hereya-cli 0.100.1 → 0.100.3

package/dist/executor/resolve-env.d.ts

@@ -90,7 +90,15 @@ export declare function resolveGithubAppMarkers(resolved: Record<string, string>
 /**
  * Walk a resolved env map, find the first value that looks like an HTTPS
  * GitHub URL (with or without `.git` suffix and trailing slash), and return
- * `['<owner>/<repo>']`. Returns `undefined` if no GitHub URL is found.
+ * `['<repo>']`. Returns `undefined` if no GitHub URL is found.
+ *
+ * The bare repo name (no owner prefix) is what GitHub's installation-token
+ * endpoint (`POST /app/installations/{id}/access_tokens`) expects in its
+ * `repositories` body field: it scopes by repo name within the installation
+ * account, since an installation is already tied to a single account. Octokit
+ * forwards `repositoryNames` verbatim to that field, so passing `owner/repo`
+ * causes the mint to fail with "There is at least one repository that does
+ * not exist or is not accessible to the parent installation".
  *
  * Used by `resolveGithubAppMarkers` to scope minted installation tokens to a
  * single repository instead of granting installation-wide access.

package/dist/executor/resolve-env.js

@@ -83,7 +83,15 @@ export async function resolveGithubAppMarkers(resolved, input, providers) {
 /**
  * Walk a resolved env map, find the first value that looks like an HTTPS
  * GitHub URL (with or without `.git` suffix and trailing slash), and return
- * `['<owner>/<repo>']`. Returns `undefined` if no GitHub URL is found.
+ * `['<repo>']`. Returns `undefined` if no GitHub URL is found.
+ *
+ * The bare repo name (no owner prefix) is what GitHub's installation-token
+ * endpoint (`POST /app/installations/{id}/access_tokens`) expects in its
+ * `repositories` body field: it scopes by repo name within the installation
+ * account, since an installation is already tied to a single account. Octokit
+ * forwards `repositoryNames` verbatim to that field, so passing `owner/repo`
+ * causes the mint to fail with "There is at least one repository that does
+ * not exist or is not accessible to the parent installation".
  *
  * Used by `resolveGithubAppMarkers` to scope minted installation tokens to a
  * single repository instead of granting installation-wide access.
@@ -95,7 +103,7 @@ export function extractGithubRepoFromPeers(resolved) {
             continue;
         const match = githubUrlRegex.exec(value);
         if (match) {
-            return [`${match[1]}/${match[2]}`];
+            return [match[2]];
         }
     }
     return undefined;

package/dist/lib/git-utils.js

@@ -1,5 +1,5 @@
-import { spawn } from 'node:child_process';
-import { runShell } from './shell.js';
+import spawn from 'cross-spawn';
+import { buildGitCredentialHelperValue, runShell } from './shell.js';
 export const gitUtils = {
     /**
      * Clones a git repository using the hereya credential helper.
@@ -104,7 +104,7 @@ export async function cloneWithCredentialHelper(input) {
     const { gitUrl, hereyaBinPath, password, targetDir, username } = input;
     // Build the credential helper config
     // The ! prefix tells git to treat it as a shell command
-    const credHelper = `!${hereyaBinPath} credential-helper`;
+    const credHelper = buildGitCredentialHelperValue(hereyaBinPath);
     return new Promise((resolve) => {
         const env = { ...process.env };
         if (username)
@@ -140,7 +140,7 @@ export async function cloneWithCredentialHelper(input) {
 }
 export async function setupCredentialHelper(input) {
     const { hereyaBinPath, projectDir } = input;
-    const credHelper = `!${hereyaBinPath} credential-helper`;
+    const credHelper = buildGitCredentialHelperValue(hereyaBinPath);
     const runGitConfig = (args) => new Promise((resolve, reject) => {
         const child = spawn('git', args, { cwd: projectDir, stdio: 'pipe' });
         child.on('close', (code) => {

package/dist/lib/shell.d.ts

@@ -39,3 +39,23 @@ export declare const shellUtils: {
     runShell: typeof runShell;
 };
 export declare function delay(ms: number): Promise<unknown> | undefined;
+/**
+ * Builds a shell-safe command string that invokes the hereya CLI. Suitable
+ * for embedding in git credential-helper config strings, SSH ProxyCommand
+ * lines, and anywhere else an external tool re-parses our command through
+ * a POSIX shell or cmd.exe.
+ *
+ * - If `binPath` ends in `.js`, prepend the absolute path of the current
+ *   Node executable (`process.execPath`) so the helper works without
+ *   depending on `.js` being executable.
+ * - Path-like tokens are normalized to forward slashes and wrapped in
+ *   double quotes to survive spaces and Windows backslashes.
+ * - Args are emitted bare unless they contain whitespace, quotes, or
+ *   backslashes.
+ */
+export declare function buildHereyaShellCommand(binPath: string, args: string[]): string;
+/**
+ * Builds the value for git's `credential.helper` config when the helper
+ * is a shell command. Git requires a leading `!` for shell-command helpers.
+ */
+export declare function buildGitCredentialHelperValue(binPath: string, subcommand?: string): string;

package/dist/lib/shell.js

@@ -106,3 +106,58 @@ export function delay(ms) {
         setTimeout(resolve, ms);
     });
 }
+/**
+ * Quote a path-like token so it survives re-parsing by a POSIX shell or
+ * cmd.exe. Backslashes are normalized to forward slashes (Windows OpenSSH
+ * and Git for Windows' msys bash both accept forward-slash absolute paths
+ * like `C:/Users/…`). Embedded double quotes are escaped as `\"`.
+ */
+function quotePath(p) {
+    const normalized = p.replaceAll('\\', '/');
+    const escaped = normalized.replaceAll('"', String.raw `\"`);
+    return `"${escaped}"`;
+}
+/**
+ * Quote a plain CLI argument. Bare args stay bare unless they contain a
+ * space, a double quote, or a backslash — keeping the macOS/Linux output
+ * close to today's (e.g. `devenv ssh-proxy -w my-ws` stays bare).
+ */
+function quoteArg(arg) {
+    if (arg === '' || /[\s"\\]/.test(arg)) {
+        const escaped = arg.replaceAll('\\', String.raw `\\`).replaceAll('"', String.raw `\"`);
+        return `"${escaped}"`;
+    }
+    return arg;
+}
+/**
+ * Builds a shell-safe command string that invokes the hereya CLI. Suitable
+ * for embedding in git credential-helper config strings, SSH ProxyCommand
+ * lines, and anywhere else an external tool re-parses our command through
+ * a POSIX shell or cmd.exe.
+ *
+ * - If `binPath` ends in `.js`, prepend the absolute path of the current
+ *   Node executable (`process.execPath`) so the helper works without
+ *   depending on `.js` being executable.
+ * - Path-like tokens are normalized to forward slashes and wrapped in
+ *   double quotes to survive spaces and Windows backslashes.
+ * - Args are emitted bare unless they contain whitespace, quotes, or
+ *   backslashes.
+ */
+export function buildHereyaShellCommand(binPath, args) {
+    const tokens = [];
+    if (binPath.toLowerCase().endsWith('.js')) {
+        tokens.push(quotePath(process.execPath));
+    }
+    tokens.push(quotePath(binPath));
+    for (const arg of args) {
+        tokens.push(quoteArg(arg));
+    }
+    return tokens.join(' ');
+}
+/**
+ * Builds the value for git's `credential.helper` config when the helper
+ * is a shell command. Git requires a leading `!` for shell-command helpers.
+ */
+export function buildGitCredentialHelperValue(binPath, subcommand = 'credential-helper') {
+    return '!' + buildHereyaShellCommand(binPath, [subcommand]);
+}