@tokenoftrust/cli 4.11.2 → 4.11.4

package/bin/tot.mjs

@@ -371,7 +371,6 @@ async function main() {
   const mcpUrl = mcpIndex < 0 ? undefined : rest[mcpIndex + 1];
   if (mcpIndex >= 0 && (!mcpUrl || mcpUrl.startsWith("--"))) throw new Error("--mcp requires an HTTPS URL.");
   // One invocation context drives auth, telemetry and every runner child.
-  delete process.env.TOT_SELECTED_MCP_URL;
   process.env.TOT_SELECTED_MCP_URL = selectedAuthority(process.env, { mcpUrl, cwd: ctx.cwd });
   process.env.MCP_BASE_URL = process.env.TOT_SELECTED_MCP_URL;
   const startedAt = Date.now();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "4.11.2",
+  "version": "4.11.4",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/viewer-session.mjs

@@ -2,8 +2,9 @@
  * Viewer-session transport for the ship surface — the NO-operator-secret path.
  *
  * An invited developer holds a `tot login` MCP session but no operator secret and no
- * storefront cookie, so the old ship-surface transport dead-ended on them. This mints
- * a storefront VIEWER session from the developer's OWN MCP token (POST
+ * storefront cookie. This discovers
+ * the storefront's trusted issuer without credentials, then mints a VIEWER session
+ * from the developer's matching MCP token (POST
  * /api/dev/cli-session on the tenant's own host, which resolves WHO the opaque token
  * is via the MCP and hands back a `tot_session` cookie), then hands the caller a
  * cookie-based transport pointed at the tenant host. Authorization is the server's
@@ -111,7 +112,7 @@ export function describeCliSessionRefusal(status, body, signedInMcpUrl) {
     };
   }
 
-  if (error === "unresolved_token" && trustedMcp) {
+  if (error === "unresolved_token" && trustedMcp && TOKEN_OF_TRUST_MCP_ORIGINS.has(trustedMcp)) {
     const signedInOrigin = originOf(signedInMcpUrl);
     if (signedInOrigin && signedInOrigin !== trustedMcp) {
       // `TOT_SELECTED_MCP_URL=… tot login` adds a session for the storefront's MCP
@@ -179,45 +180,46 @@ export async function resolveViewerTransport({
   }
 
   const base = tenantBase(tenant, storefrontUrl);
-  const first = await mintSession(base, dev.token, fetchImpl, vlog);
-  if (!first.ok) return first.refusal;
-  /** @type {any} */
-  let res = first.response;
-
-  // The hosted storefront trusts ONE MCP issuer, independent of the tier this
-  // checkout is bound to (a QA-registry store is still served by the shared
-  // storefront). When it names a different issuer, the session to present is the
-  // one for THAT issuer — the checkout's own binding is for the registry, not for
-  // this transport. Use it when the developer holds one; otherwise fall through
-  // to the refusal, which says how to get one without rebinding the checkout.
-  if (res.status === 401) {
-    const body = await readJson(res);
-    const trustedMcp = typeof body?.trustedMcp === "string" ? body.trustedMcp : null;
-    const signedInOrigin = originOf(dev.mcpUrl);
-    if (
-      body?.error === "unresolved_token" &&
-      mayPresentSessionFor(base, trustedMcp) &&
-      signedInOrigin && signedInOrigin !== trustedMcp
-    ) {
-      let trustedDev = null;
-      try {
-        trustedDev = await resolveDev(null, { ...env, TOT_SELECTED_MCP_URL: trustedMcp }, { fetchImpl });
-      } catch {
-        /* no usable session for the storefront's issuer — report the mismatch below */
-      }
-      if (trustedDev?.token && originOf(trustedDev.mcpUrl) === trustedMcp) {
-        vlog(`cli-session: retrying with your ${trustedMcp} session`);
-        const retry = await mintSession(base, trustedDev.token, fetchImpl, vlog);
-        if (!retry.ok) return retry.refusal;
-        res = retry.response;
-        dev = trustedDev;
-      } else {
-        res = replayJson(res, body);
-      }
-    } else {
-      res = replayJson(res, body);
+  // Discover the issuer without credentials before presenting any bearer.
+  let discovery;
+  try {
+    vlog(`GET ${base}/api/dev/cli-session`);
+    discovery = await fetchImpl(`${base}/api/dev/cli-session`, {
+      method: "GET", headers: { accept: "application/json" }, redirect: "manual",
+    });
+  } catch {
+    return { ok: false, message: `couldn't reach ${base} to discover its identity issuer.`,
+      hint: "check the --tenant domain / your network, then re-run." };
+  }
+  vlog(`cli-session discovery → HTTP ${discovery.status}`);
+  if (!discovery.ok) {
+    if (discovery.status === 502 || discovery.status === 503) {
+      return { ok: false, ...describeCliSessionRefusal(discovery.status, await readJson(discovery), dev.mcpUrl) };
     }
+    return { ok: false, message: `couldn't discover the store's identity issuer (HTTP ${discovery.status}).`,
+      hint: "retry shortly; if it persists, report it with `tot feedback`." };
   }
+  const advertised = await readJson(discovery);
+  const trustedMcp = typeof advertised?.trustedMcp === "string" ? advertised.trustedMcp : null;
+  if (!trustedMcp || !TOKEN_OF_TRUST_MCP_ORIGINS.has(trustedMcp)) {
+    return { ok: false, ...describeCliSessionRefusal(503, { code: "invalid_mcp_issuer" }, dev.mcpUrl) };
+  }
+  if (originOf(dev.mcpUrl) !== trustedMcp) {
+    /** @type {{ ok: false, message: string, hint: string }} */
+    const refusal = { ok: false, ...describeCliSessionRefusal(401, { error: "unresolved_token", trustedMcp }, dev.mcpUrl) };
+    if (!mayPresentSessionFor(base, trustedMcp)) return refusal;
+    let trustedDev = null;
+    try {
+      trustedDev = await resolveDev(null, { ...env, TOT_SELECTED_MCP_URL: trustedMcp }, { fetchImpl });
+    } catch {
+      /* No usable credential for the declared issuer: nothing is presented. */
+    }
+    if (!trustedDev?.token || originOf(trustedDev.mcpUrl) !== trustedMcp) return refusal;
+    dev = trustedDev;
+  }
+  const mintedSession = await mintSession(base, dev.token, fetchImpl, vlog);
+  if (!mintedSession.ok) return mintedSession.refusal;
+  const res = mintedSession.response;
 
   if (res.status === 401 || res.status === 502 || res.status === 503) {
     const body = await readJson(res);
@@ -247,7 +249,7 @@ export async function resolveViewerTransport({
     ok: true,
     base,
     identity: {
-      account: maskAccount(typeof minted?.email === "string" ? minted.email : null),
+      account: typeof minted?.account === "string" && /^[^@\s]…@[^@\s]+$/.test(minted.account) ? minted.account : null,
       mcp: originOf(dev.mcpUrl),
     },
     authHeaders: {
@@ -294,11 +296,6 @@ async function readJson(res) {
   }
 }
 
-/** A response whose body was already read, re-readable once more. */
-function replayJson(res, body) {
-  return { ok: res.ok, status: res.status, headers: res.headers, json: async () => body };
-}
-
 /**
  * POST the bearer to `<base>/api/dev/cli-session`.
  * @returns {Promise<{ ok: true, response: any } | { ok: false, refusal: { ok: false, message: string, hint: string } }>}