hereya-cli 0.86.2 → 0.87.0

package/dist/commands/git/index.js

@@ -0,0 +1,116 @@
+import { Command, Flags } from '@oclif/core';
+import fs from 'node:fs';
+import path from 'node:path';
+import { withEphemeralToken } from '../../lib/ephemeral-token.js';
+import { gitUtils } from '../../lib/git-utils.js';
+import { getDefaultLogger } from '../../lib/log.js';
+import { shellUtils } from '../../lib/shell.js';
+export default class Git extends Command {
+    static description = 'Run an arbitrary git command with the hereya credential helper available. Wraps `git <args...>`, propagating an ephemeral `--token` to the credential-helper grandchild via `HEREYA_EPHEMERAL_TOKEN`. After a successful `clone`, also wires the cloned repo to use the hereya credential helper for future `push`/`pull`/`fetch` operations. Use `--` to separate hereya flags from git flags so e.g. `--depth` reaches git instead of being parsed by oclif.';
+    static examples = [
+        '<%= config.bin %> <%= command.id %> --token <token> -- push',
+        '<%= config.bin %> <%= command.id %> --token <token> -- pull --rebase',
+        '<%= config.bin %> <%= command.id %> --token <token> -- clone https://github.com/owner/repo my-dir',
+        '<%= config.bin %> <%= command.id %> -- log --oneline -10',
+    ];
+    static flags = {
+        chdir: Flags.string({
+            description: 'directory to run git in (cwd of the spawned git process)',
+            required: false,
+        }),
+        token: Flags.string({
+            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Propagated to the git credential-helper grandchild via the HEREYA_EPHEMERAL_TOKEN env var. Takes precedence over the HEREYA_TOKEN environment variable.',
+            required: false,
+        }),
+    };
+    static strict = false;
+    async run() {
+        const { argv, flags } = await this.parse(Git);
+        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
+        if (flags.token) {
+            if (process.env.HEREYA_TOKEN) {
+                getDefaultLogger().debug('[git] --token flag overrides HEREYA_TOKEN environment variable.');
+            }
+            return withEphemeralToken(flags.token, () => this.runInner(argv, flags));
+        }
+        return this.runInner(argv, flags);
+    }
+    async runInner(gitArgs, flags) {
+        if (gitArgs.length === 0) {
+            this.error('Missing git arguments. Example: `hereya git push --token <…>`.');
+        }
+        const cwd = path.resolve(flags.chdir ?? process.env.HEREYA_PROJECT_ROOT_DIR ?? process.cwd());
+        const result = await shellUtils.runShell('git', gitArgs, {
+            directory: cwd,
+            stdio: 'inherit',
+        });
+        if (result.status !== 0) {
+            this.error(`git ${gitArgs.join(' ')} failed (exit ${result.status})`);
+        }
+        // Auto-wire the credential helper after a successful clone so future
+        // git operations from inside the cloned repo find hereya's helper.
+        if (gitArgs[0] === 'clone') {
+            const target = deriveCloneTarget(gitArgs.slice(1), cwd);
+            if (target && fs.existsSync(path.join(target, '.git'))) {
+                try {
+                    await gitUtils.setupCredentialHelper({
+                        hereyaBinPath: process.argv[1],
+                        projectDir: target,
+                    });
+                }
+                catch (error) {
+                    // Don't fail the clone if the wire-up step fails — surface as warning.
+                    this.warn(`Cloned ${gitArgs.join(' ')} successfully, but failed to wire the hereya credential helper in ${target}: ${error.message}`);
+                }
+            }
+        }
+    }
+}
+/**
+ * Best-effort resolution of the directory `git clone` wrote to. Mirrors git's
+ * own behavior: if the user passed an explicit target, that's it; otherwise
+ * derive it from the URL's basename (stripping any trailing `.git`).
+ *
+ * Returns an absolute path or `null` if we can't tell.
+ */
+function deriveCloneTarget(cloneArgs, cwd) {
+    // Walk the args, skipping flag tokens (--xxx, -x) and their values.
+    // This is heuristic — git's flag schema is large — but it covers the
+    // common cases (`-c`, `--depth`, `--branch`, `--single-branch`, ...).
+    // If the heuristic is wrong, the existsSync(.git) check below will skip
+    // wire-up rather than touching the wrong directory.
+    const positional = [];
+    for (let i = 0; i < cloneArgs.length; i++) {
+        const a = cloneArgs[i];
+        if (a.startsWith('-')) {
+            // --flag=value: no separate value arg.
+            if (a.includes('='))
+                continue;
+            // -c key=value, --depth 1, etc.: skip the next arg as a value if it
+            // doesn't look like another flag.
+            if (i + 1 < cloneArgs.length && !cloneArgs[i + 1].startsWith('-')) {
+                i++;
+            }
+            continue;
+        }
+        positional.push(a);
+    }
+    // First positional is the URL; second (optional) is the target.
+    if (positional.length >= 2) {
+        return path.resolve(cwd, positional[1]);
+    }
+    if (positional.length === 1) {
+        const url = positional[0];
+        // Equivalent to Array.findLast(Boolean) but without requiring ES2023 lib.
+        const parts = url.replace(/\.git$/, '').split(/[/\\:]/);
+        let basename = '';
+        for (let i = parts.length - 1; i >= 0; i--) {
+            if (parts[i]) {
+                basename = parts[i];
+                break;
+            }
+        }
+        return basename ? path.resolve(cwd, basename) : null;
+    }
+    return null;
+}

package/dist/lib/ephemeral-token.d.ts

@@ -16,17 +16,24 @@ export interface EphemeralTokenContext {
 /**
  * Returns the active ephemeral token context, or `undefined` if no
  * `withEphemeralToken` scope is currently in flight.
+ *
+ * Falls back to the `HEREYA_EPHEMERAL_TOKEN` env var when no async-local-
+ * storage context is set — that's how subprocesses (the credential helper
+ * grandchild, etc.) inherit the ephemeral context across process
+ * boundaries. The env var is set automatically by `withEphemeralToken`.
  */
 export declare function getEphemeralToken(): EphemeralTokenContext | undefined;
 /**
  * Run `fn` inside an ephemeral-token scope. While `fn` is executing,
- * `getEphemeralToken()` returns the supplied token (and optional cloudUrl).
+ * `getEphemeralToken()` returns the supplied token (and optional cloudUrl),
+ * and `process.env.HEREYA_EPHEMERAL_TOKEN` is set so subprocesses inherit
+ * the same ephemeral context.
  *
  * Critical guarantees:
  * - The token is held in-memory only. It is NEVER passed to the secret
  *   manager or written to disk.
  * - After `fn` returns or throws, `getEphemeralToken()` returns `undefined`
- *   again.
+ *   again and `HEREYA_EPHEMERAL_TOKEN` is restored to its prior value.
  * - The cached backend in `src/backend/index.ts` is cleared before and after
  *   the scope so that a stale, persisted-credential-backed CloudBackend is
  *   never used while the scope is active, and the scope's in-memory backend

package/dist/lib/ephemeral-token.js

@@ -1,22 +1,52 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { clearBackend } from '../backend/index.js';
 const storage = new AsyncLocalStorage();
+/**
+ * Env-var names used to propagate the ephemeral token to **subprocesses**
+ * (e.g. the `git` invocation that triggers the `hereya credential-helper`
+ * grandchild). Async-local-storage doesn't cross process boundaries, so we
+ * also stash the token in the environment for the duration of the scope.
+ *
+ * These are deliberately named differently from `HEREYA_TOKEN` because the
+ * existing `HEREYA_TOKEN` semantics call `loginWithToken()` (exchange +
+ * keychain persist), which is exactly what ephemeral mode must NOT do.
+ */
+const EPHEMERAL_TOKEN_ENV = 'HEREYA_EPHEMERAL_TOKEN';
+const EPHEMERAL_CLOUD_URL_ENV = 'HEREYA_EPHEMERAL_CLOUD_URL';
 /**
  * Returns the active ephemeral token context, or `undefined` if no
  * `withEphemeralToken` scope is currently in flight.
+ *
+ * Falls back to the `HEREYA_EPHEMERAL_TOKEN` env var when no async-local-
+ * storage context is set — that's how subprocesses (the credential helper
+ * grandchild, etc.) inherit the ephemeral context across process
+ * boundaries. The env var is set automatically by `withEphemeralToken`.
  */
 export function getEphemeralToken() {
-    return storage.getStore();
+    const fromAsyncStorage = storage.getStore();
+    if (fromAsyncStorage) {
+        return fromAsyncStorage;
+    }
+    const fromEnv = process.env[EPHEMERAL_TOKEN_ENV];
+    if (fromEnv) {
+        return {
+            cloudUrl: process.env[EPHEMERAL_CLOUD_URL_ENV] || undefined,
+            token: fromEnv,
+        };
+    }
+    return undefined;
 }
 /**
  * Run `fn` inside an ephemeral-token scope. While `fn` is executing,
- * `getEphemeralToken()` returns the supplied token (and optional cloudUrl).
+ * `getEphemeralToken()` returns the supplied token (and optional cloudUrl),
+ * and `process.env.HEREYA_EPHEMERAL_TOKEN` is set so subprocesses inherit
+ * the same ephemeral context.
  *
  * Critical guarantees:
  * - The token is held in-memory only. It is NEVER passed to the secret
  *   manager or written to disk.
  * - After `fn` returns or throws, `getEphemeralToken()` returns `undefined`
- *   again.
+ *   again and `HEREYA_EPHEMERAL_TOKEN` is restored to its prior value.
  * - The cached backend in `src/backend/index.ts` is cleared before and after
  *   the scope so that a stale, persisted-credential-backed CloudBackend is
  *   never used while the scope is active, and the scope's in-memory backend
@@ -26,10 +56,33 @@ export function getEphemeralToken() {
 export async function withEphemeralToken(token, fn, options) {
     // Drop any cached backend so the next getBackend() call sees the ephemeral context.
     clearBackend();
+    // Snapshot existing env-var values so we can restore them on exit.
+    const priorTokenEnv = process.env[EPHEMERAL_TOKEN_ENV];
+    const priorCloudUrlEnv = process.env[EPHEMERAL_CLOUD_URL_ENV];
+    process.env[EPHEMERAL_TOKEN_ENV] = token;
+    if (options?.cloudUrl) {
+        process.env[EPHEMERAL_CLOUD_URL_ENV] = options.cloudUrl;
+    }
+    else {
+        delete process.env[EPHEMERAL_CLOUD_URL_ENV];
+    }
     try {
         return await storage.run({ cloudUrl: options?.cloudUrl, token }, fn);
     }
     finally {
+        // Restore prior env-var state (no leakage between sibling invocations).
+        if (priorTokenEnv === undefined) {
+            delete process.env[EPHEMERAL_TOKEN_ENV];
+        }
+        else {
+            process.env[EPHEMERAL_TOKEN_ENV] = priorTokenEnv;
+        }
+        if (priorCloudUrlEnv === undefined) {
+            delete process.env[EPHEMERAL_CLOUD_URL_ENV];
+        }
+        else {
+            process.env[EPHEMERAL_CLOUD_URL_ENV] = priorCloudUrlEnv;
+        }
         // Drop the in-memory backend bound to the ephemeral token before yielding control.
         clearBackend();
     }