@tokenoftrust/cli 2.2.6 → 2.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.2.6",
+  "version": "2.2.7",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/git-credential.mjs

@@ -22,14 +22,25 @@
  * git config by `tot clone agency-kit`) mints through `repo_read_credential`,
  * cached under a key a store's can never take.
  *
- * FAILS SILENT, NEVER LOUD: `get` prints NOTHING and exits non-zero on any
- * problem (not signed in, MCP unreachable, cwd isn't a recognizable tenant
- * checkout) — git then falls through to its next configured helper or its
- * own prompt, exactly as if this helper weren't configured. A stack trace or
- * a malformed credential line here would otherwise corrupt EVERY git
- * operation in the checkout. It also NEVER triggers an interactive sign-in —
- * this runs as a non-interactive subprocess of `git`, so a missing session
- * fails through rather than trying to open a browser mid-`git fetch`.
+ * FAILS SILENT ON STDOUT, NEVER LOUD THERE: `get` prints NOTHING on stdout and
+ * exits non-zero on any problem (not signed in, MCP unreachable, cwd isn't a
+ * recognizable tenant checkout) — git then falls through to its next
+ * configured helper or its own prompt, exactly as if this helper weren't
+ * configured. A stack trace or a malformed credential line on STDOUT here
+ * would otherwise corrupt EVERY git operation in the checkout. It also NEVER
+ * triggers an interactive sign-in — this runs as a non-interactive subprocess
+ * of `git`, so a missing session fails through rather than trying to open a
+ * browser mid-`git fetch`.
+ *
+ * It is NOT silent on stderr for every failure, though: when the MCP itself
+ * renders an authoritative decision — a `CliError` from `tenant_checkout` or
+ * `repo_read_credential`, e.g. "this checkout names a tenant your session
+ * doesn't hold" — that diagnosis is lost forever if swallowed, and git passes
+ * a credential helper's stderr straight through to the developer's terminal.
+ * So those specific catches print the CliError's house-style message (+ its
+ * `next` step) to stderr before returning null. A bare network/auth failure
+ * (not signed in, MCP unreachable, wrong dir) has no such decision to report
+ * and stays silent exactly as before.
  *
  * Dependency-free (global fetch + `git`, via the same MCP client + auth
  * module every other command uses).
@@ -41,6 +52,7 @@ import { establishSession } from "../auth.mjs";
 import { checkoutTenant, mintReadOnlyAlias, resolveReadOnlyAlias } from "./clone.mjs";
 import { detectContext } from "../context.mjs";
 import { repoNameFromRemote, tagFromRepoName } from "./submit.mjs";
+import { CliError, formatError } from "../errors.mjs";
 import {
   parseCredentialInput, formatCredentialOutput, splitAuthedRemote,
   credentialCachePath, readCachedCredential, writeCachedCredential,
@@ -129,8 +141,13 @@ export async function mintOrCacheCredential({
       const fresh = { username: cred.username, password: cred.token };
       writeCachedCredential(cachePath, fresh);
       return fresh;
-    } catch {
-      return null; // not signed in / MCP unreachable / no kit access — say nothing
+    } catch (e) {
+      // A CliError is an authoritative decision (e.g. the kit credential was refused) —
+      // report it on stderr so `git fetch` doesn't dead-end the developer in silence. A
+      // bare network/auth failure (not signed in, MCP unreachable) has no decision to
+      // report and stays silent, same as every other "nothing this helper can do" path.
+      if (e instanceof CliError) console.error(formatError(e));
+      return null;
     }
   }
 
@@ -168,8 +185,15 @@ export async function mintOrCacheCredential({
     const fresh = { username: cred.username, password: cred.token };
     writeCachedCredential(cachePath, fresh);
     return fresh;
-  } catch {
-    return null; // MCP unreachable / tenant_checkout refused — say nothing, exit non-zero
+  } catch (e) {
+    // Same distinction as the kit-checkout catch above: `checkoutTenant` renders a
+    // CliError when the MCP (or this checkout's own state) has an authoritative answer
+    // — e.g. this checkout's `.tot/config.json` names a tenant the session doesn't hold,
+    // or `tenant_checkout` echoed a different tenant than the one asked for — and that
+    // diagnosis is lost forever if swallowed silently. A bare network/auth failure has
+    // no such decision and stays silent, exit non-zero, exactly as before.
+    if (e instanceof CliError) console.error(formatError(e));
+    return null;
   }
 }