hereya-cli 0.86.2 → 0.86.3

package/dist/lib/ephemeral-token.js

@@ -1,22 +1,52 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { clearBackend } from '../backend/index.js';
 const storage = new AsyncLocalStorage();
+/**
+ * Env-var names used to propagate the ephemeral token to **subprocesses**
+ * (e.g. the `git` invocation that triggers the `hereya credential-helper`
+ * grandchild). Async-local-storage doesn't cross process boundaries, so we
+ * also stash the token in the environment for the duration of the scope.
+ *
+ * These are deliberately named differently from `HEREYA_TOKEN` because the
+ * existing `HEREYA_TOKEN` semantics call `loginWithToken()` (exchange +
+ * keychain persist), which is exactly what ephemeral mode must NOT do.
+ */
+const EPHEMERAL_TOKEN_ENV = 'HEREYA_EPHEMERAL_TOKEN';
+const EPHEMERAL_CLOUD_URL_ENV = 'HEREYA_EPHEMERAL_CLOUD_URL';
 /**
  * Returns the active ephemeral token context, or `undefined` if no
  * `withEphemeralToken` scope is currently in flight.
+ *
+ * Falls back to the `HEREYA_EPHEMERAL_TOKEN` env var when no async-local-
+ * storage context is set — that's how subprocesses (the credential helper
+ * grandchild, etc.) inherit the ephemeral context across process
+ * boundaries. The env var is set automatically by `withEphemeralToken`.
  */
 export function getEphemeralToken() {
-    return storage.getStore();
+    const fromAsyncStorage = storage.getStore();
+    if (fromAsyncStorage) {
+        return fromAsyncStorage;
+    }
+    const fromEnv = process.env[EPHEMERAL_TOKEN_ENV];
+    if (fromEnv) {
+        return {
+            cloudUrl: process.env[EPHEMERAL_CLOUD_URL_ENV] || undefined,
+            token: fromEnv,
+        };
+    }
+    return undefined;
 }
 /**
  * Run `fn` inside an ephemeral-token scope. While `fn` is executing,
- * `getEphemeralToken()` returns the supplied token (and optional cloudUrl).
+ * `getEphemeralToken()` returns the supplied token (and optional cloudUrl),
+ * and `process.env.HEREYA_EPHEMERAL_TOKEN` is set so subprocesses inherit
+ * the same ephemeral context.
  *
  * Critical guarantees:
  * - The token is held in-memory only. It is NEVER passed to the secret
  *   manager or written to disk.
  * - After `fn` returns or throws, `getEphemeralToken()` returns `undefined`
- *   again.
+ *   again and `HEREYA_EPHEMERAL_TOKEN` is restored to its prior value.
  * - The cached backend in `src/backend/index.ts` is cleared before and after
  *   the scope so that a stale, persisted-credential-backed CloudBackend is
  *   never used while the scope is active, and the scope's in-memory backend
@@ -26,10 +56,33 @@ export function getEphemeralToken() {
 export async function withEphemeralToken(token, fn, options) {
     // Drop any cached backend so the next getBackend() call sees the ephemeral context.
     clearBackend();
+    // Snapshot existing env-var values so we can restore them on exit.
+    const priorTokenEnv = process.env[EPHEMERAL_TOKEN_ENV];
+    const priorCloudUrlEnv = process.env[EPHEMERAL_CLOUD_URL_ENV];
+    process.env[EPHEMERAL_TOKEN_ENV] = token;
+    if (options?.cloudUrl) {
+        process.env[EPHEMERAL_CLOUD_URL_ENV] = options.cloudUrl;
+    }
+    else {
+        delete process.env[EPHEMERAL_CLOUD_URL_ENV];
+    }
     try {
         return await storage.run({ cloudUrl: options?.cloudUrl, token }, fn);
     }
     finally {
+        // Restore prior env-var state (no leakage between sibling invocations).
+        if (priorTokenEnv === undefined) {
+            delete process.env[EPHEMERAL_TOKEN_ENV];
+        }
+        else {
+            process.env[EPHEMERAL_TOKEN_ENV] = priorTokenEnv;
+        }
+        if (priorCloudUrlEnv === undefined) {
+            delete process.env[EPHEMERAL_CLOUD_URL_ENV];
+        }
+        else {
+            process.env[EPHEMERAL_CLOUD_URL_ENV] = priorCloudUrlEnv;
+        }
         // Drop the in-memory backend bound to the ephemeral token before yielding control.
         clearBackend();
     }