hereya-cli 0.87.0 → 0.89.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hereya-cli",
   "description": "Infrastructure as Package",
-  "version": "0.87.0",
+  "version": "0.89.0",
   "author": "Hereya Developers",
   "bin": {
     "hereya": "./bin/run.js"

package/dist/commands/git/index.d.ts

@@ -1,12 +0,0 @@
-import { Command } from '@oclif/core';
-export default class Git extends Command {
-    static description: string;
-    static examples: string[];
-    static flags: {
-        chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-    };
-    static strict: boolean;
-    run(): Promise<void>;
-    private runInner;
-}

package/dist/commands/git/index.js

@@ -1,116 +0,0 @@
-import { Command, Flags } from '@oclif/core';
-import fs from 'node:fs';
-import path from 'node:path';
-import { withEphemeralToken } from '../../lib/ephemeral-token.js';
-import { gitUtils } from '../../lib/git-utils.js';
-import { getDefaultLogger } from '../../lib/log.js';
-import { shellUtils } from '../../lib/shell.js';
-export default class Git extends Command {
-    static description = 'Run an arbitrary git command with the hereya credential helper available. Wraps `git <args...>`, propagating an ephemeral `--token` to the credential-helper grandchild via `HEREYA_EPHEMERAL_TOKEN`. After a successful `clone`, also wires the cloned repo to use the hereya credential helper for future `push`/`pull`/`fetch` operations. Use `--` to separate hereya flags from git flags so e.g. `--depth` reaches git instead of being parsed by oclif.';
-    static examples = [
-        '<%= config.bin %> <%= command.id %> --token <token> -- push',
-        '<%= config.bin %> <%= command.id %> --token <token> -- pull --rebase',
-        '<%= config.bin %> <%= command.id %> --token <token> -- clone https://github.com/owner/repo my-dir',
-        '<%= config.bin %> <%= command.id %> -- log --oneline -10',
-    ];
-    static flags = {
-        chdir: Flags.string({
-            description: 'directory to run git in (cwd of the spawned git process)',
-            required: false,
-        }),
-        token: Flags.string({
-            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Propagated to the git credential-helper grandchild via the HEREYA_EPHEMERAL_TOKEN env var. Takes precedence over the HEREYA_TOKEN environment variable.',
-            required: false,
-        }),
-    };
-    static strict = false;
-    async run() {
-        const { argv, flags } = await this.parse(Git);
-        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
-        if (flags.token) {
-            if (process.env.HEREYA_TOKEN) {
-                getDefaultLogger().debug('[git] --token flag overrides HEREYA_TOKEN environment variable.');
-            }
-            return withEphemeralToken(flags.token, () => this.runInner(argv, flags));
-        }
-        return this.runInner(argv, flags);
-    }
-    async runInner(gitArgs, flags) {
-        if (gitArgs.length === 0) {
-            this.error('Missing git arguments. Example: `hereya git push --token <…>`.');
-        }
-        const cwd = path.resolve(flags.chdir ?? process.env.HEREYA_PROJECT_ROOT_DIR ?? process.cwd());
-        const result = await shellUtils.runShell('git', gitArgs, {
-            directory: cwd,
-            stdio: 'inherit',
-        });
-        if (result.status !== 0) {
-            this.error(`git ${gitArgs.join(' ')} failed (exit ${result.status})`);
-        }
-        // Auto-wire the credential helper after a successful clone so future
-        // git operations from inside the cloned repo find hereya's helper.
-        if (gitArgs[0] === 'clone') {
-            const target = deriveCloneTarget(gitArgs.slice(1), cwd);
-            if (target && fs.existsSync(path.join(target, '.git'))) {
-                try {
-                    await gitUtils.setupCredentialHelper({
-                        hereyaBinPath: process.argv[1],
-                        projectDir: target,
-                    });
-                }
-                catch (error) {
-                    // Don't fail the clone if the wire-up step fails — surface as warning.
-                    this.warn(`Cloned ${gitArgs.join(' ')} successfully, but failed to wire the hereya credential helper in ${target}: ${error.message}`);
-                }
-            }
-        }
-    }
-}
-/**
- * Best-effort resolution of the directory `git clone` wrote to. Mirrors git's
- * own behavior: if the user passed an explicit target, that's it; otherwise
- * derive it from the URL's basename (stripping any trailing `.git`).
- *
- * Returns an absolute path or `null` if we can't tell.
- */
-function deriveCloneTarget(cloneArgs, cwd) {
-    // Walk the args, skipping flag tokens (--xxx, -x) and their values.
-    // This is heuristic — git's flag schema is large — but it covers the
-    // common cases (`-c`, `--depth`, `--branch`, `--single-branch`, ...).
-    // If the heuristic is wrong, the existsSync(.git) check below will skip
-    // wire-up rather than touching the wrong directory.
-    const positional = [];
-    for (let i = 0; i < cloneArgs.length; i++) {
-        const a = cloneArgs[i];
-        if (a.startsWith('-')) {
-            // --flag=value: no separate value arg.
-            if (a.includes('='))
-                continue;
-            // -c key=value, --depth 1, etc.: skip the next arg as a value if it
-            // doesn't look like another flag.
-            if (i + 1 < cloneArgs.length && !cloneArgs[i + 1].startsWith('-')) {
-                i++;
-            }
-            continue;
-        }
-        positional.push(a);
-    }
-    // First positional is the URL; second (optional) is the target.
-    if (positional.length >= 2) {
-        return path.resolve(cwd, positional[1]);
-    }
-    if (positional.length === 1) {
-        const url = positional[0];
-        // Equivalent to Array.findLast(Boolean) but without requiring ES2023 lib.
-        const parts = url.replace(/\.git$/, '').split(/[/\\:]/);
-        let basename = '';
-        for (let i = parts.length - 1; i >= 0; i--) {
-            if (parts[i]) {
-                basename = parts[i];
-                break;
-            }
-        }
-        return basename ? path.resolve(cwd, basename) : null;
-    }
-    return null;
-}

package/dist/lib/active-cloud.d.ts

@@ -1,31 +0,0 @@
-/**
- * The active cloud auth credentials for this CLI invocation.
- *
- * Either sourced from an ephemeral `--token` (in which case `clientId` and
- * `refreshToken` are `null` because there is no persisted client identity
- * and the token cannot be refreshed) or from the persisted `backend.yaml`
- * + keychain credentials.
- */
-export interface ActiveCloudAuth {
-    accessToken: string;
-    clientId: null | string;
-    cloudUrl: string;
-    refreshToken: null | string;
-}
-/**
- * Returns the active cloud auth, preferring an in-scope ephemeral `--token`
- * over the persisted `backend.yaml` + keychain credentials. Returns `null`
- * when neither is available.
- *
- * **This is the single source of truth for "are we authenticated to
- * hereya-cloud right now?"** — every code path that previously read from
- * `loadBackendConfig()` + `getCloudCredentials()` directly (and therefore
- * silently ignored an ephemeral `--token`) should call this instead.
- */
-export declare function getActiveCloudAuth(): Promise<ActiveCloudAuth | null>;
-/**
- * Whether the cloud backend is "active" — either via `hereya login` or via
- * an in-scope ephemeral `--token`. Used to decide whether to consult the
- * cloud package registry, the remote executor, etc.
- */
-export declare function isCloudBackendActive(): Promise<boolean>;

package/dist/lib/active-cloud.js

@@ -1,55 +0,0 @@
-import { getCloudCredentials, loadBackendConfig } from '../backend/config.js';
-import { BackendType } from '../backend/index.js';
-import { getEphemeralToken } from './ephemeral-token.js';
-const DEFAULT_CLOUD_URL = 'https://cloud.hereya.dev';
-/**
- * Returns the active cloud auth, preferring an in-scope ephemeral `--token`
- * over the persisted `backend.yaml` + keychain credentials. Returns `null`
- * when neither is available.
- *
- * **This is the single source of truth for "are we authenticated to
- * hereya-cloud right now?"** — every code path that previously read from
- * `loadBackendConfig()` + `getCloudCredentials()` directly (and therefore
- * silently ignored an ephemeral `--token`) should call this instead.
- */
-export async function getActiveCloudAuth() {
-    const ephemeral = getEphemeralToken();
-    if (ephemeral) {
-        const cloudUrl = ephemeral.cloudUrl
-            ?? process.env.HEREYA_CLOUD_URL
-            ?? (await loadBackendConfig()).cloud?.url
-            ?? DEFAULT_CLOUD_URL;
-        return {
-            accessToken: ephemeral.token,
-            clientId: null,
-            cloudUrl,
-            refreshToken: null,
-        };
-    }
-    const config = await loadBackendConfig();
-    if (config.current !== BackendType.Cloud || !config.cloud) {
-        return null;
-    }
-    const credentials = await getCloudCredentials(config.cloud.clientId);
-    if (!credentials) {
-        return null;
-    }
-    return {
-        accessToken: credentials.accessToken,
-        clientId: config.cloud.clientId,
-        cloudUrl: config.cloud.url,
-        refreshToken: credentials.refreshToken,
-    };
-}
-/**
- * Whether the cloud backend is "active" — either via `hereya login` or via
- * an in-scope ephemeral `--token`. Used to decide whether to consult the
- * cloud package registry, the remote executor, etc.
- */
-export async function isCloudBackendActive() {
-    if (getEphemeralToken()) {
-        return true;
-    }
-    const config = await loadBackendConfig();
-    return config.current === BackendType.Cloud;
-}

package/dist/lib/ephemeral-token.d.ts

@@ -1,45 +0,0 @@
-/**
- * In-memory context for an ephemeral, in-memory-only access token.
- *
- * This is used to support per-invocation tokens (e.g. minted by a separate
- * MCP server) without persisting credentials to the user's keychain or
- * `~/.hereya/secrets/`. Code that needs to read the active token (e.g. the
- * cloud backend factory in `src/backend/index.ts`) calls
- * {@link getEphemeralToken} and uses it directly as the bearer for outgoing
- * cloud API calls. No exchange via `loginWithToken` happens — that path is
- * intentionally avoided because it would mint a long-lived refresh token.
- */
-export interface EphemeralTokenContext {
-    cloudUrl?: string;
-    token: string;
-}
-/**
- * Returns the active ephemeral token context, or `undefined` if no
- * `withEphemeralToken` scope is currently in flight.
- *
- * Falls back to the `HEREYA_EPHEMERAL_TOKEN` env var when no async-local-
- * storage context is set — that's how subprocesses (the credential helper
- * grandchild, etc.) inherit the ephemeral context across process
- * boundaries. The env var is set automatically by `withEphemeralToken`.
- */
-export declare function getEphemeralToken(): EphemeralTokenContext | undefined;
-/**
- * Run `fn` inside an ephemeral-token scope. While `fn` is executing,
- * `getEphemeralToken()` returns the supplied token (and optional cloudUrl),
- * and `process.env.HEREYA_EPHEMERAL_TOKEN` is set so subprocesses inherit
- * the same ephemeral context.
- *
- * Critical guarantees:
- * - The token is held in-memory only. It is NEVER passed to the secret
- *   manager or written to disk.
- * - After `fn` returns or throws, `getEphemeralToken()` returns `undefined`
- *   again and `HEREYA_EPHEMERAL_TOKEN` is restored to its prior value.
- * - The cached backend in `src/backend/index.ts` is cleared before and after
- *   the scope so that a stale, persisted-credential-backed CloudBackend is
- *   never used while the scope is active, and the scope's in-memory backend
- *   does not leak to subsequent code that expected the user's regular
- *   credentials.
- */
-export declare function withEphemeralToken<T>(token: string, fn: () => Promise<T>, options?: {
-    cloudUrl?: string;
-}): Promise<T>;

package/dist/lib/ephemeral-token.js

@@ -1,89 +0,0 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-import { clearBackend } from '../backend/index.js';
-const storage = new AsyncLocalStorage();
-/**
- * Env-var names used to propagate the ephemeral token to **subprocesses**
- * (e.g. the `git` invocation that triggers the `hereya credential-helper`
- * grandchild). Async-local-storage doesn't cross process boundaries, so we
- * also stash the token in the environment for the duration of the scope.
- *
- * These are deliberately named differently from `HEREYA_TOKEN` because the
- * existing `HEREYA_TOKEN` semantics call `loginWithToken()` (exchange +
- * keychain persist), which is exactly what ephemeral mode must NOT do.
- */
-const EPHEMERAL_TOKEN_ENV = 'HEREYA_EPHEMERAL_TOKEN';
-const EPHEMERAL_CLOUD_URL_ENV = 'HEREYA_EPHEMERAL_CLOUD_URL';
-/**
- * Returns the active ephemeral token context, or `undefined` if no
- * `withEphemeralToken` scope is currently in flight.
- *
- * Falls back to the `HEREYA_EPHEMERAL_TOKEN` env var when no async-local-
- * storage context is set — that's how subprocesses (the credential helper
- * grandchild, etc.) inherit the ephemeral context across process
- * boundaries. The env var is set automatically by `withEphemeralToken`.
- */
-export function getEphemeralToken() {
-    const fromAsyncStorage = storage.getStore();
-    if (fromAsyncStorage) {
-        return fromAsyncStorage;
-    }
-    const fromEnv = process.env[EPHEMERAL_TOKEN_ENV];
-    if (fromEnv) {
-        return {
-            cloudUrl: process.env[EPHEMERAL_CLOUD_URL_ENV] || undefined,
-            token: fromEnv,
-        };
-    }
-    return undefined;
-}
-/**
- * Run `fn` inside an ephemeral-token scope. While `fn` is executing,
- * `getEphemeralToken()` returns the supplied token (and optional cloudUrl),
- * and `process.env.HEREYA_EPHEMERAL_TOKEN` is set so subprocesses inherit
- * the same ephemeral context.
- *
- * Critical guarantees:
- * - The token is held in-memory only. It is NEVER passed to the secret
- *   manager or written to disk.
- * - After `fn` returns or throws, `getEphemeralToken()` returns `undefined`
- *   again and `HEREYA_EPHEMERAL_TOKEN` is restored to its prior value.
- * - The cached backend in `src/backend/index.ts` is cleared before and after
- *   the scope so that a stale, persisted-credential-backed CloudBackend is
- *   never used while the scope is active, and the scope's in-memory backend
- *   does not leak to subsequent code that expected the user's regular
- *   credentials.
- */
-export async function withEphemeralToken(token, fn, options) {
-    // Drop any cached backend so the next getBackend() call sees the ephemeral context.
-    clearBackend();
-    // Snapshot existing env-var values so we can restore them on exit.
-    const priorTokenEnv = process.env[EPHEMERAL_TOKEN_ENV];
-    const priorCloudUrlEnv = process.env[EPHEMERAL_CLOUD_URL_ENV];
-    process.env[EPHEMERAL_TOKEN_ENV] = token;
-    if (options?.cloudUrl) {
-        process.env[EPHEMERAL_CLOUD_URL_ENV] = options.cloudUrl;
-    }
-    else {
-        delete process.env[EPHEMERAL_CLOUD_URL_ENV];
-    }
-    try {
-        return await storage.run({ cloudUrl: options?.cloudUrl, token }, fn);
-    }
-    finally {
-        // Restore prior env-var state (no leakage between sibling invocations).
-        if (priorTokenEnv === undefined) {
-            delete process.env[EPHEMERAL_TOKEN_ENV];
-        }
-        else {
-            process.env[EPHEMERAL_TOKEN_ENV] = priorTokenEnv;
-        }
-        if (priorCloudUrlEnv === undefined) {
-            delete process.env[EPHEMERAL_CLOUD_URL_ENV];
-        }
-        else {
-            process.env[EPHEMERAL_CLOUD_URL_ENV] = priorCloudUrlEnv;
-        }
-        // Drop the in-memory backend bound to the ephemeral token before yielding control.
-        clearBackend();
-    }
-}