@tokenoftrust/cli 4.2.0 → 4.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/auth.mjs

@@ -173,18 +173,24 @@ export async function resolveDeveloperSession(client, env, deps = {}) {
         { reason: "expired", hint: developerCredentialRecoveryHint(creds) },
       );
     }
+    const refreshGrant = { refreshToken: creds.refreshToken, clientId: creds.clientId };
     let refreshed;
-    try {
-      refreshed = await refreshAccessToken(
-        creds.tokenEndpoint,
-        { refreshToken: creds.refreshToken, clientId: creds.clientId },
-        fetchImpl,
-      );
-    } catch (e) {
-      throw new AuthUnavailableError(
-        "couldn't refresh your Token of Trust session.",
-        { reason: "refreshFailed", hint: developerCredentialRecoveryHint(creds) },
-      );
+    // One retry: a single token-endpoint failure is not "you are not signed in".
+    for (let attempt = 0; attempt < 2; attempt++) {
+      try {
+        refreshed = await refreshAccessToken(creds.tokenEndpoint, refreshGrant, fetchImpl);
+        break;
+      } catch {
+        if (attempt === 1) {
+          throw new AuthUnavailableError(
+            "couldn't refresh your Token of Trust session.",
+            {
+              reason: "refreshFailed",
+              hint: `the refresh failed. ${developerCredentialRecoveryHint(creds)}`,
+            },
+          );
+        }
+      }
     }
     const prior = creds;
     creds = credentialsFromToken({

package/src/commands/feedback.mjs

@@ -29,6 +29,8 @@ import { fail } from "../errors.mjs";
 import { formatDiagnostics, readDiagnostics, recordDiagnostic } from "../diagnostics.mjs";
 
 const DEFAULT_MCP_URL = "https://mcp.tokenoftrust.com";
+/** `feedback_submit` returns this field. Example: `fb-1792647485730-7vguok`. */
+const FEEDBACK_ID = /^fb-[a-z0-9]+(?:-[a-z0-9]+)*$/i;
 const TYPES = new Set(["bug", "feature", "improvement"]);
 const SEVERITIES = new Set(["critical", "high", "medium", "low"]);
 const CATEGORIES = new Set([
@@ -81,6 +83,17 @@ export function buildFeedbackPayload({ type, category, severity, title, descript
   };
 }
 
+/**
+ * The fb- id from a `feedback_submit` result. Only `feedbackId` counts.
+ * @param {unknown} result
+ * @returns {string|null}
+ */
+export function feedbackReportId(result) {
+  if (result == null || typeof result !== "object" || !("feedbackId" in result)) return null;
+  const value = result.feedbackId;
+  return typeof value === "string" && FEEDBACK_ID.test(value) ? value : null;
+}
+
 function parseArgs(argv) {
   const a = {
     mcp: null, type: "improvement", category: "product-ux", severity: "medium",
@@ -104,8 +117,12 @@ function parseArgs(argv) {
   return a;
 }
 
-/** @param {string[]} argv */
-export async function run(argv) {
+/**
+ * @param {string[]} argv
+ * @param {{ createClient?: typeof createMcpClient, establishSession?: typeof establishSession }} [deps]
+ *   Test seam. Production calls pass only argv.
+ */
+export async function run(argv, deps = {}) {
   const env = process.env;
   const args = parseArgs(argv);
   if (args.help) {
@@ -184,12 +201,14 @@ export async function run(argv) {
   }
 
   const mcpUrl = args.mcp || env.MCP_BASE_URL || env.TOT_MCP_URL || DEFAULT_MCP_URL;
-  const client = createMcpClient(mcpUrl);
+  const createClient = deps.createClient || createMcpClient;
+  const openSession = deps.establishSession || establishSession;
+  const client = createClient(mcpUrl);
   try {
     // Attach auth in the right order relative to the handshake (developer bearer
     // pre-initialize). We keep the feedback-specific clientInfo by injecting our
     // own initialize.
-    await establishSession(client, {
+    await openSession(client, {
       env,
       initialize: () => client.initialize({ name: "tot-cli", version: "feedback" }),
     });
@@ -204,8 +223,15 @@ export async function run(argv) {
       traceId,
     });
     const res = await client.callTool("feedback_submit", payload);
-    const id = res?.reportId || res?.id || null;
-    console.log(`\n+ sent — thank you.${id ? ` (report ${id})` : ""}`);
+    const id = feedbackReportId(res);
+    if (!id) {
+      console.error(fail(
+        "the server accepted the note but returned no fb- id.",
+        "don't resend yet — the note may already be in the queue.",
+      ));
+      return 1;
+    }
+    console.log(`\n+ sent — thank you. ${id}`);
     return 0;
   } catch (e) {
     recordDiagnostic(e, { command: "feedback", operation: "feedback_submit", required: true }, env);

package/src/commands/submit.mjs

@@ -1583,11 +1583,17 @@ export async function run(argv, ctx, {
     const diagnostic = recordDiagnostic(e, {
       command: verb, operation: "session_establish", required: true, degraded: false,
     }, env);
-    const note = e instanceof AuthUnavailableError
-      ? `Candidate not created: ${e.hint || "developer sign-in is required"}.`
+    const authFailure = e instanceof AuthUnavailableError;
+    const note = authFailure
+      ? `Candidate not created: ${e.reason}: ${e.message}${e.hint ? ` ${e.hint}` : ""}`
       : `Candidate not created: couldn't reach Token of Trust (${describeReadbackError(e)}).`;
     if (!args.json) {
-      console.error(fail(note, "run `tot login`, then re-run; no candidate ref was pushed"));
+      // The hint already states the next step. A second line that always says
+      // `tot login` flattens refreshFailed into "you are not signed in".
+      console.error(fail(
+        note,
+        authFailure ? null : "run `tot login`, then re-run; no candidate ref was pushed",
+      ));
       console.error(`  → ${diagnosticReference(diagnostic, env)}`);
     }
     emitJson(args, buildJsonResult({