@tokenoftrust/cli 4.11.2 → 4.11.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/bin/tot.mjs +0 -1
  2. package/package.json +1 -1
  3. package/src/viewer-session.mjs +1 -1
package/bin/tot.mjs CHANGED
@@ -371,7 +371,6 @@ async function main() {
371
371
  const mcpUrl = mcpIndex < 0 ? undefined : rest[mcpIndex + 1];
372
372
  if (mcpIndex >= 0 && (!mcpUrl || mcpUrl.startsWith("--"))) throw new Error("--mcp requires an HTTPS URL.");
373
373
  // One invocation context drives auth, telemetry and every runner child.
374
- delete process.env.TOT_SELECTED_MCP_URL;
375
374
  process.env.TOT_SELECTED_MCP_URL = selectedAuthority(process.env, { mcpUrl, cwd: ctx.cwd });
376
375
  process.env.MCP_BASE_URL = process.env.TOT_SELECTED_MCP_URL;
377
376
  const startedAt = Date.now();
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@tokenoftrust/cli",
3
- "version": "4.11.2",
3
+ "version": "4.11.3",
4
4
  "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
5
5
  "license": "Apache-2.0",
6
6
  "author": "Token of Trust",
package/src/viewer-session.mjs CHANGED
@@ -111,7 +111,7 @@ export function describeCliSessionRefusal(status, body, signedInMcpUrl) {
111
111
  };
112
112
  }
113
113
 
114
- if (error === "unresolved_token" && trustedMcp) {
114
+ if (error === "unresolved_token" && trustedMcp && TOKEN_OF_TRUST_MCP_ORIGINS.has(trustedMcp)) {
115
115
  const signedInOrigin = originOf(signedInMcpUrl);
116
116
  if (signedInOrigin && signedInOrigin !== trustedMcp) {
117
117
  // `TOT_SELECTED_MCP_URL=… tot login` adds a session for the storefront's MCP