@tokenoftrust/cli 2.2.6 → 2.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.2.6",
+  "version": "2.2.8",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/git-credential.mjs

@@ -22,14 +22,25 @@
  * git config by `tot clone agency-kit`) mints through `repo_read_credential`,
  * cached under a key a store's can never take.
  *
- * FAILS SILENT, NEVER LOUD: `get` prints NOTHING and exits non-zero on any
- * problem (not signed in, MCP unreachable, cwd isn't a recognizable tenant
- * checkout) — git then falls through to its next configured helper or its
- * own prompt, exactly as if this helper weren't configured. A stack trace or
- * a malformed credential line here would otherwise corrupt EVERY git
- * operation in the checkout. It also NEVER triggers an interactive sign-in —
- * this runs as a non-interactive subprocess of `git`, so a missing session
- * fails through rather than trying to open a browser mid-`git fetch`.
+ * FAILS SILENT ON STDOUT, NEVER LOUD THERE: `get` prints NOTHING on stdout and
+ * exits non-zero on any problem (not signed in, MCP unreachable, cwd isn't a
+ * recognizable tenant checkout) — git then falls through to its next
+ * configured helper or its own prompt, exactly as if this helper weren't
+ * configured. A stack trace or a malformed credential line on STDOUT here
+ * would otherwise corrupt EVERY git operation in the checkout. It also NEVER
+ * triggers an interactive sign-in — this runs as a non-interactive subprocess
+ * of `git`, so a missing session fails through rather than trying to open a
+ * browser mid-`git fetch`.
+ *
+ * It is NOT silent on stderr for every failure, though: when the MCP itself
+ * renders an authoritative decision — a `CliError` from `tenant_checkout` or
+ * `repo_read_credential`, e.g. "this checkout names a tenant your session
+ * doesn't hold" — that diagnosis is lost forever if swallowed, and git passes
+ * a credential helper's stderr straight through to the developer's terminal.
+ * So those specific catches print the CliError's house-style message (+ its
+ * `next` step) to stderr before returning null. A bare network/auth failure
+ * (not signed in, MCP unreachable, wrong dir) has no such decision to report
+ * and stays silent exactly as before.
  *
  * Dependency-free (global fetch + `git`, via the same MCP client + auth
  * module every other command uses).
@@ -41,6 +52,7 @@ import { establishSession } from "../auth.mjs";
 import { checkoutTenant, mintReadOnlyAlias, resolveReadOnlyAlias } from "./clone.mjs";
 import { detectContext } from "../context.mjs";
 import { repoNameFromRemote, tagFromRepoName } from "./submit.mjs";
+import { CliError, formatError } from "../errors.mjs";
 import {
   parseCredentialInput, formatCredentialOutput, splitAuthedRemote,
   credentialCachePath, readCachedCredential, writeCachedCredential,
@@ -129,8 +141,13 @@ export async function mintOrCacheCredential({
       const fresh = { username: cred.username, password: cred.token };
       writeCachedCredential(cachePath, fresh);
       return fresh;
-    } catch {
-      return null; // not signed in / MCP unreachable / no kit access — say nothing
+    } catch (e) {
+      // A CliError is an authoritative decision (e.g. the kit credential was refused) —
+      // report it on stderr so `git fetch` doesn't dead-end the developer in silence. A
+      // bare network/auth failure (not signed in, MCP unreachable) has no decision to
+      // report and stays silent, same as every other "nothing this helper can do" path.
+      if (e instanceof CliError) console.error(formatError(e));
+      return null;
     }
   }
 
@@ -148,9 +165,22 @@ export async function mintOrCacheCredential({
     /* fall through — tagFromRepoName degrades to "main" on a null repo name */
   }
   if (expectedHost && !hostMatches(originUrl, expectedHost)) return null;
-  const tag = tagFromRepoName(repoName, ctx.tenant);
 
-  const cachePath = credentialCachePath(ctx.tenant, tag, env);
+  // Prefer the tenant encoded in the git remote itself over `.tot/config.json`'s
+  // "tenant" field. The remote URL is the forge's OWN record of this checkout's repo
+  // (set once by `tenant_checkout`'s returned cloneUrl at clone time); the config file
+  // is tenant-owned, committed content a developer's own commit can set wrong at seed
+  // time or drift later — exactly what broke every client_switch/tenant_checkout call
+  // in fb-1790958790645-7j8gul / fb-1790969588649-zl3xa7. Every real tenant is
+  // provisioned with repo === owner (storefront's provisioning enforces this at every
+  // call site — buildStaffStoreIdentity, scripts/tenant/provision-gitea-repo.mjs), so
+  // the repo name IS the tenant id. Fall back to the config file only when the remote
+  // can't be read or parsed (no origin yet) — this never makes the mint MORE likely to
+  // fail than before, only less dependent on content the forge itself didn't set.
+  const tenant = repoName || ctx.tenant;
+  const tag = tagFromRepoName(repoName, tenant);
+
+  const cachePath = credentialCachePath(tenant, tag, env);
   const cached = readCachedCredential(cachePath);
   if (cached) return { username: cached.username, password: cached.password };
 
@@ -162,14 +192,21 @@ export async function mintOrCacheCredential({
     return null; // not signed in (or session unrefreshable) — nothing this helper can do
   }
   try {
-    const res = await checkout(client, { tenant: ctx.tenant, tag, cloneDir: null });
+    const res = await checkout(client, { tenant, tag, cloneDir: null });
     const cred = splitAuthedRemote(res.gitRemote || "");
     if (!cred) return null;
     const fresh = { username: cred.username, password: cred.token };
     writeCachedCredential(cachePath, fresh);
     return fresh;
-  } catch {
-    return null; // MCP unreachable / tenant_checkout refused — say nothing, exit non-zero
+  } catch (e) {
+    // Same distinction as the kit-checkout catch above: `checkoutTenant` renders a
+    // CliError when the MCP (or this checkout's own state) has an authoritative answer
+    // — e.g. this checkout's `.tot/config.json` names a tenant the session doesn't hold,
+    // or `tenant_checkout` echoed a different tenant than the one asked for — and that
+    // diagnosis is lost forever if swallowed silently. A bare network/auth failure has
+    // no such decision and stays silent, exit non-zero, exactly as before.
+    if (e instanceof CliError) console.error(formatError(e));
+    return null;
   }
 }
 
@@ -212,8 +249,12 @@ export function forgetCredential({ env = process.env, cwd = process.cwd(), expec
       }).toString().trim();
     } catch { /* no origin */ }
     if (expectedHost && !hostMatches(originUrl, expectedHost)) return;
-    const tag = tagFromRepoName(originUrl ? repoNameFromRemote(originUrl) : null, ctx.tenant);
-    dropCachedCredential(credentialCachePath(ctx.tenant, tag, env));
+    // Mirror `get`'s tenant resolution (remote-derived, falling back to the config
+    // file) so `erase` drops the SAME cache key `get` wrote, not a stale sibling.
+    const repoName = originUrl ? repoNameFromRemote(originUrl) : null;
+    const tenant = repoName || ctx.tenant;
+    const tag = tagFromRepoName(repoName, tenant);
+    dropCachedCredential(credentialCachePath(tenant, tag, env));
   } catch {
     /* erase is advisory — never fail git over it */
   }