@tokenoftrust/cli 2.0.7 → 2.0.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/clone.mjs

@@ -46,7 +46,7 @@
  *
  * Dependency-free (global fetch + `git` via child_process).
  */
-import { execFile } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import { createMcpClient } from "../mcp.mjs";
 import { establishSession, AuthUnavailableError } from "../auth.mjs";
@@ -54,7 +54,7 @@ import { offerSignIn } from "./login.mjs";
 import { CliError, fail, formatError } from "../errors.mjs";
 import { writeNvmrc } from "../sample.mjs";
 import { emitObstacle } from "../obstacle.mjs";
-import { CREDENTIAL_HELPER, splitAuthedRemote, basicAuthExtraHeader } from "../git-credential.mjs";
+import { splitAuthedRemote, basicAuthExtraHeader, installForgeCredentialHelper } from "../git-credential.mjs";
 
 const execFileP = promisify(execFile);
 
@@ -366,11 +366,19 @@ async function cloneRepo(gitRemote, dir, redact) {
       next: `check the target dir is empty and you can reach the remote, then re-run`,
     });
   }
+  // Install the HOST-SCOPED helper, not a bare `credential.helper`. A bare one is appended to
+  // whatever is inherited, and on a Mac that inherits `credential.helper = osxkeychain` — which
+  // runs FIRST, answers with a stale forge credential, and shadows ours. Gitea reports the
+  // resulting unauthorized fetch as "Repository not found", so a freshly cloned checkout looks
+  // like a missing repo rather than a credential problem. The host-scoped form writes
+  // ["", <helper>]: the empty reset clears the inherited helper for this host only.
   try {
-    await git(["-C", dir, "config", "--local", "credential.helper", CREDENTIAL_HELPER]);
+    const gitSync = (/** @type {string[]} */ cargs) =>
+      execFileSync("git", ["-C", dir, ...cargs], { encoding: "utf8" });
+    installForgeCredentialHelper(gitSync, { host: new URL(gitRemote).host });
   } catch {
-    // Best-effort — a checkout missing the helper still WORKS (the token just
-    // isn't self-healing yet); the next `tot preview`/`tot sync` migrates it.
+    // Best-effort — never fail a good clone over credential plumbing. The next
+    // `tot preview`/`tot sync` installs it, and the fetch that needs it says why.
   }
   const head = (await git(["-C", dir, "log", "-1", "--oneline"])).trim();
   writeNvmrc(dir); // version-manager hooks land on a supported Node on cd

package/src/commands/sync.mjs

@@ -166,8 +166,13 @@ export async function run(argv, ctx) {
   // used to 401 even right after signing back in. Best-effort, never blocks sync.
   try {
     ensureTokenlessRemote(git);
-  } catch {
-    /* best-effort — see above */
+  } catch (e) {
+    // Best-effort, but never SILENT: this call installs the host-scoped credential helper, and
+    // without it the fetch below fails as "Repository not found" — Gitea's wording for an
+    // unauthorized read. Swallowing the reason turns a credential problem into a phantom
+    // missing repo, with nothing pointing back here.
+    console.error(`~ could not repair this checkout's forge credentials: ${e?.message || e}`);
+    console.error("  a fetch failure below is likely this, not a missing repo.");
   }
 
   // Refuse a dirty tree up front — a merge on top of uncommitted edits is how