hereya-cli 0.100.6 → 0.101.0

package/dist/lib/app-source.js

@@ -2,6 +2,19 @@ import { createHash, randomUUID } from 'node:crypto';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { gitUtils } from './git-utils.js';
+// DI seam for tests. Defaults to the real `simple-git` (loaded lazily so the
+// module stays cheap to import). Tests replace this via `setSimpleGitFactory`.
+let simpleGitFactory;
+export function setSimpleGitFactory(factory) {
+    simpleGitFactory = factory;
+}
+async function getSimpleGit() {
+    if (simpleGitFactory)
+        return simpleGitFactory;
+    const { simpleGit } = await import('simple-git');
+    return simpleGit;
+}
 /**
  * Clone an app's source repository (by repo URL + commit SHA) into a fresh
  * temp dir under ~/.hereya/downloads/<id>. Returns the rootDir path along
@@ -24,16 +37,40 @@ export const appSource = {
             }
         };
         try {
-            const { simpleGit } = await import('simple-git');
-            const git = simpleGit();
+            const simpleGit = await getSimpleGit();
             input.logger?.debug?.(`Cloning app source from ${input.repository}${input.commit ? `@${input.commit}` : ''} into ${rootDir}`);
-            if (input.commit) {
-                await git.clone(input.repository, rootDir, ['--no-checkout']);
-                const repoGit = simpleGit(rootDir);
-                await repoGit.checkout(input.commit);
+            if (input.auth?.password) {
+                // Authenticated clone through the hereya credential helper. We always
+                // do a full clone here (no shallow/no-checkout optimization) because
+                // the credential helper path uses a plain `git clone`; the optional
+                // commit checkout is performed afterwards.
+                input.logger?.debug?.('Using hereya credential helper for authenticated app-source clone');
+                const cloneResult = await gitUtils.cloneWithCredentialHelper({
+                    gitUrl: input.repository,
+                    hereyaBinPath: input.auth.hereyaBinPath,
+                    password: input.auth.password,
+                    targetDir: rootDir,
+                    username: input.auth.username,
+                });
+                if (!cloneResult.success) {
+                    throw new Error(cloneResult.reason);
+                }
+                if (input.commit) {
+                    const repoGit = simpleGit(rootDir);
+                    await repoGit.checkout(input.commit);
+                }
             }
             else {
-                await git.clone(input.repository, rootDir, ['--depth=1']);
+                // Unauthenticated clone (public-repo path).
+                const git = simpleGit();
+                if (input.commit) {
+                    await git.clone(input.repository, rootDir, ['--no-checkout']);
+                    const repoGit = simpleGit(rootDir);
+                    await repoGit.checkout(input.commit);
+                }
+                else {
+                    await git.clone(input.repository, rootDir, ['--depth=1']);
+                }
             }
             if (input.sha256) {
                 const repoGit = simpleGit(rootDir);

package/dist/lib/executor-start/execute-app-job.d.ts

@@ -1,4 +1,5 @@
 import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+import { LocalExecutor } from '../../executor/local.js';
 import { Logger } from '../../lib/log.js';
 export type AppJobResult = {
     reason: string;
@@ -10,4 +11,4 @@ export declare function executeAppJob(job: {
     id: string;
     payload: any;
     type: string;
-}, cloudBackend: CloudBackend, logger: Logger): Promise<AppJobResult>;
+}, cloudBackend: CloudBackend, logger: Logger, executor: LocalExecutor): Promise<AppJobResult>;

package/dist/lib/executor-start/execute-app-job.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import * as appSourceLib from '../../lib/app-source.js';
 import { shellUtils } from '../../lib/shell.js';
 import { sanitizeWorkspaceForFilename } from './format.js';
-export async function executeAppJob(job, cloudBackend, logger) {
+export async function executeAppJob(job, cloudBackend, logger, executor) {
     const isDeploy = job.type === 'app-deploy';
     const subcommand = isDeploy ? 'deploy' : 'destroy';
     const payload = job.payload;
@@ -17,7 +17,8 @@ export async function executeAppJob(job, cloudBackend, logger) {
     let cleanup;
     try {
         logger.info(`Downloading app source ${repository}${commit ? `@${commit}` : ''}...`);
-        const downloadResult = await appSourceLib.appSource.download({ commit, logger, repository, sha256 });
+        const auth = await resolveAppRepoCredentials({ appName, executor, logger, repository, workspace });
+        const downloadResult = await appSourceLib.appSource.download({ auth, commit, logger, repository, sha256 });
         cleanup = downloadResult.cleanup;
         const { rootDir } = downloadResult;
         await cloudBackend.updateAppDeployment({
@@ -74,6 +75,58 @@ export async function executeAppJob(job, cloudBackend, logger) {
         }
     }
 }
+/**
+ * Resolve git credentials for cloning the app's source repository, reusing the
+ * SAME hereya GitHub-App credential mechanism used for package/project clones.
+ *
+ * We build a synthetic git env map (`hereyaGitRemoteUrl` + a `github-app:`
+ * marker for the password) and run it through `executor.resolveEnvValues`,
+ * which:
+ *   1. reads the GitHub-App config (`hereyaGithubAppId`,
+ *      `hereyaGithubAppPrivateKey`, optional `hereyaGithubAppInstallationId`)
+ *      from the workspace env, and
+ *   2. mints an installation token scoped to the repo named by
+ *      `hereyaGitRemoteUrl`.
+ *
+ * If the GitHub-App config is not available (token not minted, marker left
+ * unresolved), we return `undefined` so the caller falls back to an
+ * unauthenticated clone (public-repo path preserved).
+ */
+async function resolveAppRepoCredentials(input) {
+    const { appName, executor, logger, repository, workspace } = input;
+    try {
+        const gitEnvToResolve = {
+            // Empty installation id => resolveGithubAppMarkers falls back to
+            // hereyaGithubAppInstallationId from the workspace env.
+            hereyaGitPassword: 'github-app:',
+            // Peer URL used to scope the minted installation token to this repo.
+            hereyaGitRemoteUrl: repository,
+            hereyaGitUsername: 'x-access-token',
+        };
+        // For apps, workspace env is keyed by the app name (see LocalExecutor.getWorkspaceEnv).
+        const resolved = await executor.resolveEnvValues({
+            env: gitEnvToResolve,
+            project: appName,
+            workspace,
+        });
+        const password = resolved.hereyaGitPassword;
+        // If the marker was left unresolved (no GitHub-App config available), the
+        // value still starts with `github-app:` — treat that as "no auth".
+        if (!password || password.startsWith('github-app:')) {
+            logger.debug?.('No hereya GitHub-App credentials resolved for app source; falling back to unauthenticated clone');
+            return undefined;
+        }
+        return {
+            hereyaBinPath: process.argv[1],
+            password,
+            username: resolved.hereyaGitUsername || 'x-access-token',
+        };
+    }
+    catch (error) {
+        logger.debug?.(`Failed to resolve hereya GitHub-App credentials for app source (${error?.message ?? error}); falling back to unauthenticated clone`);
+        return undefined;
+    }
+}
 async function runAppSubcommand(input) {
     const { appName, logger, paramFlags, rootDir, subcommand, versionFlags, workspace } = input;
     let runResult;

package/dist/lib/executor-start/job-dispatch.js

@@ -90,7 +90,7 @@ export async function dispatchJob(job, executor, cloudBackend, hooks) {
             return;
         }
         if (job.type === 'app-deploy' || job.type === 'app-destroy') {
-            const appJobResult = await executeAppJob(job, cloudBackend, logger);
+            const appJobResult = await executeAppJob(job, cloudBackend, logger, executor);
             await finalize(appJobResult, job.type);
             return;
         }