hereya-cli 0.86.3 → 0.88.0

package/dist/commands/run/index.js

@@ -2,8 +2,6 @@ import { Args, Command, Flags } from '@oclif/core';
 import { getBackend } from '../../backend/index.js';
 import { getConfigManager } from '../../lib/config/index.js';
 import { getEnvManager } from '../../lib/env/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../lib/log.js';
 import { getProfileFromWorkspace } from '../../lib/profile-utils.js';
 import { runShell } from '../../lib/shell.js';
 import { validateDevelopmentWorkspace } from '../../lib/workspace-validation.js';
@@ -21,10 +19,6 @@ export default class Run extends Command {
             description: 'directory to run command in',
             required: false,
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace to run the command in',
@@ -33,17 +27,6 @@ export default class Run extends Command {
     };
     static strict = false;
     async run() {
-        const { flags } = await this.parse(Run);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[run] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { args, argv, flags } = await this.parse(Run);
         const projectRootDir = flags.chdir || process.env.HEREYA_PROJECT_ROOT_DIR;
         const configManager = getConfigManager();

package/dist/commands/search/index.d.ts

@@ -9,9 +9,7 @@ export default class Search extends Command {
         chdir: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         limit: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
     private displayResults;
-    private runInner;
 }

package/dist/commands/search/index.js

@@ -1,8 +1,6 @@
 import { Args, Command, Flags } from '@oclif/core';
 import chalk from 'chalk';
 import { getBackend } from '../../backend/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../lib/log.js';
 export default class Search extends Command {
     static args = {
         query: Args.string({
@@ -32,44 +30,8 @@ export default class Search extends Command {
             default: 20,
             description: 'Maximum number of results to return',
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
     };
     async run() {
-        const { flags } = await this.parse(Search);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[search] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    displayResults(packages, hasMore) {
-        if (packages.length === 0) {
-            this.log(chalk.yellow('No packages found matching your query.'));
-            return;
-        }
-        this.log(`Found ${chalk.bold(packages.length)} package(s):`);
-        this.log();
-        for (const pkg of packages) {
-            const visibilityBadge = pkg.visibility === 'PUBLIC'
-                ? chalk.green('PUBLIC')
-                : chalk.yellow('PRIVATE');
-            this.log(`  ${chalk.cyan.bold(`${pkg.name}@${pkg.version}`)} ${visibilityBadge}`);
-            if (pkg.description) {
-                this.log(`    ${chalk.gray(pkg.description)}`);
-            }
-            this.log();
-        }
-        if (hasMore) {
-            this.log(chalk.dim('More results available. Use --limit to see more.'));
-        }
-    }
-    async runInner() {
         const { args, flags } = await this.parse(Search);
         // Change to specified directory
         if (flags.chdir !== '.') {
@@ -104,4 +66,25 @@ export default class Search extends Command {
             this.error(error instanceof Error ? error.message : 'Failed to search packages');
         }
     }
+    displayResults(packages, hasMore) {
+        if (packages.length === 0) {
+            this.log(chalk.yellow('No packages found matching your query.'));
+            return;
+        }
+        this.log(`Found ${chalk.bold(packages.length)} package(s):`);
+        this.log();
+        for (const pkg of packages) {
+            const visibilityBadge = pkg.visibility === 'PUBLIC'
+                ? chalk.green('PUBLIC')
+                : chalk.yellow('PRIVATE');
+            this.log(`  ${chalk.cyan.bold(`${pkg.name}@${pkg.version}`)} ${visibilityBadge}`);
+            if (pkg.description) {
+                this.log(`    ${chalk.gray(pkg.description)}`);
+            }
+            this.log();
+        }
+        if (hasMore) {
+            this.log(chalk.dim('More results available. Use --limit to see more.'));
+        }
+    }
 }

package/dist/commands/undeploy/index.d.ts

@@ -6,10 +6,8 @@ export default class Undeploy extends Command {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         local: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
     private undeployRemotely;
 }

package/dist/commands/undeploy/index.js

@@ -2,14 +2,13 @@ import { Command, Flags } from '@oclif/core';
 import { getRendererClass, Listr, ListrLogger, ListrLogLevels } from 'listr2';
 import path from 'node:path';
 import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+import { getCloudCredentials, loadBackendConfig } from '../../backend/config.js';
 import { getBackend } from '../../backend/index.js';
 import { getExecutor } from '../../executor/index.js';
-import { getActiveCloudAuth } from '../../lib/active-cloud.js';
 import { getConfigManager } from '../../lib/config/index.js';
 import { getEnvManager } from '../../lib/env/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
 import { gitUtils } from '../../lib/git-utils.js';
-import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
+import { getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
 import { getParameterManager } from '../../lib/parameter/index.js';
 import { getProfileFromWorkspace } from '../../lib/profile-utils.js';
 import { pollExecutorJob } from '../../lib/remote-job-utils.js';
@@ -36,10 +35,6 @@ export default class Undeploy extends Command {
             default: false,
             description: 'force local execution (skip remote executor)',
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace to undeploy the packages for',
@@ -47,17 +42,6 @@ export default class Undeploy extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(Undeploy);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[undeploy] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { flags } = await this.parse(Undeploy);
         setDebug(flags.debug);
         const projectRootDir = path.resolve(flags.chdir || process.env.HEREYA_PROJECT_ROOT_DIR || process.cwd());
@@ -338,18 +322,21 @@ See ${getLogPath()} for more details`);
             this.error(cleanCheck.reason);
         }
         myLogger.log(ListrLogLevels.STARTED, `Undeploying ${input.workspace} via remote executor (branch: ${input.gitBranch})`);
-        // 2. Resolve cloud auth (ephemeral --token first, then persisted creds)
-        // and build a CloudBackend for job submission + polling.
-        const auth = await getActiveCloudAuth();
-        if (!auth) {
-            this.error('Remote undeployment requires cloud backend. Run `hereya login` or pass `--token <token>`.');
+        // 2. Build CloudBackend for job submission + polling
+        const backendConfig = await loadBackendConfig();
+        if (!backendConfig.cloud) {
+            this.error('Remote undeployment requires cloud backend. Run `hereya login` first.');
+        }
+        const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
+        if (!credentials) {
+            this.error('Cloud credentials not found. Run `hereya login` first.');
         }
         const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
         const cloudBackend = new CloudBackend({
-            accessToken: auth.accessToken,
-            clientId: auth.clientId ?? '',
-            refreshToken: auth.refreshToken ?? '',
-            url: auth.cloudUrl,
+            accessToken: credentials.accessToken,
+            clientId: backendConfig.cloud.clientId,
+            refreshToken: credentials.refreshToken,
+            url: backendConfig.cloud.url,
         });
         // 3. Submit undeploy job
         const submitResult = await cloudBackend.submitExecutorJob({

package/dist/commands/up/index.d.ts

@@ -7,9 +7,7 @@ export default class Up extends Command {
         debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         deploy: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         select: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/up/index.js

@@ -4,8 +4,7 @@ import { getBackend } from '../../backend/index.js';
 import { getExecutorForWorkspace } from '../../executor/context.js';
 import { getConfigManager } from '../../lib/config/index.js';
 import { getEnvManager } from '../../lib/env/index.js';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
-import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
+import { getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
 import { getParameterManager } from '../../lib/parameter/index.js';
 import { getProfileFromWorkspace } from '../../lib/profile-utils.js';
 import { delay } from '../../lib/shell.js';
@@ -36,10 +35,6 @@ export default class Up extends Command {
             description: 'select the packages to provision',
             multiple: true,
         }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace to install the packages for',
@@ -47,17 +42,6 @@ export default class Up extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(Up);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[up] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { flags } = await this.parse(Up);
         setDebug(flags.debug);
         const projectRootDir = flags.chdir || process.env.HEREYA_PROJECT_ROOT_DIR;

package/dist/commands/workspace/executor/install/index.d.ts

@@ -4,9 +4,7 @@ export default class WorkspaceExecutorInstall extends Command {
     static flags: {
         debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/workspace/executor/install/index.js

@@ -3,8 +3,7 @@ import { Listr, ListrLogger, ListrLogLevels } from 'listr2';
 import { CloudBackend } from '../../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../../backend/index.js';
 import { getExecutor } from '../../../../executor/index.js';
-import { withEphemeralToken } from '../../../../lib/ephemeral-token.js';
-import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../../../lib/log.js';
+import { getLogger, getLogPath, isDebug, setDebug } from '../../../../lib/log.js';
 import { delay } from '../../../../lib/shell.js';
 const DEFAULT_EXECUTOR_PACKAGE = 'hereya/remote-executor-aws';
 export default class WorkspaceExecutorInstall extends Command {
@@ -12,10 +11,6 @@ export default class WorkspaceExecutorInstall extends Command {
     static flags = {
         debug: Flags.boolean({ default: false, description: 'enable debug mode' }),
         force: Flags.boolean({ char: 'f', default: false, description: 'force reinstall even if executor is already installed' }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace',
@@ -23,17 +18,6 @@ export default class WorkspaceExecutorInstall extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(WorkspaceExecutorInstall);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[workspace executor install] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { flags } = await this.parse(WorkspaceExecutorInstall);
         setDebug(flags.debug);
         const myLogger = new ListrLogger({ useIcons: false });

package/dist/commands/workspace/executor/token/index.d.ts

@@ -2,9 +2,7 @@ import { Command } from '@oclif/core';
 export default class WorkspaceExecutorToken extends Command {
     static description: string;
     static flags: {
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/workspace/executor/token/index.js

@@ -1,15 +1,9 @@
 import { Command, Flags } from '@oclif/core';
 import { CloudBackend } from '../../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../../backend/index.js';
-import { withEphemeralToken } from '../../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../../lib/log.js';
 export default class WorkspaceExecutorToken extends Command {
     static description = 'Generate a workspace-scoped executor token for the remote executor';
     static flags = {
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace',
@@ -17,17 +11,6 @@ export default class WorkspaceExecutorToken extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(WorkspaceExecutorToken);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[workspace executor token] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { flags } = await this.parse(WorkspaceExecutorToken);
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {

package/dist/commands/workspace/executor/uninstall/index.d.ts

@@ -3,9 +3,7 @@ export default class WorkspaceExecutorUninstall extends Command {
     static description: string;
     static flags: {
         debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/workspace/executor/uninstall/index.js

@@ -3,18 +3,13 @@ import { Listr, ListrLogger, ListrLogLevels } from 'listr2';
 import { CloudBackend } from '../../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../../backend/index.js';
 import { getExecutor } from '../../../../executor/index.js';
-import { withEphemeralToken } from '../../../../lib/ephemeral-token.js';
-import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../../../lib/log.js';
+import { getLogger, getLogPath, isDebug, setDebug } from '../../../../lib/log.js';
 import { delay } from '../../../../lib/shell.js';
 const DEFAULT_EXECUTOR_PACKAGE = 'hereya/remote-executor-aws';
 export default class WorkspaceExecutorUninstall extends Command {
     static description = 'Uninstall the remote executor from a workspace';
     static flags = {
         debug: Flags.boolean({ default: false, description: 'enable debug mode' }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace',
@@ -22,17 +17,6 @@ export default class WorkspaceExecutorUninstall extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(WorkspaceExecutorUninstall);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[workspace executor uninstall] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { flags } = await this.parse(WorkspaceExecutorUninstall);
         setDebug(flags.debug);
         const myLogger = new ListrLogger({ useIcons: false });

package/dist/executor/context.js

@@ -1,17 +1,16 @@
-import { getBackend } from '../backend/index.js';
-import { getActiveCloudAuth } from '../lib/active-cloud.js';
+import { getCloudCredentials, loadBackendConfig } from '../backend/config.js';
+import { BackendType, getBackend } from '../backend/index.js';
 import { resolveWorkspaceName } from '../lib/workspace-utils.js';
 import { getExecutor } from './index.js';
 export async function getExecutorForWorkspace(workspaceName, project) {
     if (!workspaceName) {
         return getExecutor();
     }
-    // Honors both `hereya login` (persisted on disk) and an in-scope
-    // ephemeral `--token`. Without this, `--token` invocations silently
-    // fell through to the local executor regardless of whether the
-    // workspace actually has a remote executor.
-    const auth = await getActiveCloudAuth();
-    if (!auth) {
+    const backendConfig = await loadBackendConfig();
+    if (backendConfig.current !== BackendType.Cloud) {
+        return getExecutor();
+    }
+    if (!backendConfig.cloud) {
         return getExecutor();
     }
     const resolvedName = resolveWorkspaceName(workspaceName, project);
@@ -24,12 +23,16 @@ export async function getExecutorForWorkspace(workspaceName, project) {
     if (!workspace.hasExecutor) {
         return getExecutor();
     }
+    const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
+    if (!credentials) {
+        return getExecutor();
+    }
     return getExecutor({
         cloudConfig: {
-            accessToken: auth.accessToken,
-            clientId: auth.clientId ?? '',
-            refreshToken: auth.refreshToken ?? '',
-            url: auth.cloudUrl,
+            accessToken: credentials.accessToken,
+            clientId: backendConfig.cloud.clientId,
+            refreshToken: credentials.refreshToken,
+            url: backendConfig.cloud.url,
         },
         workspace: resolvedName,
     });

package/dist/lib/hereya-token.js

@@ -1,21 +1,22 @@
-import { getActiveCloudAuth } from './active-cloud.js';
+import { getCloudCredentials, loadBackendConfig } from '../backend/config.js';
 export const hereyaTokenUtils = {
     async generateHereyaToken(description) {
-        // Honors both `hereya login` (persisted) and an in-scope ephemeral
-        // `--token`. Note: workspace-scoped CLI tokens (kind:"cli") are
-        // intentionally rejected by the cloud's /api/personal-tokens route —
-        // only user-level tokens can mint long-lived personal tokens.
-        const auth = await getActiveCloudAuth();
-        if (!auth) {
+        const backendConfig = await loadBackendConfig();
+        if (!backendConfig.cloud) {
+            return null;
+        }
+        const { clientId, url } = backendConfig.cloud;
+        const credentials = await getCloudCredentials(clientId);
+        if (!credentials) {
             return null;
         }
         const formData = new FormData();
         formData.append('description', description);
         formData.append('expiresInDays', '365');
-        const response = await fetch(`${auth.cloudUrl}/api/personal-tokens`, {
+        const response = await fetch(`${url}/api/personal-tokens`, {
             body: formData,
             headers: {
-                Authorization: `Bearer ${auth.accessToken}`,
+                Authorization: `Bearer ${credentials.accessToken}`,
             },
             method: 'POST',
         });
@@ -23,6 +24,6 @@ export const hereyaTokenUtils = {
             return null;
         }
         const result = await response.json();
-        return { cloudUrl: auth.cloudUrl, token: result.data.token };
+        return { cloudUrl: url, token: result.data.token };
     },
 };

package/dist/lib/package/index.js

@@ -1,9 +1,9 @@
 import * as yaml from 'yaml';
 import { z } from 'zod';
-import { getBackend } from '../../backend/index.js';
+import { getCurrentBackendType } from '../../backend/config.js';
+import { BackendType, getBackend } from '../../backend/index.js';
 import { IacType } from '../../iac/common.js';
 import { InfrastructureType } from '../../infrastructure/common.js';
-import { isCloudBackendActive } from '../active-cloud.js';
 import { CloudPackageManager } from './cloud.js';
 import { GitHubPackageManager } from './github.js';
 import { LocalPackageManager } from './local.js';
@@ -31,21 +31,23 @@ export async function resolvePackage(input) {
         return { found: false, reason: 'Invalid package format. Package name cannot contain dots (.) nor double dashes (--)' };
     }
     const isLocal = packageName.startsWith('local/');
-    // Try cloud first if not local and backend is cloud (or an ephemeral
-    // --token is in scope, which acts as Cloud regardless of on-disk config).
-    if (!isLocal && await isCloudBackendActive()) {
-        const result = await tryCloudResolution(input);
-        if (result.found) {
-            return result; // Success
+    // Try cloud first if not local and backend is cloud
+    if (!isLocal) {
+        const backendType = await getCurrentBackendType();
+        if (backendType === BackendType.Cloud) {
+            const result = await tryCloudResolution(input);
+            if (result.found) {
+                return result; // Success
+            }
+            // Failed - check if we should fallback to GitHub or return the error
+            if (!packageName.includes('/')) {
+                // Simple package names can't fallback to GitHub, return the detailed error
+                return result;
+            }
+            // For owner/repo format, we can fallback to GitHub
+            input.logger?.debug(`Package ${packageName} not found in registry, trying GitHub...`);
+            input.logger?.debug(`Registry error: ${result.reason}`);
         }
-        // Failed - check if we should fallback to GitHub or return the error
-        if (!packageName.includes('/')) {
-            // Simple package names can't fallback to GitHub, return the detailed error
-            return result;
-        }
-        // For owner/repo format, we can fallback to GitHub
-        input.logger?.debug(`Package ${packageName} not found in registry, trying GitHub...`);
-        input.logger?.debug(`Registry error: ${result.reason}`);
     }
     // Determine protocol for standard resolution
     const protocol = isLocal ? 'local' : '';
@@ -61,10 +63,12 @@ export async function downloadPackage(pkgUrl, destPath) {
     if (pkgUrl.startsWith('local/')) {
         protocol = 'local';
     }
-    else if (pkgUrl.includes('#') && await isCloudBackendActive()) {
-        // Registry package URLs contain commit SHA. Cloud branch fires when
-        // backend.yaml says Cloud OR an ephemeral --token is in scope.
-        protocol = 'cloud';
+    else if (pkgUrl.includes('#')) {
+        // Registry package URLs contain commit SHA
+        const backendType = await getCurrentBackendType();
+        if (backendType === BackendType.Cloud) {
+            protocol = 'cloud';
+        }
     }
     // Otherwise defaults to GitHub
     const packageManager = await getPackageManager(protocol);