@tokenoftrust/cli 3.7.2 → 3.7.3

package/bin/tot.mjs

@@ -133,7 +133,12 @@ async function dispatch(cmd, rest, ctx) {
   // root's preview branch into it. Refuse them there, naming the space's own path.
   if (SPACE_REFUSED_COMMANDS.has(cmd)) {
     const { recordedCheckout } = await import("../src/commands/git-credential.mjs");
-    const space = recordedCheckout(ctx.cwd);
+    let space;
+    try { space = recordedCheckout(ctx.cwd); }
+    catch (error) {
+      process.stderr.write(`tot: could not read this checkout's git config, so it is not safe to continue.\n${error instanceof Error ? error.message : error}\n`);
+      return 1;
+    }
     if (space?.kind === "publication-space") {
       process.stderr.write(spaceCheckoutRefusal(cmd, space.spaceId));
       return 2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "3.7.2",
+  "version": "3.7.3",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/git-credential.mjs

@@ -128,7 +128,14 @@ export async function mintOrCacheCredential({
 } = {}) {
   let authority;
   try { authority = selectedAuthority(env, { cwd }); }
-  catch { console.error("tot: this checkout has an invalid MCP authority. Run tot login --mcp <url> in this checkout."); return null; }
+  catch (error) {
+    if (error instanceof Error && error.message.startsWith("invalid MCP authority")) {
+      console.error("tot: this checkout has an invalid MCP authority. Run tot login --mcp <url> in this checkout.");
+      return null;
+    }
+    console.error(formatError(error));
+    return null;
+  }
   env = { ...env, TOT_SELECTED_MCP_URL: authority, MCP_BASE_URL: authority };
   const report = (e) => {
     console.error(e instanceof AuthUnavailableError
@@ -142,7 +149,9 @@ export async function mintOrCacheCredential({
       `tot: Token of Trust's entitlement service didn't answer — retrying for up to ${Math.round(ms / 1000)}s…`,
     ),
   });
-  const recorded = recordedCheckout(cwd);
+  let recorded;
+  try { recorded = recordedCheckout(cwd); }
+  catch (e) { report(e); return null; }
   if (recorded?.kind === "invalid") return null; // a half-recorded space mints nothing, never the store's
   if (recorded?.kind === PUBLICATION_SPACE_KIND) {
     if (expectedHost && !hostMatches(recorded.originUrl, expectedHost)) return null;
@@ -167,7 +176,9 @@ export async function mintOrCacheCredential({
       return null;
     }
   }
-  const kit = kitCheckout(cwd);
+  let kit;
+  try { kit = kitCheckout(cwd); }
+  catch (e) { report(e); return null; }
   if (kit) {
     if (expectedHost && !hostMatches(kit.originUrl, expectedHost)) return null;
     const alias = resolveReadOnlyAlias(kit.target);
@@ -256,7 +267,8 @@ export async function mintOrCacheCredential({
 
 /**
  * The publication-space checkout `cwd` is in (or a half-recorded one: `{ kind: "invalid" }`),
- * from the kind `tot clone` recorded; null for anything else. Never throws.
+ * from the kind `tot clone` recorded; null for anything else. An unreadable git
+ * config throws — it is not "not a space".
  * @param {string} cwd
  * @returns {{ kind: "publication-space", tenant: string, spaceId: string, repo: string, originUrl: string|null }
  *   | { kind: "invalid" } | null}
@@ -264,8 +276,7 @@ export async function mintOrCacheCredential({
 export function recordedCheckout(cwd) {
   const git = (cargs) =>
     execFileSync("git", ["-C", cwd, ...cargs], { stdio: ["ignore", "pipe", "pipe"] }).toString();
-  let kind;
-  try { kind = readCheckoutKind(git); } catch { return null; }
+  const kind = readCheckoutKind(git);
   if (kind.kind === "invalid") return { kind: "invalid" };
   if (kind.kind !== PUBLICATION_SPACE_KIND) return null;
   let originUrl = null;
@@ -275,7 +286,7 @@ export function recordedCheckout(cwd) {
 
 /**
  * The read-only kit checkout `cwd` is in, from the kind `tot clone` recorded, or null when
- * it is not one (a store, a loose dir, not a repo). Never throws.
+ * it is not one (a store, a loose dir, not a repo). An unreadable git config throws.
  * @param {string} cwd
  * @returns {{ target: string, originUrl: string|null }|null}
  */

package/src/git-credential.mjs

@@ -21,7 +21,7 @@ import { homedir } from "node:os";
 import { createHash } from "node:crypto";
 import { join, dirname } from "node:path";
 import { mkdirSync, writeFileSync, chmodSync, rmSync } from "node:fs";
-import { readCredentials, writeCredentials, selectedAuthority, profileSlug, readSessionCredentials } from "./token-store.mjs";
+import { readCredentials, writeCredentials, selectedAuthority, profileSlug, readSessionCredentials, isAbsentGitConfig } from "./token-store.mjs";
 
 /** The git config value that routes credential requests through `tot` — the
  *  `!` tells git to run this as a shell command (git appends the operation,
@@ -54,8 +54,9 @@ export function splitAuthedRemote(remoteUrl) {
     if (!token) return null;
     const username = u.username ? decodeURIComponent(u.username) : "";
     return { publicUrl: `${u.protocol}//${u.host}${u.pathname}`, username, token };
-  } catch {
-    return null;
+  } catch (error) {
+    if (error instanceof TypeError || error instanceof URIError) return null;
+    throw error;
   }
 }
 
@@ -205,7 +206,11 @@ export function recordPublicationSpaceCheckout(git, { tenant, spaceId, repo }) {
  */
 export function readCheckoutKind(git) {
   const get = (key) => {
-    try { return String(git(["config", "--local", "--get", key])).trim(); } catch { return ""; }
+    try { return String(git(["config", "--local", "--get", key])).trim(); }
+    catch (error) {
+      if (isAbsentGitConfig(error)) return "";
+      throw error;
+    }
   };
   const kind = get(CHECKOUT_KIND_KEY);
   if (kind === PUBLICATION_SPACE_KIND) {

package/src/token-store.mjs

@@ -54,6 +54,21 @@ export function normalizeAuthority(value) {
   }
 }
 
+/**
+ * `git config --get` exit 1 means the key is unset. Exit 128 is "not a checkout"
+ * only when stderr says so. Permission denied and a missing git binary are not
+ * "no authority" — callers must not fall through to another session.
+ * @param {unknown} error
+ */
+export function isAbsentGitConfig(error) {
+  const status = error && typeof error === "object" ? /** @type {{ status?: number }} */ (error).status : undefined;
+  if (status === 1) return true;
+  if (status !== 128) return false;
+  const stderr = `${/** @type {{ stderr?: unknown, message?: unknown }} */ (error).stderr ?? ""}\n${/** @type {{ message?: unknown }} */ (error).message ?? ""}`;
+  if (/Permission denied|unable to access/i.test(stderr)) return false;
+  return /not a git repository|can only be used inside a git repository/i.test(stderr);
+}
+
 /** Local checkout provenance, never inferred from a shared forge hostname. */
 export function repositoryAuthority(cwd = process.cwd()) {
   let value;
@@ -61,7 +76,10 @@ export function repositoryAuthority(cwd = process.cwd()) {
     value = execFileSync("git", ["-C", cwd, "config", "--local", "--get", MCP_AUTHORITY_KEY], {
       encoding: "utf8", stdio: ["ignore", "pipe", "pipe"],
     }).trim();
-  } catch { return null; }
+  } catch (error) {
+    if (isAbsentGitConfig(error)) return null;
+    throw error;
+  }
   return value ? normalizeAuthority(value) : null;
 }
 
@@ -147,8 +165,13 @@ export function defaultCredentialsPath(env = process.env, mcpUrl = undefined) {
 export function readSessionCredentials(env = process.env, mcpUrl = undefined) {
   const authority = selectedAuthority(env, { mcpUrl });
   const creds = readCredentials(defaultCredentialsPath(env, authority));
-  try { return creds && normalizeAuthority(creds.mcpUrl) === authority ? creds : null; }
-  catch { return null; }
+  if (!creds || typeof creds.mcpUrl !== "string") return null;
+  try {
+    return normalizeAuthority(creds.mcpUrl) === authority ? creds : null;
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("invalid MCP authority")) return null;
+    throw error;
+  }
 }
 
 /**
@@ -165,7 +188,10 @@ export function readCredentials(filePath) {
   try {
     const parsed = JSON.parse(text);
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
-  } catch { return null; }
+  } catch (error) {
+    if (error instanceof SyntaxError) return null;
+    throw error;
+  }
 }
 
 /**

package/src/visual-parity.mjs

@@ -61,11 +61,14 @@ function parseConfig(tenantDir) {
   }
 }
 
-/** The checkout's `.tot/config.json`, or null when absent or unreadable. */
+/** The checkout's `.tot/config.json`, or null when it is absent or malformed. Unreadable throws. */
 function readTotConfig(tenantDir) {
   try {
     return JSON.parse(readFileSync(join(tenantDir, ".tot", "config.json"), "utf8"));
-  } catch { return null; }
+  } catch (error) {
+    if (error?.code === "ENOENT" || error instanceof SyntaxError) return null;
+    throw error;
+  }
 }
 
 function allowedNavigation(value, allowlist) {