hereya-cli 0.87.0 → 0.89.0

package/dist/commands/workspace/executor/token/index.js

@@ -1,15 +1,9 @@
 import { Command, Flags } from '@oclif/core';
 import { CloudBackend } from '../../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../../backend/index.js';
-import { withEphemeralToken } from '../../../../lib/ephemeral-token.js';
-import { getDefaultLogger } from '../../../../lib/log.js';
 export default class WorkspaceExecutorToken extends Command {
     static description = 'Generate a workspace-scoped executor token for the remote executor';
     static flags = {
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace',
@@ -17,17 +11,6 @@ export default class WorkspaceExecutorToken extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(WorkspaceExecutorToken);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[workspace executor token] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { flags } = await this.parse(WorkspaceExecutorToken);
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {

package/dist/commands/workspace/executor/uninstall/index.d.ts

@@ -3,9 +3,7 @@ export default class WorkspaceExecutorUninstall extends Command {
     static description: string;
     static flags: {
         debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private runInner;
 }

package/dist/commands/workspace/executor/uninstall/index.js

@@ -3,18 +3,13 @@ import { Listr, ListrLogger, ListrLogLevels } from 'listr2';
 import { CloudBackend } from '../../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../../backend/index.js';
 import { getExecutor } from '../../../../executor/index.js';
-import { withEphemeralToken } from '../../../../lib/ephemeral-token.js';
-import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../../../lib/log.js';
+import { getLogger, getLogPath, isDebug, setDebug } from '../../../../lib/log.js';
 import { delay } from '../../../../lib/shell.js';
 const DEFAULT_EXECUTOR_PACKAGE = 'hereya/remote-executor-aws';
 export default class WorkspaceExecutorUninstall extends Command {
     static description = 'Uninstall the remote executor from a workspace';
     static flags = {
         debug: Flags.boolean({ default: false, description: 'enable debug mode' }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace',
@@ -22,17 +17,6 @@ export default class WorkspaceExecutorUninstall extends Command {
         }),
     };
     async run() {
-        const { flags } = await this.parse(WorkspaceExecutorUninstall);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[workspace executor uninstall] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner());
-        }
-        return this.runInner();
-    }
-    async runInner() {
         const { flags } = await this.parse(WorkspaceExecutorUninstall);
         setDebug(flags.debug);
         const myLogger = new ListrLogger({ useIcons: false });

package/dist/executor/context.js

@@ -1,17 +1,16 @@
-import { getBackend } from '../backend/index.js';
-import { getActiveCloudAuth } from '../lib/active-cloud.js';
+import { getCloudCredentials, loadBackendConfig } from '../backend/config.js';
+import { BackendType, getBackend } from '../backend/index.js';
 import { resolveWorkspaceName } from '../lib/workspace-utils.js';
 import { getExecutor } from './index.js';
 export async function getExecutorForWorkspace(workspaceName, project) {
     if (!workspaceName) {
         return getExecutor();
     }
-    // Honors both `hereya login` (persisted on disk) and an in-scope
-    // ephemeral `--token`. Without this, `--token` invocations silently
-    // fell through to the local executor regardless of whether the
-    // workspace actually has a remote executor.
-    const auth = await getActiveCloudAuth();
-    if (!auth) {
+    const backendConfig = await loadBackendConfig();
+    if (backendConfig.current !== BackendType.Cloud) {
+        return getExecutor();
+    }
+    if (!backendConfig.cloud) {
         return getExecutor();
     }
     const resolvedName = resolveWorkspaceName(workspaceName, project);
@@ -24,12 +23,16 @@ export async function getExecutorForWorkspace(workspaceName, project) {
     if (!workspace.hasExecutor) {
         return getExecutor();
     }
+    const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
+    if (!credentials) {
+        return getExecutor();
+    }
     return getExecutor({
         cloudConfig: {
-            accessToken: auth.accessToken,
-            clientId: auth.clientId ?? '',
-            refreshToken: auth.refreshToken ?? '',
-            url: auth.cloudUrl,
+            accessToken: credentials.accessToken,
+            clientId: backendConfig.cloud.clientId,
+            refreshToken: credentials.refreshToken,
+            url: backendConfig.cloud.url,
         },
         workspace: resolvedName,
     });

package/dist/lib/clone-and-configure.d.ts

@@ -0,0 +1,43 @@
+import { ListrTask } from 'listr2';
+export interface CloneAndConfigureCtx {
+    resolvedGitEnv: Record<string, string>;
+}
+export interface CloneAndConfigureProjectInput<Ctx extends CloneAndConfigureCtx = CloneAndConfigureCtx> {
+    /**
+     * Returns the env map that should be inspected for `hereyaGit*` markers.
+     * Called when the "Resolving git credentials" task runs, so callers can
+     * read up-to-date values from the Listr context (e.g. `ctx.prefixedEnv`)
+     * after earlier tasks have populated it.
+     */
+    getEnv(ctx: Ctx): Promise<Record<string, string>> | Record<string, string>;
+    /**
+     * Project name to use for env resolution / config persistence / state save.
+     * Can be a value or a callback that reads it from ctx (useful when the
+     * canonical name comes from a previous task, e.g. `ctx.initOutput.project.name`).
+     */
+    getProject(ctx: Ctx): Promise<string> | string;
+    /**
+     * Workspace name to use for env resolution / config persistence / state save.
+     */
+    getWorkspace(ctx: Ctx): Promise<string> | string;
+    hereyaBinPath: string;
+    /**
+     * Optional override for the error thrown when `hereyaGitRemoteUrl` is missing
+     * from the resolved git env. Lets call sites surface a flow-specific message
+     * (e.g. "Template did not provide hereyaGitRemoteUrl").
+     */
+    missingRemoteUrlError?: string;
+    targetDir: string;
+}
+/**
+ * Returns Listr tasks that:
+ *  1. Filter `hereyaGit*` env vars (from a caller-supplied env map) and resolve
+ *     them via the workspace executor (this exercises the github-app marker path).
+ *  2. Clone the repository using the resolved git credentials and the hereya
+ *     credential helper.
+ *  3. Persist the local hereya.yaml, set up the credential helper for the
+ *     cloned repo, and save the project state on the cloud backend.
+ *
+ * Used by both `hereya init` (template flow) and `hereya import-repo --clone`.
+ */
+export declare function cloneAndConfigureProjectTasks<Ctx extends CloneAndConfigureCtx = CloneAndConfigureCtx>(input: CloneAndConfigureProjectInput<Ctx>): ListrTask<Ctx>[];

package/dist/lib/clone-and-configure.js

@@ -0,0 +1,77 @@
+import { getBackend } from '../backend/index.js';
+import { getExecutorForWorkspace } from '../executor/context.js';
+import { getConfigManager } from './config/index.js';
+import { gitUtils } from './git-utils.js';
+/**
+ * Returns Listr tasks that:
+ *  1. Filter `hereyaGit*` env vars (from a caller-supplied env map) and resolve
+ *     them via the workspace executor (this exercises the github-app marker path).
+ *  2. Clone the repository using the resolved git credentials and the hereya
+ *     credential helper.
+ *  3. Persist the local hereya.yaml, set up the credential helper for the
+ *     cloned repo, and save the project state on the cloud backend.
+ *
+ * Used by both `hereya init` (template flow) and `hereya import-repo --clone`.
+ */
+export function cloneAndConfigureProjectTasks(input) {
+    const { getEnv, getProject, getWorkspace, hereyaBinPath, missingRemoteUrlError, targetDir } = input;
+    return [
+        {
+            async task(ctx) {
+                const env = await getEnv(ctx);
+                const project = await getProject(ctx);
+                const workspace = await getWorkspace(ctx);
+                const gitEnvToResolve = {};
+                for (const [key, value] of Object.entries(env || {})) {
+                    if (key.startsWith('hereyaGit'))
+                        gitEnvToResolve[key] = value;
+                }
+                const executor$ = await getExecutorForWorkspace(workspace);
+                if (!executor$.success)
+                    throw new Error(executor$.reason);
+                ctx.resolvedGitEnv = await executor$.executor.resolveEnvValues({
+                    env: gitEnvToResolve,
+                    project,
+                    workspace,
+                });
+                if (!ctx.resolvedGitEnv.hereyaGitRemoteUrl) {
+                    throw new Error(missingRemoteUrlError
+                        ?? 'Project metadata does not contain hereyaGitRemoteUrl.');
+                }
+            },
+            title: 'Resolving git credentials',
+        },
+        {
+            async task(ctx) {
+                const cloneResult = await gitUtils.cloneWithCredentialHelper({
+                    gitUrl: ctx.resolvedGitEnv.hereyaGitRemoteUrl,
+                    hereyaBinPath,
+                    password: ctx.resolvedGitEnv.hereyaGitPassword,
+                    targetDir,
+                    username: ctx.resolvedGitEnv.hereyaGitUsername,
+                });
+                if (!cloneResult.success)
+                    throw new Error(cloneResult.reason);
+            },
+            title: 'Cloning project repository',
+        },
+        {
+            async task(ctx) {
+                const project = await getProject(ctx);
+                const workspace = await getWorkspace(ctx);
+                const configManager = getConfigManager();
+                const existing = await configManager.loadConfig({ projectRootDir: targetDir });
+                const config = {
+                    ...(existing.found ? existing.config : {}),
+                    project,
+                    workspace,
+                };
+                await configManager.saveConfig({ config, projectRootDir: targetDir });
+                await gitUtils.setupCredentialHelper({ hereyaBinPath, projectDir: targetDir });
+                const backend = await getBackend();
+                await backend.saveState(config, workspace);
+            },
+            title: 'Setting up project',
+        },
+    ];
+}

package/dist/lib/hereya-token.js

@@ -1,21 +1,22 @@
-import { getActiveCloudAuth } from './active-cloud.js';
+import { getCloudCredentials, loadBackendConfig } from '../backend/config.js';
 export const hereyaTokenUtils = {
     async generateHereyaToken(description) {
-        // Honors both `hereya login` (persisted) and an in-scope ephemeral
-        // `--token`. Note: workspace-scoped CLI tokens (kind:"cli") are
-        // intentionally rejected by the cloud's /api/personal-tokens route —
-        // only user-level tokens can mint long-lived personal tokens.
-        const auth = await getActiveCloudAuth();
-        if (!auth) {
+        const backendConfig = await loadBackendConfig();
+        if (!backendConfig.cloud) {
+            return null;
+        }
+        const { clientId, url } = backendConfig.cloud;
+        const credentials = await getCloudCredentials(clientId);
+        if (!credentials) {
             return null;
         }
         const formData = new FormData();
         formData.append('description', description);
         formData.append('expiresInDays', '365');
-        const response = await fetch(`${auth.cloudUrl}/api/personal-tokens`, {
+        const response = await fetch(`${url}/api/personal-tokens`, {
             body: formData,
             headers: {
-                Authorization: `Bearer ${auth.accessToken}`,
+                Authorization: `Bearer ${credentials.accessToken}`,
             },
             method: 'POST',
         });
@@ -23,6 +24,6 @@ export const hereyaTokenUtils = {
             return null;
         }
         const result = await response.json();
-        return { cloudUrl: auth.cloudUrl, token: result.data.token };
+        return { cloudUrl: url, token: result.data.token };
     },
 };

package/dist/lib/package/index.js

@@ -1,9 +1,9 @@
 import * as yaml from 'yaml';
 import { z } from 'zod';
-import { getBackend } from '../../backend/index.js';
+import { getCurrentBackendType } from '../../backend/config.js';
+import { BackendType, getBackend } from '../../backend/index.js';
 import { IacType } from '../../iac/common.js';
 import { InfrastructureType } from '../../infrastructure/common.js';
-import { isCloudBackendActive } from '../active-cloud.js';
 import { CloudPackageManager } from './cloud.js';
 import { GitHubPackageManager } from './github.js';
 import { LocalPackageManager } from './local.js';
@@ -31,21 +31,23 @@ export async function resolvePackage(input) {
         return { found: false, reason: 'Invalid package format. Package name cannot contain dots (.) nor double dashes (--)' };
     }
     const isLocal = packageName.startsWith('local/');
-    // Try cloud first if not local and backend is cloud (or an ephemeral
-    // --token is in scope, which acts as Cloud regardless of on-disk config).
-    if (!isLocal && await isCloudBackendActive()) {
-        const result = await tryCloudResolution(input);
-        if (result.found) {
-            return result; // Success
+    // Try cloud first if not local and backend is cloud
+    if (!isLocal) {
+        const backendType = await getCurrentBackendType();
+        if (backendType === BackendType.Cloud) {
+            const result = await tryCloudResolution(input);
+            if (result.found) {
+                return result; // Success
+            }
+            // Failed - check if we should fallback to GitHub or return the error
+            if (!packageName.includes('/')) {
+                // Simple package names can't fallback to GitHub, return the detailed error
+                return result;
+            }
+            // For owner/repo format, we can fallback to GitHub
+            input.logger?.debug(`Package ${packageName} not found in registry, trying GitHub...`);
+            input.logger?.debug(`Registry error: ${result.reason}`);
         }
-        // Failed - check if we should fallback to GitHub or return the error
-        if (!packageName.includes('/')) {
-            // Simple package names can't fallback to GitHub, return the detailed error
-            return result;
-        }
-        // For owner/repo format, we can fallback to GitHub
-        input.logger?.debug(`Package ${packageName} not found in registry, trying GitHub...`);
-        input.logger?.debug(`Registry error: ${result.reason}`);
     }
     // Determine protocol for standard resolution
     const protocol = isLocal ? 'local' : '';
@@ -61,10 +63,12 @@ export async function downloadPackage(pkgUrl, destPath) {
     if (pkgUrl.startsWith('local/')) {
         protocol = 'local';
     }
-    else if (pkgUrl.includes('#') && await isCloudBackendActive()) {
-        // Registry package URLs contain commit SHA. Cloud branch fires when
-        // backend.yaml says Cloud OR an ephemeral --token is in scope.
-        protocol = 'cloud';
+    else if (pkgUrl.includes('#')) {
+        // Registry package URLs contain commit SHA
+        const backendType = await getCurrentBackendType();
+        if (backendType === BackendType.Cloud) {
+            protocol = 'cloud';
+        }
     }
     // Otherwise defaults to GitHub
     const packageManager = await getPackageManager(protocol);