@tokenoftrust/cli 2.0.7 → 2.0.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.0.7",
+  "version": "2.0.9",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/clone.mjs

@@ -46,7 +46,7 @@
  *
  * Dependency-free (global fetch + `git` via child_process).
  */
-import { execFile } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import { createMcpClient } from "../mcp.mjs";
 import { establishSession, AuthUnavailableError } from "../auth.mjs";
@@ -54,7 +54,7 @@ import { offerSignIn } from "./login.mjs";
 import { CliError, fail, formatError } from "../errors.mjs";
 import { writeNvmrc } from "../sample.mjs";
 import { emitObstacle } from "../obstacle.mjs";
-import { CREDENTIAL_HELPER, splitAuthedRemote, basicAuthExtraHeader } from "../git-credential.mjs";
+import { splitAuthedRemote, basicAuthExtraHeader, installForgeCredentialHelper } from "../git-credential.mjs";
 
 const execFileP = promisify(execFile);
 
@@ -366,11 +366,19 @@ async function cloneRepo(gitRemote, dir, redact) {
       next: `check the target dir is empty and you can reach the remote, then re-run`,
     });
   }
+  // Install the HOST-SCOPED helper, not a bare `credential.helper`. A bare one is appended to
+  // whatever is inherited, and on a Mac that inherits `credential.helper = osxkeychain` — which
+  // runs FIRST, answers with a stale forge credential, and shadows ours. Gitea reports the
+  // resulting unauthorized fetch as "Repository not found", so a freshly cloned checkout looks
+  // like a missing repo rather than a credential problem. The host-scoped form writes
+  // ["", <helper>]: the empty reset clears the inherited helper for this host only.
   try {
-    await git(["-C", dir, "config", "--local", "credential.helper", CREDENTIAL_HELPER]);
+    const gitSync = (/** @type {string[]} */ cargs) =>
+      execFileSync("git", ["-C", dir, ...cargs], { encoding: "utf8" });
+    installForgeCredentialHelper(gitSync, { host: new URL(gitRemote).host });
   } catch {
-    // Best-effort — a checkout missing the helper still WORKS (the token just
-    // isn't self-healing yet); the next `tot preview`/`tot sync` migrates it.
+    // Best-effort — never fail a good clone over credential plumbing. The next
+    // `tot preview`/`tot sync` installs it, and the fetch that needs it says why.
   }
   const head = (await git(["-C", dir, "log", "-1", "--oneline"])).trim();
   writeNvmrc(dir); // version-manager hooks land on a supported Node on cd

package/src/commands/submit.mjs

@@ -1154,7 +1154,7 @@ function reportCandidate(result, changeId, { quiet = false } = {}) {
  * Defaults to null when no numeric PR number was known at result-build time.
  * Pure — unit-tested.
  * @param {{ ok: boolean, ref?: string|null, commit?: string|null, changeId?: string|null,
- *   candidate?: {prNumber?: number, number?: number, state?: string, url?: string}|null,
+ *   candidate?: {prNumber?: number, number?: number, state?: string, url?: string, headSha?: string|null}|null,
  *   status?: {status?: string, reconcile?: object|null, compliance?: object|null,
  *     previewUrl?: string|null, shipped?: object|null, dispatched?: boolean|null,
  *     notDispatched?: boolean, delivery?: object|null}|null,
@@ -1165,6 +1165,10 @@ export function buildJsonResult({ ok, ref = null, commit = null, changeId = null
     ok,
     ref,
     commit,
+    // The sha the `status`/`reconcile`/`compliance` fields above are reported against —
+    // the candidate head when the candidate names one, else the local `commit`. Kept
+    // beside `commit` rather than replacing it so automation can tell the two apart.
+    candidateHeadSha: candidate ? resolvePreviewStatusSha(commit, candidate) : null,
     changeId,
     candidate: candidate
       ? { number: candidate.prNumber ?? candidate.number ?? null, state: candidate.state ?? null, url: candidate.url ?? null }
@@ -1184,6 +1188,43 @@ export function buildJsonResult({ ok, ref = null, commit = null, changeId = null
   };
 }
 
+/**
+ * The sha `preview_status` actually resolves against. The candidate the forge opened
+ * may carry a DIFFERENT head than the commit you pushed (it is rebuilt onto the
+ * current store), and `preview_status` only knows the candidate head — so polling the
+ * local commit returns a misleading `pending` / "no reconcile delivery observed"
+ * instead of the real result. Prefer the candidate head whenever the candidate names
+ * one; fall back to the local commit (no candidate, or an older MCP that omits it).
+ * Pure — unit-tested.
+ * @param {string|null} commit local HEAD sha
+ * @param {{headSha?: string|null}|null} candidate the candidate_open projection
+ */
+export function resolvePreviewStatusSha(commit, candidate) {
+  const head = typeof candidate?.headSha === "string" ? candidate.headSha.trim() : "";
+  return head || commit;
+}
+
+/**
+ * The two-sha notice, printed ONLY when they actually differ (when they match there is
+ * nothing to disambiguate and a second line would be noise). Names which sha the
+ * reconcile result is reported against, so a developer polling by hand — or reading a
+ * failure — knows which one to use. Pure — unit-tested.
+ * @param {string|null} commit local HEAD sha
+ * @param {{headSha?: string|null}|null} candidate the candidate_open projection
+ * @returns {string[]} lines to print (empty when there is no distinction to draw)
+ */
+export function formatCandidateHeadNotice(commit, candidate) {
+  const head = resolvePreviewStatusSha(commit, candidate);
+  if (!commit || !head || head === commit) return [];
+  return [
+    "",
+    `  ▸ local commit:    ${commit.slice(0, 9)}   (what you committed here)`,
+    `    candidate head:  ${head.slice(0, 9)}   (what preview_status reports on)`,
+    "    They differ because your candidate is rebuilt on the current store. Follow the",
+    "    candidate head — the local commit reads as \"never dispatched\", not as the result.",
+  ];
+}
+
 /** Print the `--json` result as one pretty-printed object on stdout — a no-op
  *  unless `args.json` was passed, so call sites can invoke it unconditionally. */
 function emitJson(args, payload) {
@@ -1663,9 +1704,18 @@ export async function run(argv, ctx, { verb = "preview" } = {}) {
       } catch { /* best-effort local hint — a miss just re-derives the stable id */ }
     }
 
+    // Poll the sha `preview_status` actually resolves against — the candidate head, not
+    // the local commit, whenever the candidate names its own. Printed first (when they
+    // differ) so the developer reads the result against the right sha.
+    const statusSha = resolvePreviewStatusSha(commit, candidate) ?? commit;
+    const statusShort = statusSha.slice(0, 9);
+    if (!args.json) {
+      for (const line of formatCandidateHeadNotice(commit, candidate)) console.log(line);
+    }
+
     let status;
     if (args.noWait) {
-      status = normalizePreviewStatus(await client.callTool("preview_status", { commit }));
+      status = normalizePreviewStatus(await client.callTool("preview_status", { commit: statusSha }));
     } else {
       // One in-place status line (TTY: a spinner with an elapsed-seconds counter;
       // non-TTY: a ~10s heartbeat) instead of a newline per poll — the wait reads
@@ -1681,11 +1731,11 @@ export async function run(argv, ctx, { verb = "preview" } = {}) {
       // stage text ("still reconciling…") IS truthful and is left as-is below.
       let phase = "reconcile";
       if (!args.json) {
-        progress = startProgress(`waiting for reconcile of ${short}…`, {
-          stages: [{ afterMs: 45_000, text: `still reconciling ${short}… (larger changes take longer)` }],
+        progress = startProgress(`waiting for reconcile of ${statusShort}…`, {
+          stages: [{ afterMs: 45_000, text: `still reconciling ${statusShort}… (larger changes take longer)` }],
         });
       }
-      status = await pollPreviewStatus(client, commit, {
+      status = await pollPreviewStatus(client, statusSha, {
         ...(args.watch ? WATCH_POLL : DEFAULT_POLL),
         onTick: (s) => {
           // Reconcile is done but we're still waiting on a ship decision (--watch):
@@ -1693,7 +1743,7 @@ export async function run(argv, ctx, { verb = "preview" } = {}) {
           if (!args.json && s.status === "reconciled" && !s.shipped && phase !== "ship") {
             phase = "ship";
             progress.stop();
-            progress = startProgress(`reconciled ${short} — waiting for a ship decision…`);
+            progress = startProgress(`reconciled ${statusShort} — waiting for a ship decision…`);
           }
         },
       });
@@ -1704,7 +1754,9 @@ export async function run(argv, ctx, { verb = "preview" } = {}) {
     }
     // --json also skips the browser auto-open (open: !args.noOpen && !args.json)
     // — automation doesn't want a browser popping up.
-    reportStatus(status, tenant, { open: !args.noOpen && !args.json, quiet: args.json, commit, ref, verb, noChanges: patchEntries.length === 0 });
+    // `commit: statusSha` — the diagnostic blocks name the sha that was actually polled,
+    // so a "never dispatched" hint points at a sha `preview_status` knows about.
+    reportStatus(status, tenant, { open: !args.noOpen && !args.json, quiet: args.json, commit: statusSha, ref, verb, noChanges: patchEntries.length === 0 });
     emitJson(args, buildJsonResult({ ok: status?.status !== "failed", ref, commit, changeId, candidate, status, previewPrUrl }));
     return status?.status === "failed" ? 1 : 0;
   } catch (e) {

package/src/commands/sync.mjs

@@ -166,8 +166,13 @@ export async function run(argv, ctx) {
   // used to 401 even right after signing back in. Best-effort, never blocks sync.
   try {
     ensureTokenlessRemote(git);
-  } catch {
-    /* best-effort — see above */
+  } catch (e) {
+    // Best-effort, but never SILENT: this call installs the host-scoped credential helper, and
+    // without it the fetch below fails as "Repository not found" — Gitea's wording for an
+    // unauthorized read. Swallowing the reason turns a credential problem into a phantom
+    // missing repo, with nothing pointing back here.
+    console.error(`~ could not repair this checkout's forge credentials: ${e?.message || e}`);
+    console.error("  a fetch failure below is likely this, not a missing repo.");
   }
 
   // Refuse a dirty tree up front — a merge on top of uncommitted edits is how