@tokenoftrust/cli 2.2.8 → 2.2.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.2.8",
+  "version": "2.2.9",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/git-credential.mjs

@@ -55,7 +55,7 @@ import { repoNameFromRemote, tagFromRepoName } from "./submit.mjs";
 import { CliError, formatError } from "../errors.mjs";
 import {
   parseCredentialInput, formatCredentialOutput, splitAuthedRemote,
-  credentialCachePath, readCachedCredential, writeCachedCredential,
+  readCachedCredential, writeCachedCredential,
   kitCredentialCachePath, dropCachedCredential, readCheckoutKind, READ_ONLY_KIT_KIND,
 } from "../git-credential.mjs";
 
@@ -180,10 +180,21 @@ export async function mintOrCacheCredential({
   const tenant = repoName || ctx.tenant;
   const tag = tagFromRepoName(repoName, tenant);
 
-  const cachePath = credentialCachePath(tenant, tag, env);
-  const cached = readCachedCredential(cachePath);
-  if (cached) return { username: cached.username, password: cached.password };
-
+  // NEVER cache this credential (fb-1790975400361-eg8wxt). The push credential's mint
+  // (tot-mcp's checkoutRepo -> mintUserToken) ROTATES: it revokes EVERY prior token for
+  // this (developer, tenant) Gitea user on each call -- by design, so a leaked push
+  // credential stops working the moment a fresh one is issued (gitea-rest.ts:1559-1569).
+  // A local cache keyed only by (tenant, tag) -- not by checkout directory -- has no way
+  // to learn that ANOTHER checkout, another machine, or even a retry just rotated the
+  // token it is holding: it only knows its own TTL, so it keeps serving a credential
+  // Gitea already revoked until that TTL expires. That produced exactly the reported
+  // symptom -- a brand-new clone's first fetch fails "Failed to authenticate user" until
+  // the cache is cleared, because an earlier clone's mint had already rotated this one
+  // out from under it. The read-only kit-credential path avoids this by minting with
+  // `rotate: false` (gitea-rest.ts:571, "would yank a concurrent fetch's token") -- that
+  // option isn't available here without weakening the push credential's own leak-safety
+  // property, so the fix is on this side: mint fresh every time instead of trusting a
+  // local TTL the server can invalidate out of band.
   const baseUrl = env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
   const client = createClient(baseUrl);
   try {
@@ -195,9 +206,7 @@ export async function mintOrCacheCredential({
     const res = await checkout(client, { tenant, tag, cloneDir: null });
     const cred = splitAuthedRemote(res.gitRemote || "");
     if (!cred) return null;
-    const fresh = { username: cred.username, password: cred.token };
-    writeCachedCredential(cachePath, fresh);
-    return fresh;
+    return { username: cred.username, password: cred.token };
   } catch (e) {
     // Same distinction as the kit-checkout catch above: `checkoutTenant` renders a
     // CliError when the MCP (or this checkout's own state) has an authoritative answer
@@ -227,34 +236,19 @@ export function kitCheckout(cwd) {
 }
 
 /**
- * git reported the credential rejected (`erase`): drop this checkout's cached credential so
- * the next `get` mints a fresh one instead of replaying the rejected token. Scoped to the
+ * git reported a credential rejected (`erase`). Only the read-only kit credential is ever
+ * cached (see `mintOrCacheCredential` — the tenant push credential is never cached, because
+ * its mint rotates server-side out from under any local TTL), so this only has work to do
+ * for a kit checkout; a tenant checkout's `erase` is a correct no-op. Scoped to the
  * checkout's own origin host, like `get`. Never throws.
  * @param {{ env?: NodeJS.ProcessEnv, cwd?: string, expectedHost?: string|null }} [opts]
  */
 export function forgetCredential({ env = process.env, cwd = process.cwd(), expectedHost = null } = {}) {
   try {
     const kit = kitCheckout(cwd);
-    if (kit) {
-      if (expectedHost && !hostMatches(kit.originUrl, expectedHost)) return;
-      dropCachedCredential(kitCredentialCachePath(kit.target, env));
-      return;
-    }
-    const ctx = detectContext(cwd);
-    if (ctx.mode !== "checkout" || !ctx.tenant || !ctx.workspacePath) return;
-    let originUrl = null;
-    try {
-      originUrl = execFileSync("git", ["-C", ctx.workspacePath, "remote", "get-url", "origin"], {
-        stdio: ["ignore", "pipe", "pipe"],
-      }).toString().trim();
-    } catch { /* no origin */ }
-    if (expectedHost && !hostMatches(originUrl, expectedHost)) return;
-    // Mirror `get`'s tenant resolution (remote-derived, falling back to the config
-    // file) so `erase` drops the SAME cache key `get` wrote, not a stale sibling.
-    const repoName = originUrl ? repoNameFromRemote(originUrl) : null;
-    const tenant = repoName || ctx.tenant;
-    const tag = tagFromRepoName(repoName, tenant);
-    dropCachedCredential(credentialCachePath(tenant, tag, env));
+    if (!kit) return;
+    if (expectedHost && !hostMatches(kit.originUrl, expectedHost)) return;
+    dropCachedCredential(kitCredentialCachePath(kit.target, env));
   } catch {
     /* erase is advisory — never fail git over it */
   }