@tokenoftrust/cli 3.10.1 → 3.10.3

package/bin/tot.mjs

@@ -29,10 +29,6 @@ import {
   recordDiagnostic,
   resetInvocationDiagnostics,
 } from "../src/diagnostics.mjs";
-import {
-  nativeWindowsRefuseMessage,
-  shouldRefuseNativeWindows,
-} from "../src/platform.mjs";
 
 const BUILD_ORDER = ["clone", "validate", "dev", "preview"];
 
@@ -120,14 +116,6 @@ async function dispatch(cmd, rest, ctx) {
     return cmd ? 0 : 2;
   }
 
-  // Native Windows: refuse before login/--device/start burn cycles on a host the
-  // local loop cannot run on. doctor/feedback/ideas stay available so the gate
-  // itself is discoverable. WSL reports as linux and passes through.
-  if (shouldRefuseNativeWindows(cmd)) {
-    process.stderr.write(nativeWindowsRefuseMessage(cmd));
-    return 2;
-  }
-
   // A mounted publication space's checkout (spaces/<id>/, recorded by `tot clone`) is its own
   // repository: the store-root verbs below would push it with the ROOT's credential or merge the
   // root's preview branch into it. Refuse them there, naming the space's own path.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "3.10.1",
+  "version": "3.10.3",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/dev.mjs

@@ -1567,7 +1567,7 @@ export function ensureCorepackPnpm(runnerDir, { logPath, spawnFn = spawnSync } =
     // WITHOUT the global shim (see runPnpmInstall's fallback). Capture both to the
     // log — a silent corepack failure was why the install error carried no cause.
     for (const args of [["enable"], ["prepare", pm, "--activate"]]) {
-      const r = spawnFn("corepack", args, { stdio: ["ignore", fd ?? "ignore", fd ?? "ignore"] });
+      const r = spawnFn("corepack", args, { stdio: ["ignore", fd ?? "ignore", fd ?? "ignore"], shell: launcherNeedsShell() });
       if (fd !== null && (r.error || r.status !== 0)) {
         const rerr = /** @type {any} */ (r.error);
         writeSync(fd, `[tot] corepack ${args.join(" ")} → ${rerr?.code || rerr?.message || `exit ${r.status}`}\n`);
@@ -1598,6 +1598,15 @@ export function ensureCorepackPnpm(runnerDir, { logPath, spawnFn = spawnSync } =
  * @param {string} cmd @param {string[]} args @param {object} opts
  * @returns {Promise<{ status: number|null, error: Error|null, signal?: string|null }>}
  */
+/**
+ * On Windows `pnpm`, `corepack` and `npm` are `.cmd` shims, which Node refuses to
+ * spawn without a shell (and a bare name ENOENTs). Their args here are fixed
+ * literals, so the shell sees no user input.
+ */
+export function launcherNeedsShell(platform = process.platform) {
+  return platform === "win32";
+}
+
 function spawnAsyncResult(cmd, args, opts = {}) {
   return new Promise((resolvePromise) => {
     let settled = false;
@@ -1654,9 +1663,11 @@ export async function runPnpmInstall(runnerDir, { logPath, spawnFn = spawnAsyncR
         cwd: runnerDir,
         // Send both streams to the log fd (or swallow them) — never inherit.
         stdio: ["ignore", fd ?? "ignore", fd ?? "ignore"],
+        shell: launcherNeedsShell(),
       });
       if (r.status === 0) return cmd; // installed — the launcher that did it
-      if (/** @type {any} */ (r.error)?.code === "ENOENT") {
+      // Through cmd.exe a missing launcher is exit 9009 ("not recognized"), not ENOENT.
+      if (/** @type {any} */ (r.error)?.code === "ENOENT" || (launcherNeedsShell() && r.status === 9009)) {
         // This launcher isn't on the machine — record it and try the next one.
         if (fd !== null) writeSync(fd, `[tot] ${cmd} not found (ENOENT) — trying the next launcher\n`);
         continue;

package/src/commands/doctor.mjs

@@ -25,11 +25,7 @@ import { join } from "node:path";
 import { hasLegacyOperatorEnv, legacyOperatorEnvAdvisory } from "../auth.mjs";
 import { MIN_NODE, nodeMeetsFloor } from "../ensure-node.mjs";
 import { clientPackages, osLabel } from "../mcp.mjs";
-import {
-  isNativeWindows,
-  nativeWindowsDetail,
-  shouldAttemptDoctorAutoLogin,
-} from "../platform.mjs";
+import { isNativeWindows, nativeWindowsDetail } from "../platform.mjs";
 import { readSessionCredentials, isExpired } from "../token-store.mjs";
 import { dockerAvailable, tryStartDocker, RENDERER_CACHE_ROOT, rendererArtifactComplete } from "./dev.mjs";
 import { loginAndCache } from "./login.mjs";
@@ -71,15 +67,15 @@ export function collectChecks(_ctx, env = process.env) {
     blocking: true,
   });
 
-  // Native Windows isn't a supported host for the local loop (the runner install
-  // + tar extraction assume a POSIX toolchain) — WSL is, and reports as linux
-  // here. Say so up front instead of letting `tot login` / `tot dev` fail opaquely.
+  // Native Windows runs everything except the local renderer (`dev` / `start`: the
+  // runner install + tar extraction assume a POSIX toolchain) — WSL is the host for
+  // those, and reports as linux here. Informational, so the gap is visible up front.
   const nativeWindows = isNativeWindows();
   checks.push({
-    name: "supported platform",
-    pass: !nativeWindows,
+    name: "platform",
+    pass: true,
     detail: nativeWindows ? nativeWindowsDetail() : "macOS / Linux / WSL",
-    blocking: true,
+    blocking: false,
   });
 
   // Informational: the versions + OS this invocation is running on — the same
@@ -181,17 +177,13 @@ async function applyFixes(checks, env) {
 
   const auth = checks.find((c) => c.name === "auth identity");
   if (auth && !auth.pass) {
-    if (!shouldAttemptDoctorAutoLogin()) {
-      console.log(`  ~ not signed in — skipping auto-login (${nativeWindowsDetail()})`);
-    } else {
-      const mcpUrl = env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
-      console.log("  ~ not signed in — opening the browser to sign in…");
-      try {
-        await loginAndCache(mcpUrl, env, { log: (m) => console.log(`  ${m}`) });
-        console.log("  ✓ signed in");
-      } catch (e) {
-        console.log(`  ~ couldn't sign in automatically (${e?.message || e}) — run \`tot login\``);
-      }
+    const mcpUrl = env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
+    console.log("  ~ not signed in — opening the browser to sign in…");
+    try {
+      await loginAndCache(mcpUrl, env, { log: (m) => console.log(`  ${m}`) });
+      console.log("  ✓ signed in");
+    } catch (e) {
+      console.log(`  ~ couldn't sign in automatically (${e?.message || e}) — run \`tot login\``);
     }
   }
 }

package/src/commands/hotfix.mjs

@@ -39,7 +39,7 @@ import { openBrowser } from "../open.mjs";
 import { missingGrantsOf, refusalHint } from "../admission-hint.mjs";
 // Reuse `tot ship`'s operator-secret precedence + live-url derivation verbatim so
 // ship + hotfix speak ONE operator-auth contract.
-import { resolveOperatorSecret, liveUrlFor } from "./ship.mjs";
+import { resolveOperatorSecret, liveUrlFor, normalizeLiveDrift } from "./ship.mjs";
 
 const DEFAULT_STOREFRONT_URL = "https://storefront.tokenoftrust.store";
 
@@ -126,6 +126,7 @@ export function normalizeHotfixPlan(data) {
       bypassedPreviewSha: typeof o.bypassedPreviewSha === "string" ? o.bypassedPreviewSha : null,
       bypassedPrs: Array.isArray(o.bypassedPrs) ? o.bypassedPrs : [],
       rollbackTarget: o.rollbackTarget && typeof o.rollbackTarget === "object" ? o.rollbackTarget : null,
+      warning: normalizeLiveDrift(o.warning),
       paywall:
         o.paywall && typeof o.paywall === "object"
           ? { allowed: o.paywall.allowed === true, message: typeof o.paywall.message === "string" ? o.paywall.message : null }
@@ -285,6 +286,7 @@ export async function runHotfix(
     bypassedPrs: plan.bypassedPrs,
     bypassedPreviewSha: plan.bypassedPreviewSha,
     rollbackTarget: plan.rollbackTarget,
+    liveDrift: plan.warning,
     paywall: plan.paywall,
     targets: { live: liveUrl },
   });

package/src/commands/ship.mjs

@@ -245,8 +245,8 @@ export function liveUrlFor(tenant) {
  *   paywall:{allowed:boolean,message:string|null}, alreadyShipped:boolean} |
  *   {ok:false, reason:string, message:string}}
  */
-/** The ship-plan CDN drift warning, or null when the ledger and the CDN name the same release. */
-function normalizeLiveDrift(warning) {
+/** The plan CDN drift warning, or null when the ledger and the CDN name the same release. */
+export function normalizeLiveDrift(warning) {
   if (!warning || typeof warning !== "object" || typeof warning.reason !== "string") return null;
   const target = warning.correctedRollbackTarget;
   if (!target || typeof target !== "object" || typeof target.aggregateSha !== "string") return null;

package/src/git-credential.mjs

@@ -252,6 +252,13 @@ export function forgeShimPath(env = process.env) {
   return join(home, ".tot", "bin", "tot-git-credential");
 }
 
+/** The shim path as git's `!` helper runs it (through sh). Git for Windows' sh reads
+ *  forward slashes, not backslashes, and a home directory may contain spaces, so a
+ *  Windows path is slash-normalized and single-quoted. POSIX paths pass through. Pure. */
+export function helperCommandPath(shim, platform = process.platform) {
+  return platform === "win32" ? shq(shim.replace(/\\/g, "/")) : shim;
+}
+
 /** The shim's contents: pin the ABSOLUTE node + CLI entry active at write time, with a
  *  PATH-search fallback for node, and FAIL LOUD to stderr (never silently) when no node
  *  is found — so a broken helper says how to fix itself instead of yielding an opaque
@@ -324,7 +331,7 @@ export function installForgeCredentialHelper(git, {
 } = {}) {
   if (!host) return false;
   const shim = writeShim(env, nodePath, entryPath);
-  const helperValue = shim ? `!${shim}` : CREDENTIAL_HELPER;
+  const helperValue = shim ? `!${helperCommandPath(shim)}` : CREDENTIAL_HELPER;
   const key = `credential.https://${host}.helper`;
   let raw = null;
   try { raw = git(["config", "--local", "--get-all", key]); } catch { raw = null; }

package/src/open.mjs

@@ -58,6 +58,17 @@ export async function firstFreePort(preferred, maxTries = 64) {
   return preferred;
 }
 
+/**
+ * The OS opener as [command, args]. Windows goes through `rundll32` with no shell:
+ * `cmd /c start` would treat the `&` in an OAuth URL as a command separator.
+ * @param {string} url @param {string} platform @returns {[string, string[]]}
+ */
+export function openerCommand(url, platform) {
+  if (platform === "darwin") return ["open", [url]];
+  if (platform === "win32") return ["rundll32", ["url.dll,FileProtocolHandler", url]];
+  return ["xdg-open", [url]];
+}
+
 /**
  * Open `url` in the user's default browser. Best-effort and non-blocking: the
  * child is detached + unref'd so it never holds `tot` open, and any failure
@@ -65,21 +76,9 @@ export async function firstFreePort(preferred, maxTries = 64) {
  * @returns {boolean} whether we managed to launch an opener.
  */
 export function openBrowser(url, platform = process.platform) {
-  let cmd, args, shell = false;
-  if (platform === "darwin") {
-    cmd = "open";
-    args = [url];
-  } else if (platform === "win32") {
-    // `start` is a shell builtin; the empty first arg is the window title.
-    cmd = "start";
-    args = ["", url];
-    shell = true;
-  } else {
-    cmd = "xdg-open";
-    args = [url];
-  }
+  const [cmd, args] = openerCommand(url, platform);
   try {
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true, shell });
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
     child.on("error", () => {}); // swallow "opener not found" async errors
     child.unref();
     return true;

package/src/plan.mjs

@@ -40,6 +40,20 @@ function targetLabel({ pr, changeId }) {
   return "this change";
 }
 
+/** Empty when the CDN and the ledger name the same release. */
+function cdnDriftLines(liveDrift) {
+  if (!liveDrift?.reason) return [];
+  return [
+    `  ⚠ ${liveDrift.reason}: the CDN serves ${liveDrift.served ?? "an unknown revision"}, not the ledger's live ${liveDrift.live ?? "nothing"}.`,
+  ];
+}
+
+function rollbackToLine(rollbackTarget, liveDrift) {
+  return rollbackTarget
+    ? `  rollback to: ${rollbackTarget.aggregateSha} (receipt ${rollbackTarget.receiptId})${liveDrift?.reason ? " — corrected target" : ""}`
+    : "  rollback to: (none — first-ever ship)";
+}
+
 /**
  * Build the EXACT plan for a mutating operator verb — structured lines ready
  * to print verbatim (CLI) or join for a confirm() dialog (admin). Pure: no
@@ -137,16 +151,8 @@ export function planForAction({
           lines.push(`    - ${prLabel}${shortSha}`);
         }
       }
-      if (liveDrift?.reason) {
-        lines.push(
-          `  ⚠ ${liveDrift.reason}: the CDN serves ${liveDrift.served ?? "an unknown revision"}, not the ledger's live ${liveDrift.live ?? "nothing"}.`,
-        );
-      }
-      lines.push(
-        rollbackTarget
-          ? `  rollback to: ${rollbackTarget.aggregateSha} (receipt ${rollbackTarget.receiptId})${liveDrift?.reason ? " — corrected target" : ""}`
-          : "  rollback to: (none — first-ever ship)",
-      );
+      lines.push(...cdnDriftLines(liveDrift));
+      lines.push(rollbackToLine(rollbackTarget, liveDrift));
       if (paywall && paywall.allowed === false) {
         lines.push(`  ⚠ paywall:   ${paywall.message || "go-live is blocked by the storefront subscription gate"}`);
       }
@@ -206,11 +212,8 @@ export function planForAction({
         }
       }
       if (bypassedPreviewSha) lines.push(`  preview head (bypassed): ${bypassedPreviewSha}`);
-      lines.push(
-        rollbackTarget
-          ? `  rollback to: ${rollbackTarget.aggregateSha} (receipt ${rollbackTarget.receiptId})`
-          : "  rollback to: (none — first-ever ship)",
-      );
+      lines.push(...cdnDriftLines(liveDrift));
+      lines.push(rollbackToLine(rollbackTarget, liveDrift));
       if (paywall && paywall.allowed === false) {
         lines.push(`  ⚠ paywall:   ${paywall.message || "go-live is blocked by the storefront subscription gate"}`);
       }

package/src/platform.mjs

@@ -1,10 +1,8 @@
 /**
- * Host-platform readiness for the local loop.
+ * Host-platform copy shared by `tot doctor` and login recovery hints.
  *
- * Native Windows is unsupported (runner install + tar extraction assume a POSIX
- * toolchain). WSL reports as `linux` and is the supported path on a Windows box.
- * Keep the check + copy in ONE place so doctor, the CLI gate, and login recovery
- * hints cannot drift.
+ * Every command runs on native Windows. WSL reports as `linux` and remains the
+ * better-trodden path for the local renderer (`tot dev` / `tot start`).
  */
 
 export const WSL_INSTALL_URL = "https://learn.microsoft.com/windows/wsl/install";
@@ -17,75 +15,17 @@ export function isNativeWindows(platform = process.platform) {
   return platform === "win32";
 }
 
-/**
- * One-line detail used by `tot doctor` and CliError footers.
- * @param {{ url?: string }} [opts]
- */
-export function nativeWindowsDetail(opts = {}) {
-  const url = opts.url ?? WSL_INSTALL_URL;
-  return `native Windows isn't supported yet — run tot inside WSL (${url})`;
-}
-
-/**
- * Multi-line refuse message printed before exit. Names the attempted command so
- * a pasted invite (`tot login --code … && tot start`) still points at WSL.
- * @param {string} [command] e.g. "login", "start"
- */
-export function nativeWindowsRefuseMessage(command) {
-  const verb = command ? `tot ${command}` : "tot";
-  return (
-    `✗ ${nativeWindowsDetail()}\n` +
-    `  → next: install WSL, open an Ubuntu (or other Linux) terminal, install Node 24 LTS + git there,\n` +
-    `    then re-run \`${verb}\` inside WSL — don't keep retrying login/--device on native Windows.\n`
-  );
+/** One-line detail used by `tot doctor`. */
+export function nativeWindowsDetail() {
+  return `native Windows — if \`tot dev\` or \`tot start\` misbehaves, WSL is the better-trodden path (${WSL_INSTALL_URL})`;
 }
 
 /**
- * Commands that are safe / useful to run on native Windows so the developer can
- * learn the gate (`doctor`) or report friction (`feedback`) without a false start.
- */
-export const NATIVE_WINDOWS_ALLOWED_COMMANDS = new Set([
-  "help",
-  "--help",
-  "-h",
-  "--version",
-  "-v",
-  "version",
-  "doctor",
-  "feedback",
-  "ideas",
-]);
-
-/**
- * @param {string | null | undefined} command
- * @param {string} [platform] Node `process.platform` value (defaults to current).
- * @returns {boolean} true when this command must refuse on native Windows
- */
-export function shouldRefuseNativeWindows(command, platform = process.platform) {
-  if (!isNativeWindows(/** @type {string} */ (platform))) return false;
-  const cmd = String(command ?? "").trim();
-  if (!cmd) return false; // bare `tot` → help
-  return !NATIVE_WINDOWS_ALLOWED_COMMANDS.has(cmd);
-}
-
-/**
- * Recovery hint after a failed `tot login`. Never steers native Windows at
- * `--device` — that path still can't run the local loop on win32.
- * @param {{ device?: boolean, platform?: string }} [opts]
+ * Recovery hint after a failed `tot login`.
+ * @param {{ device?: boolean }} [opts]
  */
 export function loginFailureNext(opts = {}) {
-  const platform = /** @type {string} */ (opts.platform ?? process.platform);
-  if (isNativeWindows(platform)) return nativeWindowsDetail();
   return opts.device
     ? "re-run `tot login --device` and approve the code."
     : "re-run `tot login` and finish the browser sign-in (approve the request) — or try `tot login --device`.";
 }
-
-/**
- * `tot doctor --fix` must not open OAuth on native Windows — the session
- * would be unusable for the local loop, and the browser hop burns a cycle.
- * @param {string} [platform] Node `process.platform` value (defaults to current).
- */
-export function shouldAttemptDoctorAutoLogin(platform = process.platform) {
-  return !isNativeWindows(/** @type {string} */ (platform));
-}