@tokenoftrust/cli 2.2.8 → 2.2.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.2.8",
+  "version": "2.2.10",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/dev.mjs

@@ -760,65 +760,127 @@ export function pinnedPublicCacheDir(cacheRoot, version) {
 }
 
 /**
- * List the installed package dirs that could carry a platform-native binary,
- * normalised so a scoped package reads as `@scope+name` (mirroring pnpm's virtual
- * store naming) regardless of the on-disk layout. Prefers the pnpm virtual store
- * (`node_modules/.pnpm/*`); falls back to a shallow `node_modules` scan (one level
- * into `@scope/`) for an npm/flat install. Best-effort — returns [] on any error.
+ * List the installed packages that could carry a platform-native binary, as
+ * `{ key, pkgJson }`: `key` is normalised so a scoped package reads as
+ * `@scope+name` (pnpm's virtual-store naming) regardless of the on-disk layout,
+ * and `pkgJson` is where that package's own manifest lives. Prefers the pnpm
+ * virtual store (`node_modules/.pnpm/<name>@<ver>/node_modules/<name>`); falls back
+ * to a shallow `node_modules` scan (one level into `@scope/`) for an npm/flat
+ * install. Best-effort — returns [] on any error.
  */
 function collectNativePackageDirs(runnerDir) {
-  const pnpmDir = join(runnerDir, "node_modules", ".pnpm");
-  if (existsSync(pnpmDir)) return readdirSync(pnpmDir);
   const nm = join(runnerDir, "node_modules");
+  const pnpmDir = join(nm, ".pnpm");
+  if (existsSync(pnpmDir)) {
+    return readdirSync(pnpmDir).map((entry) => {
+      const m = /^(@[^+]+)\+([^@]+)@/.exec(entry) || /^([^@]+)@/.exec(entry);
+      const pkgName = !m ? null : m[2] !== undefined ? `${m[1]}/${m[2]}` : m[1];
+      return {
+        key: entry,
+        pkgJson: pkgName ? join(pnpmDir, entry, "node_modules", pkgName, "package.json") : null,
+      };
+    });
+  }
   if (!existsSync(nm)) return [];
-  const names = [];
+  const out = [];
   for (const e of readdirSync(nm, { withFileTypes: true })) {
     if (e.name.startsWith("@") && e.isDirectory()) {
-      for (const s of readdirSync(join(nm, e.name))) names.push(`${e.name}+${s}`);
+      for (const s of readdirSync(join(nm, e.name))) {
+        out.push({ key: `${e.name}+${s}`, pkgJson: join(nm, e.name, s, "package.json") });
+      }
     } else {
-      names.push(e.name);
+      out.push({ key: e.name, pkgJson: join(nm, e.name, "package.json") });
     }
   }
-  return names;
+  return out;
 }
 
 /**
- * True unless the installed renderer is POISONED for this host's CPU arch — the
- * "the dev server didn't come up" root cause. Platform-native binding packages
- * are named `<family>-<os>-<cpu>[-<abi>]` (e.g. `@esbuild/darwin-arm64`,
- * `lightningcss-linux-x64-gnu`, `@rollup/rollup-win32-x64-msvc`). npm's optional-
- * deps bug (npm/cli#4828) can materialise a DIFFERENT arch's variant than the host
- * needs (e.g. darwin-x64 on an arm64 Mac) — pnpm gets it right. We flag the tree
- * as poisoned exactly when a family ships a binding for our OS but NOT our OS+CPU,
- * which is the precise shape of the `Cannot find native binding` boot crash. A
- * family with no variant for our OS at all is a cross-platform optional dep that's
- * correctly absent, so it never trips the check. Never throws; on any probe error
- * it returns true (trust the cache) so a health probe can't itself break `tot dev`.
+ * The `<os>-<cpu>` targets a package's own manifest declares through its `os` and
+ * `cpu` fields — the authority npm and pnpm themselves install by. Null when the
+ * manifest is unreadable or declares no positive os AND cpu (negations such as
+ * `"!win32"` exclude rather than name a target).
+ */
+function declaredNativeTargets(pkgJsonPath) {
+  if (!pkgJsonPath) return null;
+  try {
+    const j = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
+    const positive = (v) =>
+      (Array.isArray(v) ? v : typeof v === "string" ? [v] : []).filter(
+        (x) => typeof x === "string" && x && !x.startsWith("!"),
+      );
+    const os = positive(j.os);
+    const cpu = positive(j.cpu);
+    if (!os.length || !cpu.length) return null;
+    return os.flatMap((o) => cpu.map((c) => `${o}-${c}`));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Package-name spellings of an OS / CPU that differ from Node's `process.platform`
+ * / `process.arch`. `@cloudflare/workerd-linux-64` is linux-x64; reading the name
+ * token literally makes every x64 host look like it is missing workerd.
+ */
+const NATIVE_OS_ALIASES = { windows: "win32" };
+const NATIVE_CPU_ALIASES = { 64: "x64", amd64: "x64", x86_64: "x64", aarch64: "arm64", 32: "ia32", x86: "ia32", i386: "ia32" };
+
+/**
+ * Every native-binding family that ships a variant for this host's OS but not for
+ * its OS+CPU — the exact shape of astro's `Cannot find native binding` boot crash.
+ * Platform-native packages are named `<family>-<os>-<cpu>[-<abi>]` (e.g.
+ * `@esbuild/darwin-arm64`, `lightningcss-linux-x64-gnu`, `@cloudflare/workerd-linux-64`);
+ * the name only GROUPS a package into its family. Which target a package is for
+ * comes from its manifest's `os`/`cpu` fields, falling back to the name tokens
+ * (aliases normalised) only when the manifest is unreadable. npm's optional-deps bug
+ * (npm/cli#4828) can materialise a DIFFERENT arch's variant than the host needs
+ * (e.g. darwin-x64 on an arm64 Mac). A family with no variant for our OS at all is
+ * a cross-platform optional dep that's correctly absent, so it never counts.
  *
- * `platform`/`arch` are injectable so this is testable off the host's real arch.
+ * @returns {{ family: string, want: string, found: string[] }[]} — `family` in
+ *   npm spelling (`@scope/name`), `found` the targets installed for our OS.
+ *   [] on any probe error, so a health probe can't itself break `tot dev`.
  */
-export function rendererCacheHealthy(runnerDir, { platform = process.platform, arch = process.arch } = {}) {
+export function rendererNativeBindingGaps(runnerDir, { platform = process.platform, arch = process.arch } = {}) {
   try {
-    const re = /^(.*?)[-+](darwin|linux|win32|freebsd|android|openharmony)-([a-z0-9]+)/;
+    const re = /^(.*?)[-+](darwin|linux|win32|windows|freebsd|android|openharmony)-([a-z0-9_]+)/;
     const families = new Map(); // family -> Set("<os>-<cpu>")
-    for (const name of collectNativePackageDirs(runnerDir)) {
-      const m = name.match(re);
+    for (const { key, pkgJson } of collectNativePackageDirs(runnerDir)) {
+      const m = key.match(re);
       if (!m) continue;
       const [, family, os, cpu] = m;
+      const targets = declaredNativeTargets(pkgJson) || [
+        `${NATIVE_OS_ALIASES[os] || os}-${NATIVE_CPU_ALIASES[cpu] || cpu}`,
+      ];
       if (!families.has(family)) families.set(family, new Set());
-      families.get(family).add(`${os}-${cpu}`);
+      for (const t of targets) families.get(family).add(t);
     }
     const want = `${platform}-${arch}`;
-    for (const variants of families.values()) {
-      const hasOurOs = [...variants].some((v) => v.startsWith(`${platform}-`));
-      if (hasOurOs && !variants.has(want)) return false; // wrong-arch binary present, ours missing
+    const gaps = [];
+    for (const [family, variants] of families) {
+      const ours = [...variants].filter((v) => v.startsWith(`${platform}-`));
+      if (ours.length && !variants.has(want)) {
+        gaps.push({ family: family.replace(/^(@[^+]+)\+/, "$1/"), want, found: ours.sort() });
+      }
     }
-    return true;
+    return gaps;
   } catch {
-    return true;
+    return [];
   }
 }
 
+/**
+ * True unless the installed renderer is POISONED for this host's CPU arch — the
+ * "the dev server didn't come up" root cause (see rendererNativeBindingGaps).
+ * Never throws; on any probe error it returns true (trust the cache).
+ *
+ * `platform`/`arch` are injectable so this is testable off the host's real arch.
+ */
+export function rendererCacheHealthy(runnerDir, opts = {}) {
+  return rendererNativeBindingGaps(runnerDir, opts).length === 0;
+}
+
 /**
  * True unless the installed runner package is missing source the Astro config
  * chain needs to even boot — the "renderer resolves but `tot dev` can't load
@@ -1217,8 +1279,9 @@ export async function installRunnerTarball(
       const installSpin = startProgress("installing the store preview engine…", {
         stages: [{ afterMs: 20000, text: "still setting up the preview engine (first run only)…" }],
       });
+      let installer;
       try {
-        await runPnpmInstall(stagingDir, { logPath: installLog });
+        installer = await runPnpmInstall(stagingDir, { logPath: installLog });
       } finally {
         installSpin.stop();
       }
@@ -1234,12 +1297,20 @@ export async function installRunnerTarball(
       // rather than swallow it as "the dev server didn't come up". Permanent: the
       // same installer on the same host would just produce the same result, so the
       // auto-retry is skipped.
-      if (!rendererCacheHealthy(runnerDir)) {
+      const gaps = rendererNativeBindingGaps(runnerDir);
+      if (gaps.length) {
         await emitObstacle("renderer-native-bindings-missing");
         const err = new CliError(
-          `the store preview engine installed but is missing its native components for ${process.platform}-${process.arch}`,
+          `the store preview engine installed but is missing its native components for ${process.platform}-${process.arch}` +
+            ` (${gaps.map((g) => `${g.family}: only ${g.found.join(", ")} installed`).join("; ")})` +
+            `\n     details: ${installLog}`,
           {
-            next: "install pnpm (`npm i -g pnpm`, or `corepack enable`) and re-run `tot start` — pnpm installs the platform-native bits npm can skip (npm/cli#4828)",
+            // Only npm (the last-resort launcher) has the optional-deps bug that
+            // installing pnpm cures; a pnpm-installed gap is not the developer's to fix.
+            next:
+              installer === "npm"
+                ? "install pnpm (`npm i -g pnpm`, or `corepack enable`) and re-run `tot start` — pnpm installs the platform-native bits npm can skip (npm/cli#4828)"
+                : `re-run \`tot start --reset-cache\`; if it repeats, file feedback naming preview engine ${version} and the packages above — this is not something on your machine`,
             exitCode: 2,
           },
         );
@@ -1495,6 +1566,7 @@ function spawnAsyncResult(cmd, args, opts = {}) {
 /**
  * @param {string} runnerDir
  * @param {{ logPath?: string, spawnFn?: (cmd: string, args: string[], opts?: any) => any }} [opts]
+ * @returns {Promise<string>} the launcher that completed the install ("pnpm" | "corepack" | "npm").
  */
 export async function runPnpmInstall(runnerDir, { logPath, spawnFn = spawnAsyncResult } = {}) {
   const fd = logPath ? openSync(logPath, "a") : null;
@@ -1532,7 +1604,7 @@ export async function runPnpmInstall(runnerDir, { logPath, spawnFn = spawnAsyncR
         // Send both streams to the log fd (or swallow them) — never inherit.
         stdio: ["ignore", fd ?? "ignore", fd ?? "ignore"],
       });
-      if (r.status === 0) return; // installed
+      if (r.status === 0) return cmd; // installed — the launcher that did it
       if (/** @type {any} */ (r.error)?.code === "ENOENT") {
         // This launcher isn't on the machine — record it and try the next one.
         if (fd !== null) writeSync(fd, `[tot] ${cmd} not found (ENOENT) — trying the next launcher\n`);

package/src/commands/git-credential.mjs

@@ -55,7 +55,7 @@ import { repoNameFromRemote, tagFromRepoName } from "./submit.mjs";
 import { CliError, formatError } from "../errors.mjs";
 import {
   parseCredentialInput, formatCredentialOutput, splitAuthedRemote,
-  credentialCachePath, readCachedCredential, writeCachedCredential,
+  readCachedCredential, writeCachedCredential,
   kitCredentialCachePath, dropCachedCredential, readCheckoutKind, READ_ONLY_KIT_KIND,
 } from "../git-credential.mjs";
 
@@ -180,10 +180,21 @@ export async function mintOrCacheCredential({
   const tenant = repoName || ctx.tenant;
   const tag = tagFromRepoName(repoName, tenant);
 
-  const cachePath = credentialCachePath(tenant, tag, env);
-  const cached = readCachedCredential(cachePath);
-  if (cached) return { username: cached.username, password: cached.password };
-
+  // NEVER cache this credential (fb-1790975400361-eg8wxt). The push credential's mint
+  // (tot-mcp's checkoutRepo -> mintUserToken) ROTATES: it revokes EVERY prior token for
+  // this (developer, tenant) Gitea user on each call -- by design, so a leaked push
+  // credential stops working the moment a fresh one is issued (gitea-rest.ts:1559-1569).
+  // A local cache keyed only by (tenant, tag) -- not by checkout directory -- has no way
+  // to learn that ANOTHER checkout, another machine, or even a retry just rotated the
+  // token it is holding: it only knows its own TTL, so it keeps serving a credential
+  // Gitea already revoked until that TTL expires. That produced exactly the reported
+  // symptom -- a brand-new clone's first fetch fails "Failed to authenticate user" until
+  // the cache is cleared, because an earlier clone's mint had already rotated this one
+  // out from under it. The read-only kit-credential path avoids this by minting with
+  // `rotate: false` (gitea-rest.ts:571, "would yank a concurrent fetch's token") -- that
+  // option isn't available here without weakening the push credential's own leak-safety
+  // property, so the fix is on this side: mint fresh every time instead of trusting a
+  // local TTL the server can invalidate out of band.
   const baseUrl = env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
   const client = createClient(baseUrl);
   try {
@@ -195,9 +206,7 @@ export async function mintOrCacheCredential({
     const res = await checkout(client, { tenant, tag, cloneDir: null });
     const cred = splitAuthedRemote(res.gitRemote || "");
     if (!cred) return null;
-    const fresh = { username: cred.username, password: cred.token };
-    writeCachedCredential(cachePath, fresh);
-    return fresh;
+    return { username: cred.username, password: cred.token };
   } catch (e) {
     // Same distinction as the kit-checkout catch above: `checkoutTenant` renders a
     // CliError when the MCP (or this checkout's own state) has an authoritative answer
@@ -227,34 +236,19 @@ export function kitCheckout(cwd) {
 }
 
 /**
- * git reported the credential rejected (`erase`): drop this checkout's cached credential so
- * the next `get` mints a fresh one instead of replaying the rejected token. Scoped to the
+ * git reported a credential rejected (`erase`). Only the read-only kit credential is ever
+ * cached (see `mintOrCacheCredential` — the tenant push credential is never cached, because
+ * its mint rotates server-side out from under any local TTL), so this only has work to do
+ * for a kit checkout; a tenant checkout's `erase` is a correct no-op. Scoped to the
  * checkout's own origin host, like `get`. Never throws.
  * @param {{ env?: NodeJS.ProcessEnv, cwd?: string, expectedHost?: string|null }} [opts]
  */
 export function forgetCredential({ env = process.env, cwd = process.cwd(), expectedHost = null } = {}) {
   try {
     const kit = kitCheckout(cwd);
-    if (kit) {
-      if (expectedHost && !hostMatches(kit.originUrl, expectedHost)) return;
-      dropCachedCredential(kitCredentialCachePath(kit.target, env));
-      return;
-    }
-    const ctx = detectContext(cwd);
-    if (ctx.mode !== "checkout" || !ctx.tenant || !ctx.workspacePath) return;
-    let originUrl = null;
-    try {
-      originUrl = execFileSync("git", ["-C", ctx.workspacePath, "remote", "get-url", "origin"], {
-        stdio: ["ignore", "pipe", "pipe"],
-      }).toString().trim();
-    } catch { /* no origin */ }
-    if (expectedHost && !hostMatches(originUrl, expectedHost)) return;
-    // Mirror `get`'s tenant resolution (remote-derived, falling back to the config
-    // file) so `erase` drops the SAME cache key `get` wrote, not a stale sibling.
-    const repoName = originUrl ? repoNameFromRemote(originUrl) : null;
-    const tenant = repoName || ctx.tenant;
-    const tag = tagFromRepoName(repoName, tenant);
-    dropCachedCredential(credentialCachePath(tenant, tag, env));
+    if (!kit) return;
+    if (expectedHost && !hostMatches(kit.originUrl, expectedHost)) return;
+    dropCachedCredential(kitCredentialCachePath(kit.target, env));
   } catch {
     /* erase is advisory — never fail git over it */
   }