2',
+    '  echo "       $ENTRY" >&2',
+    '  echo "     This shim was pinned by whichever tot ran last — if that was a dev" >&2',
+    '  echo "     checkout or a git worktree that has since been removed, forge git auth" >&2',
+    '  echo "     is broken for EVERY checkout on this machine until it is re-pinned." >&2',
+    '  echo "     Fix: run any tot command that touches git (e.g. \\`tot clone <tenant>\\`)" >&2',
+    '  echo "     from an installed tot, or reinstall: npm i -g @tokenoftrust/cli@latest" >&2',
+    "  exit 1",
+    "fi",
+    'exec "$NODE" "$ENTRY" git-credential "$@"',
     "",
   ].join("\n");
 }