@tokenoftrust/cli 3.10.3 → 3.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "3.10.3",
+  "version": "3.11.0",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/dev.mjs

@@ -913,7 +913,20 @@ export function rendererNativeBindingGaps(runnerDir, { platform = process.platfo
  * `platform`/`arch` are injectable so this is testable off the host's real arch.
  */
 export function rendererCacheHealthy(runnerDir, opts = {}) {
-  return rendererNativeBindingGaps(runnerDir, opts).length === 0;
+  return rendererNativeBindingGaps(runnerDir, opts).length === 0 && rendererDepsResolve(runnerDir);
+}
+
+/**
+ * Does the renderer's own dependency tree resolve from where it sits? `existsSync`
+ * follows links, so a `node_modules` entry whose target is gone (a junction left
+ * pointing into a renamed staging directory) reads as absent. A tree with no
+ * `apps/storefront/package.json` has nothing to check and passes.
+ * @param {string} runnerDir
+ */
+export function rendererDepsResolve(runnerDir) {
+  const app = join(runnerDir, "apps", "storefront");
+  if (!existsSync(join(app, "package.json"))) return true;
+  return existsSync(join(app, "node_modules", "astro", "package.json"));
 }
 
 /**
@@ -1266,7 +1279,7 @@ export async function installRunnerTarball(
   // Bounded to one retry so a genuinely-broken source still fails loudly.
   for (let attempt = 1; ; attempt++) {
     const archivePath = /** @type {string} */ (isUrl ? join(tmpdir(), `tot-renderer-${process.pid}-${attempt}.tar.gz`) : localSource);
-    const stagingDir = `${runnerDir}.staging-${process.pid}`;
+    const stagingDir = installsInPlace() ? runnerDir : `${runnerDir}.staging-${process.pid}`;
     try {
       if (isUrl) {
         // The fetch itself is otherwise silent (no per-byte output) and can run
@@ -1339,8 +1352,10 @@ export async function installRunnerTarball(
       // Atomic-ish: only rename into the final, discoverable path once install
       // succeeded, so a crashed/interrupted run never leaves a half-built cache
       // entry that a later `tot dev` would treat as ready.
-      rmSync(runnerDir, { recursive: true, force: true });
-      renameSync(stagingDir, runnerDir);
+      if (stagingDir !== runnerDir) {
+        rmSync(runnerDir, { recursive: true, force: true });
+        renameSync(stagingDir, runnerDir);
+      }
       // Fence a fresh install against npm/cli#4828: if the installer left the wrong
       // arch's native bindings (or none) for this host, DON'T stamp the completion
       // marker — an unmarked tree is never reused, so the next run reinstalls cleanly
@@ -1368,6 +1383,19 @@ export async function installRunnerTarball(
         /** @type {any} */ (err).permanent = true;
         throw err;
       }
+      if (!rendererDepsResolve(runnerDir)) {
+        await emitObstacle("install-failed");
+        const err = new CliError(
+          `the store preview engine installed but its dependencies don't resolve from where it was installed` +
+            `\n     details: ${installLog}`,
+          {
+            next: `re-run \`tot start --reset-cache\`; if it repeats, file feedback naming preview engine ${version} and your OS`,
+            exitCode: 2,
+          },
+        );
+        /** @type {any} */ (err).permanent = true;
+        throw err;
+      }
       writeCacheMarker(runnerDir, { version, integrity: contentId });
       return runnerDir;
     } catch (e) {
@@ -1547,9 +1575,9 @@ function extractTarball(archivePath, destDir, { strip = 0 } = {}) {
  * missing or disabled (a locked-down host), pnpm install below falls through to
  * the pnpm-missing obstacle instead of failing here.
  * @param {string} runnerDir
- * @param {{ logPath?: string, spawnFn?: typeof spawnSync }} [opts]
+ * @param {{ logPath?: string, spawnFn?: (cmd: string, args: string[], opts?: any) => any }} [opts]
  */
-export function ensureCorepackPnpm(runnerDir, { logPath, spawnFn = spawnSync } = {}) {
+export function ensureCorepackPnpm(runnerDir, { logPath, spawnFn = spawnLauncherSync } = {}) {
   const pkgPath = join(runnerDir, "package.json");
   if (!existsSync(pkgPath)) return;
   let pm;
@@ -1567,7 +1595,7 @@ export function ensureCorepackPnpm(runnerDir, { logPath, spawnFn = spawnSync } =
     // WITHOUT the global shim (see runPnpmInstall's fallback). Capture both to the
     // log — a silent corepack failure was why the install error carried no cause.
     for (const args of [["enable"], ["prepare", pm, "--activate"]]) {
-      const r = spawnFn("corepack", args, { stdio: ["ignore", fd ?? "ignore", fd ?? "ignore"], shell: launcherNeedsShell() });
+      const r = spawnFn("corepack", args, { stdio: ["ignore", fd ?? "ignore", fd ?? "ignore"] });
       if (fd !== null && (r.error || r.status !== 0)) {
         const rerr = /** @type {any} */ (r.error);
         writeSync(fd, `[tot] corepack ${args.join(" ")} → ${rerr?.code || rerr?.message || `exit ${r.status}`}\n`);
@@ -1598,22 +1626,68 @@ export function ensureCorepackPnpm(runnerDir, { logPath, spawnFn = spawnSync } =
  * @param {string} cmd @param {string[]} args @param {object} opts
  * @returns {Promise<{ status: number|null, error: Error|null, signal?: string|null }>}
  */
+/**
+ * Windows installs the renderer where it will live. pnpm there writes `node_modules`
+ * junctions with ABSOLUTE targets into the directory it installs in, so renaming a
+ * staging directory into place leaves every one dangling. The completion marker is still
+ * written last and an unmarked tree is never reused, so a half install cannot be served.
+ * @param {string} [platform]
+ */
+export function installsInPlace(platform = process.platform) {
+  return platform === "win32";
+}
+
 /**
  * On Windows `pnpm`, `corepack` and `npm` are `.cmd` shims, which Node refuses to
- * spawn without a shell (and a bare name ENOENTs). Their args here are fixed
- * literals, so the shell sees no user input.
+ * spawn without a shell.
+ * @param {string} [platform]
  */
 export function launcherNeedsShell(platform = process.platform) {
   return platform === "win32";
 }
 
+const SAFE_LAUNCHER_ARG = /^[\w@.:+=/-]+$/;
+
+/**
+ * `[file, args, opts]` to spawn a package-manager launcher. On Windows that is one
+ * command string run through a shell (an args array alongside `shell: true` trips
+ * Node's DEP0190 warning). The shell sees every argument, so each must match a safe
+ * alphabet; anything else throws instead of reaching it.
+ * @param {string} cmd @param {string[]} args @param {object} [opts] @param {string} [platform]
+ * @returns {[string, string[], object]}
+ */
+export function launcherSpawn(cmd, args, opts = {}, platform = process.platform) {
+  if (!launcherNeedsShell(platform)) return [cmd, args, opts];
+  for (const a of args) {
+    if (!SAFE_LAUNCHER_ARG.test(a)) throw new Error(`refusing to pass an unsafe argument to ${cmd} through a shell: ${a}`);
+  }
+  return [[cmd, ...args].join(" "), [], { ...opts, shell: true }];
+}
+
+/**
+ * Is the launcher on PATH? POSIX answers with ENOENT at spawn, so this is always true
+ * there. Through cmd.exe a missing launcher is an ordinary non-zero exit that cannot be
+ * told from a failed install, so Windows asks `where` (a real executable, no shell).
+ * @param {string} cmd @param {string} [platform]
+ */
+export function launcherAvailable(cmd, platform = process.platform) {
+  if (!launcherNeedsShell(platform)) return true;
+  return spawnSync("where", [cmd], { stdio: "ignore" }).status === 0;
+}
+
+/** @param {string} cmd @param {string[]} args @param {object} [opts] */
+function spawnLauncherSync(cmd, args, opts = {}) {
+  const [file, fileArgs, fileOpts] = launcherSpawn(cmd, args, opts);
+  return spawnSync(file, fileArgs, fileOpts);
+}
+
 function spawnAsyncResult(cmd, args, opts = {}) {
   return new Promise((resolvePromise) => {
     let settled = false;
     const settle = (v) => { if (!settled) { settled = true; resolvePromise(v); } };
     let child;
     try {
-      child = spawn(cmd, args, opts);
+      child = spawn(...launcherSpawn(cmd, args, opts));
     } catch (error) {
       settle({ status: null, error });
       return;
@@ -1625,10 +1699,10 @@ function spawnAsyncResult(cmd, args, opts = {}) {
 
 /**
  * @param {string} runnerDir
- * @param {{ logPath?: string, spawnFn?: (cmd: string, args: string[], opts?: any) => any }} [opts]
+ * @param {{ logPath?: string, spawnFn?: (cmd: string, args: string[], opts?: any) => any, available?: (cmd: string) => boolean }} [opts]
  * @returns {Promise<string>} the launcher that completed the install ("pnpm" | "corepack" | "npm").
  */
-export async function runPnpmInstall(runnerDir, { logPath, spawnFn = spawnAsyncResult } = {}) {
+export async function runPnpmInstall(runnerDir, { logPath, spawnFn = spawnAsyncResult, available = launcherAvailable } = {}) {
   const fd = logPath ? openSync(logPath, "a") : null;
   const installArgs = ["install", "--config.dangerouslyAllowAllBuilds=true"];
   // pnpm FIRST: the renderer tree is a bundle of native optional deps (rolldown,
@@ -1653,6 +1727,10 @@ export async function runPnpmInstall(runnerDir, { logPath, spawnFn = spawnAsyncR
   ];
   try {
     for (const { cmd, args } of attempts) {
+      if (!available(cmd)) {
+        if (fd !== null) writeSync(fd, `[tot] ${cmd} not found on PATH — trying the next launcher\n`);
+        continue;
+      }
       // Awaited: the default spawnFn (spawnAsyncResult) runs the launcher
       // NON-BLOCKING so the caller's "installing…" spinner keeps ticking during
       // the (long, one-time) npm install instead of freezing at "(0s)" — a
@@ -1663,15 +1741,20 @@ export async function runPnpmInstall(runnerDir, { logPath, spawnFn = spawnAsyncR
         cwd: runnerDir,
         // Send both streams to the log fd (or swallow them) — never inherit.
         stdio: ["ignore", fd ?? "ignore", fd ?? "ignore"],
-        shell: launcherNeedsShell(),
       });
       if (r.status === 0) return cmd; // installed — the launcher that did it
-      // Through cmd.exe a missing launcher is exit 9009 ("not recognized"), not ENOENT.
-      if (/** @type {any} */ (r.error)?.code === "ENOENT" || (launcherNeedsShell() && r.status === 9009)) {
+      if (/** @type {any} */ (r.error)?.code === "ENOENT") {
         // This launcher isn't on the machine — record it and try the next one.
         if (fd !== null) writeSync(fd, `[tot] ${cmd} not found (ENOENT) — trying the next launcher\n`);
         continue;
       }
+      // corepack is the one launcher that can run and still fail for a reason that has
+      // nothing to do with the install (no write access to its shim directory, no
+      // network to fetch pnpm); npm below is the escape hatch that always exists.
+      if (cmd === "corepack") {
+        if (fd !== null) writeSync(fd, `[tot] corepack exited ${r.status} — trying npm\n`);
+        continue;
+      }
       // The launcher ran; the install itself failed. That's the actionable error.
       // installRunnerTarball retries transient failures once from a clean slate;
       // deterministic broken-release 404s are marked permanent below and skip it.