@tokenoftrust/cli 3.9.1 → 3.10.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "3.9.1",
+  "version": "3.10.1",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/hotfix.mjs

@@ -157,6 +157,7 @@ export function normalizeHotfixResult(data) {
     artifactDigest: typeof o.artifactDigest === "string" ? o.artifactDigest : null,
     receiptId: typeof o.receiptId === "string" ? o.receiptId : null,
     rollbackTarget: o.rollbackTarget && typeof o.rollbackTarget === "object" ? o.rollbackTarget : null,
+    retriable: o.retriable === false ? false : o.retriable === true ? true : null,
     forwardIntegration: fwd
       ? {
           ok: fwd.ok === true,
@@ -371,10 +372,15 @@ export function reportHotfixResult(result, { tenant, liveUrl, noOpen, openUrl })
     result.state === "promote_failed" ||
     result.state === "record_failed"
   ) {
+    // Same rule as ship: a compare-and-set refusal, or any outcome that says a retry cannot
+    // change it, must not be offered as safe to retry.
+    const deterministic = result.retriable === false || result.reason === "live_moved";
     console.error(
       fail(
         result.message || `hotfix ${result.state.replace("_", " ")}`,
-        "re-run `tot hotfix` — the release is idempotent and safe to retry",
+        deterministic
+          ? "do not re-run `tot hotfix` — this refusal is deterministic and will not change"
+          : "re-run `tot hotfix` — the release is idempotent and safe to retry",
       ),
     );
     return 1;

package/src/commands/ship.mjs

@@ -734,11 +734,12 @@ function reportShipResult(result, { tenant, liveUrl, noOpen, openUrl }) {
     return 1;
   }
   if (result.state === "publishing") {
-    // Dispatched is not written. Say the pointer moved only once this result says it was.
+    // pointerWritten false means the job step has not confirmed a write. For s3-overwrite, CI can
+    // write the pointer during awaiting-external, before prove, so do not say the pointer is absent.
     console.log(
       result.pointerWritten
         ? `\n  ⏳ ${tenant} is publishing — the live pointer moved, CDN delivery is still confirming.`
-        : `\n  ⏳ ${tenant} is publishing — dispatched; the live pointer is not written yet.`,
+        : `\n  ⏳ ${tenant} is publishing — dispatched; the live pointer is not confirmed written.`,
     );
     if (result.pinnedSha) console.log(`  pinned:  ${result.pinnedSha}`);
     if (result.receiptId) console.log(`  receipt: ${result.receiptId}`);

package/src/token-store.mjs

@@ -4,7 +4,7 @@
  * TOT_HOME selects a private home and TOT_PROFILE selects an independent identity.
  */
 import {
-  readFileSync, writeFileSync, mkdirSync, renameSync, chmodSync, existsSync, rmSync, linkSync, unlinkSync,
+  readFileSync, writeFileSync, mkdirSync, renameSync, chmodSync, existsSync, rmSync, linkSync, unlinkSync, statSync,
 } from "node:fs";
 import { homedir } from "node:os";
 import { createHash, randomUUID } from "node:crypto";
@@ -55,22 +55,45 @@ export function normalizeAuthority(value) {
 }
 
 /**
- * `git config --get` exit 1 means the key is unset. Exit 128 is "not a checkout"
- * only when stderr says so. Permission denied and a missing git binary are not
- * "no authority" — callers must not fall through to another session.
+ * `git config --get` exit 1 means the key is unset only when the config was readable.
+ * Exit 128 is "not a checkout" only when stderr says so. Permission denied, at any
+ * exit code, and a missing git binary are not "no authority".
  * @param {unknown} error
  */
 export function isAbsentGitConfig(error) {
+  const stderr = `${/** @type {{ stderr?: unknown }} */ (error)?.stderr ?? ""}\n${/** @type {{ message?: unknown }} */ (error)?.message ?? ""}`;
+  if (/Permission denied|unable to access/i.test(stderr)) return false;
   const status = error && typeof error === "object" ? /** @type {{ status?: number }} */ (error).status : undefined;
   if (status === 1) return true;
   if (status !== 128) return false;
-  const stderr = `${/** @type {{ stderr?: unknown, message?: unknown }} */ (error).stderr ?? ""}\n${/** @type {{ message?: unknown }} */ (error).message ?? ""}`;
-  if (/Permission denied|unable to access/i.test(stderr)) return false;
   return /not a git repository|can only be used inside a git repository/i.test(stderr);
 }
 
+/** A mode with no read bits is unreadable even when a privileged process can still open it. */
+function refuseUnreadableGitConfig(cwd) {
+  const config = join(cwd, ".git", "config");
+  let mode;
+  try {
+    mode = statSync(config).mode;
+  } catch (error) {
+    const code = error && typeof error === "object" ? /** @type {{ code?: string }} */ (error).code : undefined;
+    if (code === "ENOENT" || code === "ENOTDIR") return;
+    if (code === "EACCES") throw gitConfigDenied(config);
+    throw error;
+  }
+  if ((mode & 0o444) === 0) throw gitConfigDenied(config);
+}
+
+function gitConfigDenied(config) {
+  const denied = new Error(`unable to access '${config}': Permission denied`);
+  /** @type {Error & { status?: number, stderr?: string }} */ (denied).status = 128;
+  /** @type {Error & { stderr?: string }} */ (denied).stderr = denied.message;
+  return denied;
+}
+
 /** Local checkout provenance, never inferred from a shared forge hostname. */
 export function repositoryAuthority(cwd = process.cwd()) {
+  refuseUnreadableGitConfig(cwd);
   let value;
   try {
     value = execFileSync("git", ["-C", cwd, "config", "--local", "--get", MCP_AUTHORITY_KEY], {