@tokenoftrust/cli 3.10.0 → 3.10.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "3.10.0",
+  "version": "3.10.2",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/hotfix.mjs

@@ -39,7 +39,7 @@ import { openBrowser } from "../open.mjs";
 import { missingGrantsOf, refusalHint } from "../admission-hint.mjs";
 // Reuse `tot ship`'s operator-secret precedence + live-url derivation verbatim so
 // ship + hotfix speak ONE operator-auth contract.
-import { resolveOperatorSecret, liveUrlFor } from "./ship.mjs";
+import { resolveOperatorSecret, liveUrlFor, normalizeLiveDrift } from "./ship.mjs";
 
 const DEFAULT_STOREFRONT_URL = "https://storefront.tokenoftrust.store";
 
@@ -126,6 +126,7 @@ export function normalizeHotfixPlan(data) {
       bypassedPreviewSha: typeof o.bypassedPreviewSha === "string" ? o.bypassedPreviewSha : null,
       bypassedPrs: Array.isArray(o.bypassedPrs) ? o.bypassedPrs : [],
       rollbackTarget: o.rollbackTarget && typeof o.rollbackTarget === "object" ? o.rollbackTarget : null,
+      warning: normalizeLiveDrift(o.warning),
       paywall:
         o.paywall && typeof o.paywall === "object"
           ? { allowed: o.paywall.allowed === true, message: typeof o.paywall.message === "string" ? o.paywall.message : null }
@@ -157,6 +158,7 @@ export function normalizeHotfixResult(data) {
     artifactDigest: typeof o.artifactDigest === "string" ? o.artifactDigest : null,
     receiptId: typeof o.receiptId === "string" ? o.receiptId : null,
     rollbackTarget: o.rollbackTarget && typeof o.rollbackTarget === "object" ? o.rollbackTarget : null,
+    retriable: o.retriable === false ? false : o.retriable === true ? true : null,
     forwardIntegration: fwd
       ? {
           ok: fwd.ok === true,
@@ -284,6 +286,7 @@ export async function runHotfix(
     bypassedPrs: plan.bypassedPrs,
     bypassedPreviewSha: plan.bypassedPreviewSha,
     rollbackTarget: plan.rollbackTarget,
+    liveDrift: plan.warning,
     paywall: plan.paywall,
     targets: { live: liveUrl },
   });
@@ -371,10 +374,15 @@ export function reportHotfixResult(result, { tenant, liveUrl, noOpen, openUrl })
     result.state === "promote_failed" ||
     result.state === "record_failed"
   ) {
+    // Same rule as ship: a compare-and-set refusal, or any outcome that says a retry cannot
+    // change it, must not be offered as safe to retry.
+    const deterministic = result.retriable === false || result.reason === "live_moved";
     console.error(
       fail(
         result.message || `hotfix ${result.state.replace("_", " ")}`,
-        "re-run `tot hotfix` — the release is idempotent and safe to retry",
+        deterministic
+          ? "do not re-run `tot hotfix` — this refusal is deterministic and will not change"
+          : "re-run `tot hotfix` — the release is idempotent and safe to retry",
       ),
     );
     return 1;

package/src/commands/ship.mjs

@@ -245,8 +245,8 @@ export function liveUrlFor(tenant) {
  *   paywall:{allowed:boolean,message:string|null}, alreadyShipped:boolean} |
  *   {ok:false, reason:string, message:string}}
  */
-/** The ship-plan CDN drift warning, or null when the ledger and the CDN name the same release. */
-function normalizeLiveDrift(warning) {
+/** The plan CDN drift warning, or null when the ledger and the CDN name the same release. */
+export function normalizeLiveDrift(warning) {
   if (!warning || typeof warning !== "object" || typeof warning.reason !== "string") return null;
   const target = warning.correctedRollbackTarget;
   if (!target || typeof target !== "object" || typeof target.aggregateSha !== "string") return null;
@@ -734,11 +734,12 @@ function reportShipResult(result, { tenant, liveUrl, noOpen, openUrl }) {
     return 1;
   }
   if (result.state === "publishing") {
-    // Dispatched is not written. Say the pointer moved only once this result says it was.
+    // pointerWritten false means the job step has not confirmed a write. For s3-overwrite, CI can
+    // write the pointer during awaiting-external, before prove, so do not say the pointer is absent.
     console.log(
       result.pointerWritten
         ? `\n  ⏳ ${tenant} is publishing — the live pointer moved, CDN delivery is still confirming.`
-        : `\n  ⏳ ${tenant} is publishing — dispatched; the live pointer is not written yet.`,
+        : `\n  ⏳ ${tenant} is publishing — dispatched; the live pointer is not confirmed written.`,
     );
     if (result.pinnedSha) console.log(`  pinned:  ${result.pinnedSha}`);
     if (result.receiptId) console.log(`  receipt: ${result.receiptId}`);

package/src/plan.mjs

@@ -40,6 +40,20 @@ function targetLabel({ pr, changeId }) {
   return "this change";
 }
 
+/** Empty when the CDN and the ledger name the same release. */
+function cdnDriftLines(liveDrift) {
+  if (!liveDrift?.reason) return [];
+  return [
+    `  ⚠ ${liveDrift.reason}: the CDN serves ${liveDrift.served ?? "an unknown revision"}, not the ledger's live ${liveDrift.live ?? "nothing"}.`,
+  ];
+}
+
+function rollbackToLine(rollbackTarget, liveDrift) {
+  return rollbackTarget
+    ? `  rollback to: ${rollbackTarget.aggregateSha} (receipt ${rollbackTarget.receiptId})${liveDrift?.reason ? " — corrected target" : ""}`
+    : "  rollback to: (none — first-ever ship)";
+}
+
 /**
  * Build the EXACT plan for a mutating operator verb — structured lines ready
  * to print verbatim (CLI) or join for a confirm() dialog (admin). Pure: no
@@ -137,16 +151,8 @@ export function planForAction({
           lines.push(`    - ${prLabel}${shortSha}`);
         }
       }
-      if (liveDrift?.reason) {
-        lines.push(
-          `  ⚠ ${liveDrift.reason}: the CDN serves ${liveDrift.served ?? "an unknown revision"}, not the ledger's live ${liveDrift.live ?? "nothing"}.`,
-        );
-      }
-      lines.push(
-        rollbackTarget
-          ? `  rollback to: ${rollbackTarget.aggregateSha} (receipt ${rollbackTarget.receiptId})${liveDrift?.reason ? " — corrected target" : ""}`
-          : "  rollback to: (none — first-ever ship)",
-      );
+      lines.push(...cdnDriftLines(liveDrift));
+      lines.push(rollbackToLine(rollbackTarget, liveDrift));
       if (paywall && paywall.allowed === false) {
         lines.push(`  ⚠ paywall:   ${paywall.message || "go-live is blocked by the storefront subscription gate"}`);
       }
@@ -206,11 +212,8 @@ export function planForAction({
         }
       }
       if (bypassedPreviewSha) lines.push(`  preview head (bypassed): ${bypassedPreviewSha}`);
-      lines.push(
-        rollbackTarget
-          ? `  rollback to: ${rollbackTarget.aggregateSha} (receipt ${rollbackTarget.receiptId})`
-          : "  rollback to: (none — first-ever ship)",
-      );
+      lines.push(...cdnDriftLines(liveDrift));
+      lines.push(rollbackToLine(rollbackTarget, liveDrift));
       if (paywall && paywall.allowed === false) {
         lines.push(`  ⚠ paywall:   ${paywall.message || "go-live is blocked by the storefront subscription gate"}`);
       }

package/src/token-store.mjs

@@ -4,7 +4,7 @@
  * TOT_HOME selects a private home and TOT_PROFILE selects an independent identity.
  */
 import {
-  readFileSync, writeFileSync, mkdirSync, renameSync, chmodSync, existsSync, rmSync, linkSync, unlinkSync,
+  readFileSync, writeFileSync, mkdirSync, renameSync, chmodSync, existsSync, rmSync, linkSync, unlinkSync, statSync,
 } from "node:fs";
 import { homedir } from "node:os";
 import { createHash, randomUUID } from "node:crypto";
@@ -55,22 +55,45 @@ export function normalizeAuthority(value) {
 }
 
 /**
- * `git config --get` exit 1 means the key is unset. Exit 128 is "not a checkout"
- * only when stderr says so. Permission denied and a missing git binary are not
- * "no authority" — callers must not fall through to another session.
+ * `git config --get` exit 1 means the key is unset only when the config was readable.
+ * Exit 128 is "not a checkout" only when stderr says so. Permission denied, at any
+ * exit code, and a missing git binary are not "no authority".
  * @param {unknown} error
  */
 export function isAbsentGitConfig(error) {
+  const stderr = `${/** @type {{ stderr?: unknown }} */ (error)?.stderr ?? ""}\n${/** @type {{ message?: unknown }} */ (error)?.message ?? ""}`;
+  if (/Permission denied|unable to access/i.test(stderr)) return false;
   const status = error && typeof error === "object" ? /** @type {{ status?: number }} */ (error).status : undefined;
   if (status === 1) return true;
   if (status !== 128) return false;
-  const stderr = `${/** @type {{ stderr?: unknown, message?: unknown }} */ (error).stderr ?? ""}\n${/** @type {{ message?: unknown }} */ (error).message ?? ""}`;
-  if (/Permission denied|unable to access/i.test(stderr)) return false;
   return /not a git repository|can only be used inside a git repository/i.test(stderr);
 }
 
+/** A mode with no read bits is unreadable even when a privileged process can still open it. */
+function refuseUnreadableGitConfig(cwd) {
+  const config = join(cwd, ".git", "config");
+  let mode;
+  try {
+    mode = statSync(config).mode;
+  } catch (error) {
+    const code = error && typeof error === "object" ? /** @type {{ code?: string }} */ (error).code : undefined;
+    if (code === "ENOENT" || code === "ENOTDIR") return;
+    if (code === "EACCES") throw gitConfigDenied(config);
+    throw error;
+  }
+  if ((mode & 0o444) === 0) throw gitConfigDenied(config);
+}
+
+function gitConfigDenied(config) {
+  const denied = new Error(`unable to access '${config}': Permission denied`);
+  /** @type {Error & { status?: number, stderr?: string }} */ (denied).status = 128;
+  /** @type {Error & { stderr?: string }} */ (denied).stderr = denied.message;
+  return denied;
+}
+
 /** Local checkout provenance, never inferred from a shared forge hostname. */
 export function repositoryAuthority(cwd = process.cwd()) {
+  refuseUnreadableGitConfig(cwd);
   let value;
   try {
     value = execFileSync("git", ["-C", cwd, "config", "--local", "--get", MCP_AUTHORITY_KEY], {