@tokenoftrust/cli 2.2.7 → 2.2.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.2.7",
+  "version": "2.2.9",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/git-credential.mjs

@@ -55,7 +55,7 @@ import { repoNameFromRemote, tagFromRepoName } from "./submit.mjs";
 import { CliError, formatError } from "../errors.mjs";
 import {
   parseCredentialInput, formatCredentialOutput, splitAuthedRemote,
-  credentialCachePath, readCachedCredential, writeCachedCredential,
+  readCachedCredential, writeCachedCredential,
   kitCredentialCachePath, dropCachedCredential, readCheckoutKind, READ_ONLY_KIT_KIND,
 } from "../git-credential.mjs";
 
@@ -165,12 +165,36 @@ export async function mintOrCacheCredential({
     /* fall through — tagFromRepoName degrades to "main" on a null repo name */
   }
   if (expectedHost && !hostMatches(originUrl, expectedHost)) return null;
-  const tag = tagFromRepoName(repoName, ctx.tenant);
 
-  const cachePath = credentialCachePath(ctx.tenant, tag, env);
-  const cached = readCachedCredential(cachePath);
-  if (cached) return { username: cached.username, password: cached.password };
+  // Prefer the tenant encoded in the git remote itself over `.tot/config.json`'s
+  // "tenant" field. The remote URL is the forge's OWN record of this checkout's repo
+  // (set once by `tenant_checkout`'s returned cloneUrl at clone time); the config file
+  // is tenant-owned, committed content a developer's own commit can set wrong at seed
+  // time or drift later — exactly what broke every client_switch/tenant_checkout call
+  // in fb-1790958790645-7j8gul / fb-1790969588649-zl3xa7. Every real tenant is
+  // provisioned with repo === owner (storefront's provisioning enforces this at every
+  // call site — buildStaffStoreIdentity, scripts/tenant/provision-gitea-repo.mjs), so
+  // the repo name IS the tenant id. Fall back to the config file only when the remote
+  // can't be read or parsed (no origin yet) — this never makes the mint MORE likely to
+  // fail than before, only less dependent on content the forge itself didn't set.
+  const tenant = repoName || ctx.tenant;
+  const tag = tagFromRepoName(repoName, tenant);
 
+  // NEVER cache this credential (fb-1790975400361-eg8wxt). The push credential's mint
+  // (tot-mcp's checkoutRepo -> mintUserToken) ROTATES: it revokes EVERY prior token for
+  // this (developer, tenant) Gitea user on each call -- by design, so a leaked push
+  // credential stops working the moment a fresh one is issued (gitea-rest.ts:1559-1569).
+  // A local cache keyed only by (tenant, tag) -- not by checkout directory -- has no way
+  // to learn that ANOTHER checkout, another machine, or even a retry just rotated the
+  // token it is holding: it only knows its own TTL, so it keeps serving a credential
+  // Gitea already revoked until that TTL expires. That produced exactly the reported
+  // symptom -- a brand-new clone's first fetch fails "Failed to authenticate user" until
+  // the cache is cleared, because an earlier clone's mint had already rotated this one
+  // out from under it. The read-only kit-credential path avoids this by minting with
+  // `rotate: false` (gitea-rest.ts:571, "would yank a concurrent fetch's token") -- that
+  // option isn't available here without weakening the push credential's own leak-safety
+  // property, so the fix is on this side: mint fresh every time instead of trusting a
+  // local TTL the server can invalidate out of band.
   const baseUrl = env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
   const client = createClient(baseUrl);
   try {
@@ -179,12 +203,10 @@ export async function mintOrCacheCredential({
     return null; // not signed in (or session unrefreshable) — nothing this helper can do
   }
   try {
-    const res = await checkout(client, { tenant: ctx.tenant, tag, cloneDir: null });
+    const res = await checkout(client, { tenant, tag, cloneDir: null });
     const cred = splitAuthedRemote(res.gitRemote || "");
     if (!cred) return null;
-    const fresh = { username: cred.username, password: cred.token };
-    writeCachedCredential(cachePath, fresh);
-    return fresh;
+    return { username: cred.username, password: cred.token };
   } catch (e) {
     // Same distinction as the kit-checkout catch above: `checkoutTenant` renders a
     // CliError when the MCP (or this checkout's own state) has an authoritative answer
@@ -214,30 +236,19 @@ export function kitCheckout(cwd) {
 }
 
 /**
- * git reported the credential rejected (`erase`): drop this checkout's cached credential so
- * the next `get` mints a fresh one instead of replaying the rejected token. Scoped to the
+ * git reported a credential rejected (`erase`). Only the read-only kit credential is ever
+ * cached (see `mintOrCacheCredential` — the tenant push credential is never cached, because
+ * its mint rotates server-side out from under any local TTL), so this only has work to do
+ * for a kit checkout; a tenant checkout's `erase` is a correct no-op. Scoped to the
  * checkout's own origin host, like `get`. Never throws.
  * @param {{ env?: NodeJS.ProcessEnv, cwd?: string, expectedHost?: string|null }} [opts]
  */
 export function forgetCredential({ env = process.env, cwd = process.cwd(), expectedHost = null } = {}) {
   try {
     const kit = kitCheckout(cwd);
-    if (kit) {
-      if (expectedHost && !hostMatches(kit.originUrl, expectedHost)) return;
-      dropCachedCredential(kitCredentialCachePath(kit.target, env));
-      return;
-    }
-    const ctx = detectContext(cwd);
-    if (ctx.mode !== "checkout" || !ctx.tenant || !ctx.workspacePath) return;
-    let originUrl = null;
-    try {
-      originUrl = execFileSync("git", ["-C", ctx.workspacePath, "remote", "get-url", "origin"], {
-        stdio: ["ignore", "pipe", "pipe"],
-      }).toString().trim();
-    } catch { /* no origin */ }
-    if (expectedHost && !hostMatches(originUrl, expectedHost)) return;
-    const tag = tagFromRepoName(originUrl ? repoNameFromRemote(originUrl) : null, ctx.tenant);
-    dropCachedCredential(credentialCachePath(ctx.tenant, tag, env));
+    if (!kit) return;
+    if (expectedHost && !hostMatches(kit.originUrl, expectedHost)) return;
+    dropCachedCredential(kitCredentialCachePath(kit.target, env));
   } catch {
     /* erase is advisory — never fail git over it */
   }