hereya-cli 0.95.4 → 0.96.0

package/dist/commands/devenv/config/index.js

@@ -6,20 +6,43 @@ import { getBackend } from '../../../backend/index.js';
 import { getExecutorForWorkspace } from '../../../executor/context.js';
 import { setKeyFilePermissions, setSshDirPermissions } from '../../../lib/ssh-utils.js';
 export function buildSshConfigBlock(options) {
-    const { host, hostAlias, keyFilePath, sshUser } = options;
+    const { host, hostAlias, keyFilePath, proxyCommand, sshUser } = options;
     const knownHostsFile = process.platform === 'win32' ? 'NUL' : '/dev/null';
     const beginMarker = `# hereya-managed:${hostAlias} BEGIN`;
     const endMarker = `# hereya-managed:${hostAlias} END`;
-    return [
+    // On-demand devenvs (proxyCommand provided) need a placeholder HostName —
+    // ssh requires HostName to start a connection but the actual address is
+    // resolved by ProxyCommand at connect time. The alias itself is fine as
+    // a placeholder; ProxyCommand ignores %h.
+    const lines = [
         beginMarker,
         `Host ${hostAlias}`,
         `  HostName ${host}`,
         `  User ${sshUser}`,
         `  IdentityFile ${keyFilePath}`,
-        `  StrictHostKeyChecking no`,
-        `  UserKnownHostsFile ${knownHostsFile}`,
-        endMarker,
-    ].join('\n');
+    ];
+    if (proxyCommand) {
+        lines.push(`  ProxyCommand ${proxyCommand}`);
+    }
+    lines.push(`  StrictHostKeyChecking no`, `  UserKnownHostsFile ${knownHostsFile}`, endMarker);
+    return lines.join('\n');
+}
+/**
+ * Resolve the path to the hereya binary so we can bake an absolute
+ * ProxyCommand into the SSH config. SSH invokes ProxyCommand without
+ * inheriting the user's interactive shell PATH (it uses /bin/sh and the
+ * stripped login env), so a bare `hereya` often won't resolve. Prefer
+ * `process.argv[1]` (the actual binary that ran us) — that path is what's
+ * already on the user's machine and just worked. Fall back to `hereya` if
+ * argv[1] is missing for any reason; users can fix their PATH or re-run
+ * `devenv config` from a binary they want the SSH proxy to use.
+ */
+export function resolveHereyaBinForProxyCommand() {
+    const argv1 = process.argv[1];
+    if (argv1 && argv1.length > 0) {
+        return argv1;
+    }
+    return 'hereya';
 }
 export function upsertSshConfigBlock(existingConfig, newBlock, hostAlias) {
     const beginMarker = `# hereya-managed:${hostAlias} BEGIN`;
@@ -37,7 +60,7 @@ export function upsertSshConfigBlock(existingConfig, newBlock, hostAlias) {
     return existingConfig.trimEnd() + '\n\n' + newBlock + '\n';
 }
 export default class DevenvConfig extends Command {
-    static description = 'Configure SSH for a dev environment and display connection details.';
+    static description = 'Configure SSH for a dev environment and display connection details. On-demand devenvs use a ProxyCommand that wakes the instance on first connection.';
     static examples = [
         '<%= config.bin %> <%= command.id %> -w my-workspace',
     ];
@@ -67,10 +90,15 @@ export default class DevenvConfig extends Command {
         const sshPrivateKey = env.devEnvSshPrivateKey;
         const sshUser = env.devEnvSshUser;
         const sshHostDns = env.devEnvSshHostDns;
-        if (!sshHost || !sshPrivateKey || !sshUser) {
-            this.error('devEnvSshHost, devEnvSshPrivateKey, and devEnvSshUser must be set in the workspace environment');
+        const wakeUrl = env.devEnvWakeUrl;
+        if (!sshPrivateKey || !sshUser) {
+            this.error('devEnvSshPrivateKey and devEnvSshUser must be set in the workspace environment');
+        }
+        // Always-on devenvs need a cached host; on-demand devenvs resolve via
+        // the broker so devEnvSshHost is just a hint (and is often stale).
+        if (!wakeUrl && !sshHost) {
+            this.error('devEnvSshHost must be set in the workspace environment for always-on devenvs');
         }
-        const host = sshHostDns || sshHost;
         const sshDir = path.join(os.homedir(), '.ssh');
         const sanitizedWorkspace = workspace.replaceAll('/', '-');
         const keyFilePath = path.join(sshDir, `hereya-devenv-${sanitizedWorkspace}`);
@@ -87,15 +115,40 @@ export default class DevenvConfig extends Command {
         catch {
             // File doesn't exist yet, that's fine
         }
-        const newBlock = buildSshConfigBlock({ host, hostAlias, keyFilePath, sshUser });
-        const updatedConfig = upsertSshConfigBlock(existingConfig, newBlock, hostAlias);
+        // For on-demand devenvs, emit a ProxyCommand that calls back into this
+        // CLI to wake the box and resolve the live IP every connection. The
+        // cached devEnvSshHost would otherwise drift on every stop/start (EC2
+        // reassigns public IPs). The HostName field still has to be present
+        // for ssh to even try the connection — use the alias as a placeholder
+        // since ProxyCommand ignores %h.
+        const isOnDemand = Boolean(wakeUrl);
+        const block = isOnDemand
+            ? buildSshConfigBlock({
+                host: hostAlias,
+                hostAlias,
+                keyFilePath,
+                proxyCommand: `${resolveHereyaBinForProxyCommand()} devenv ssh-proxy -w ${workspace}`,
+                sshUser,
+            })
+            : buildSshConfigBlock({
+                host: sshHostDns || sshHost,
+                hostAlias,
+                keyFilePath,
+                sshUser,
+            });
+        const updatedConfig = upsertSshConfigBlock(existingConfig, block, hostAlias);
         await fs.writeFile(sshConfigPath, updatedConfig, { mode: 0o600 });
         this.log('SSH connection configured successfully.');
         this.log('');
         this.log('Fill in the Claude Code SSH connection form with:');
         this.log('');
         this.log(`  Name:                ${workspace}`);
-        this.log(`  SSH Host:            ${sshUser}@${host}`);
+        if (isOnDemand) {
+            this.log(`  SSH Host:            ${hostAlias}   (on-demand; wake handled automatically via ProxyCommand)`);
+        }
+        else {
+            this.log(`  SSH Host:            ${sshUser}@${sshHostDns || sshHost}`);
+        }
         this.log(`  SSH Port:            22`);
         this.log(`  Identity File:       ${keyFilePath}`);
         this.log('');

package/dist/commands/devenv/ssh-proxy/index.d.ts

@@ -0,0 +1,27 @@
+import { Command } from '@oclif/core';
+/**
+ * Hidden command used as `ProxyCommand` from the SSH config block written
+ * by `hereya devenv config`. Wakes the devenv (on-demand path) via the
+ * broker, resolves the live IP, then pipes stdin/stdout to <host>:22 so
+ * any SSH client (plain `ssh`, VS Code Remote SSH, Cursor, etc.) connects
+ * through the resolved address transparently.
+ *
+ * Equivalent to `ssh -W %h:%p` semantics, except %h/%p are resolved here
+ * (host comes from the broker, port is fixed at 22). Uses Node's built-in
+ * `net` module so we don't depend on an external `nc`/`ncat` being on PATH.
+ */
+export default class DevenvSshProxy extends Command {
+    static description: string;
+    static flags: {
+        workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    static hidden: boolean;
+    /**
+     * Open a TCP socket to <host>:<port> and pipe between stdin/stdout and
+     * the socket — the canonical SSH ProxyCommand contract. Resolves when
+     * the SSH client closes (EOF on stdin / socket end), with the appropriate
+     * exit code on error.
+     */
+    protected pipeToHost(host: string, port: number): Promise<void>;
+    run(): Promise<void>;
+}

package/dist/commands/devenv/ssh-proxy/index.js

@@ -0,0 +1,80 @@
+import { Command, Flags } from '@oclif/core';
+import * as net from 'node:net';
+import { getBackend } from '../../../backend/index.js';
+import { getExecutorForWorkspace } from '../../../executor/context.js';
+import { resolveDevenvSshHost } from '../../../lib/devenv-wake.js';
+/**
+ * Hidden command used as `ProxyCommand` from the SSH config block written
+ * by `hereya devenv config`. Wakes the devenv (on-demand path) via the
+ * broker, resolves the live IP, then pipes stdin/stdout to <host>:22 so
+ * any SSH client (plain `ssh`, VS Code Remote SSH, Cursor, etc.) connects
+ * through the resolved address transparently.
+ *
+ * Equivalent to `ssh -W %h:%p` semantics, except %h/%p are resolved here
+ * (host comes from the broker, port is fixed at 22). Uses Node's built-in
+ * `net` module so we don't depend on an external `nc`/`ncat` being on PATH.
+ */
+export default class DevenvSshProxy extends Command {
+    static description = 'Internal: SSH ProxyCommand for on-demand devenvs (wake + connect).';
+    static flags = {
+        workspace: Flags.string({
+            char: 'w',
+            description: 'name of the workspace to proxy SSH for',
+            required: true,
+        }),
+    };
+    static hidden = true;
+    /**
+     * Open a TCP socket to <host>:<port> and pipe between stdin/stdout and
+     * the socket — the canonical SSH ProxyCommand contract. Resolves when
+     * the SSH client closes (EOF on stdin / socket end), with the appropriate
+     * exit code on error.
+     */
+    pipeToHost(host, port) {
+        return new Promise((resolve, reject) => {
+            const socket = net.createConnection({ host, port });
+            socket.once('error', (err) => {
+                process.stderr.write(`hereya devenv ssh-proxy: failed to connect to ${host}:${port}: ${err.message}\n`);
+                reject(err);
+            });
+            socket.once('connect', () => {
+                process.stdin.pipe(socket);
+                socket.pipe(process.stdout);
+            });
+            socket.once('end', () => {
+                resolve();
+            });
+            socket.once('close', () => {
+                resolve();
+            });
+        });
+    }
+    async run() {
+        const { flags } = await this.parse(DevenvSshProxy);
+        const { workspace } = flags;
+        const backend = await getBackend();
+        const getWorkspaceEnvOutput = await backend.getWorkspaceEnv({ workspace });
+        if (!getWorkspaceEnvOutput.success) {
+            this.error(getWorkspaceEnvOutput.reason);
+        }
+        let { env } = getWorkspaceEnvOutput;
+        const executor$ = await getExecutorForWorkspace(workspace);
+        if (!executor$.success) {
+            this.error(executor$.reason);
+        }
+        const { executor } = executor$;
+        env = await executor.resolveEnvValues({ env });
+        let host;
+        try {
+            host = await resolveDevenvSshHost(env);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            // Print to stderr so SSH surfaces it, then exit non-zero so SSH
+            // reports a clean failure to the user.
+            process.stderr.write(`hereya devenv ssh-proxy: ${message}\n`);
+            this.exit(1);
+        }
+        await this.pipeToHost(host, 22);
+    }
+}

package/dist/commands/workspace/executor/install/index.js

@@ -10,14 +10,14 @@ export default class WorkspaceExecutorInstall extends Command {
     static description = `Install a remote executor into a workspace.
 
 Provisions hereya/remote-executor-aws. Two modes are supported:
-  - always-on (default): a long-lived EC2 polls hereya-cloud 24/7.
-  - ephemeral: ASG scaled to 0 with a broker Lambda + OIDC for on-demand wake.`;
+  - ephemeral (default): ASG scaled to 0 with a broker Lambda + OIDC for on-demand wake.
+  - always-on: a long-lived EC2 polls hereya-cloud 24/7 (legacy).`;
     static flags = {
         debug: Flags.boolean({ default: false, description: 'enable debug mode' }),
         force: Flags.boolean({ char: 'f', default: false, description: 'force reinstall even if executor is already installed' }),
         mode: Flags.string({
-            default: 'always-on',
-            description: 'executor mode: always-on (legacy long-lived EC2) or ephemeral (ASG min=0/max=1 with broker Lambda)',
+            default: 'ephemeral',
+            description: 'executor mode: ephemeral (ASG min=0/max=1 with broker Lambda) or always-on (legacy long-lived EC2)',
             options: ['ephemeral', 'always-on'],
         }),
         parameter: Flags.string({

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { type GetInfrastructureFn, type GetWorkspaceEnvFn, type MintInstallationTokenFn, type ResolveEnvProviders, resolveEnvValues, type ResolveEnvValuesInput, type ResolveEnvValuesOutput, resolveGithubAppMarkers, type ResolveSimpleEnvFn, } from './executor/resolve-env.js';
 export { InfrastructureType } from './infrastructure/common.js';
 export { awsProviderFactory, getInfrastructure, type GetInfrastructureInput, type GetInfrastructureOutput, type InfrastructureProviderFactory, registerInfrastructureProvider, resetInfrastructureProviders, } from './infrastructure/registry.js';
+export { mintInstallationToken, type MintInstallationTokenInput, } from './lib/github-app.js';
 export { run } from '@oclif/core';

package/dist/index.js

@@ -5,4 +5,5 @@
 export { resolveEnvValues, resolveGithubAppMarkers, } from './executor/resolve-env.js';
 export { InfrastructureType } from './infrastructure/common.js';
 export { awsProviderFactory, getInfrastructure, registerInfrastructureProvider, resetInfrastructureProviders, } from './infrastructure/registry.js';
+export { mintInstallationToken, } from './lib/github-app.js';
 export { run } from '@oclif/core';

package/dist/lib/package/cloud.js

@@ -17,7 +17,6 @@ export class CloudPackageManager {
         if (await isNotEmpty(destPath)) {
             return destPath;
         }
-        await fs.mkdir(destPath, { recursive: true });
         const tmpFolder = path.join(os.homedir(), '.hereya', 'downloads', randomUUID());
         try {
             // Use simple-git to clone the repository at specific commit
@@ -45,15 +44,41 @@ export class CloudPackageManager {
                     throw new Error(`Checksum mismatch for package ${registryPackage.name}@${registryPackage.version}. Expected: ${registryPackage.sha256}, Got: ${actualChecksum}`);
                 }
             }
-            // Move files from temp folder to destination
-            const files = await fs.readdir(tmpFolder);
-            await Promise.all(files.map(async (file) => {
-                if (file !== '.git') {
-                    await fs.rename(path.join(tmpFolder, file), path.join(destPath, file));
+            // Drop .git so the published artifact is clean — and so the directory
+            // rename below carries only the package contents.
+            await fs.rm(path.join(tmpFolder, '.git'), { force: true, recursive: true });
+            // Atomic publish: rename the whole tmpFolder onto destPath in one
+            // syscall. POSIX rename succeeds when destPath doesn't exist or is an
+            // empty directory; if a concurrent install already populated destPath
+            // (peer won the race), we get ENOTEMPTY/EEXIST and treat that as
+            // success — their result is valid because they ran the same
+            // checksum-validated clone we did.
+            //
+            // Pre-fix: we mkdir'd destPath then renamed each file individually,
+            // so two concurrent jobs racing on the same package both passed
+            // isNotEmpty(destPath) === false, both cloned into separate
+            // tmpFolders, and both tried to rename `<tmp>/lib` → `<destPath>/lib`.
+            // First wins; second crashed with EEXIST and the executor reported
+            // the job failed even though the package was correctly installed
+            // by the peer. Concurrency 20 in the executor amplified this
+            // anytime more than one job for the same workspace ran in parallel.
+            await fs.mkdir(path.dirname(destPath), { recursive: true });
+            try {
+                await fs.rename(tmpFolder, destPath);
+            }
+            catch (renameError) {
+                const { code } = renameError;
+                if (code === 'ENOTEMPTY' || code === 'EEXIST') {
+                    // Peer install won. Discard our copy.
+                    await fs.rm(tmpFolder, { force: true, recursive: true });
+                    if (!(await isNotEmpty(destPath))) {
+                        throw new Error(`Concurrent install for ${registryPackage.name}@${registryPackage.version} reported as won but left ${destPath} empty`);
+                    }
+                }
+                else {
+                    throw renameError;
                 }
-            }));
-            // Clean up temp folder
-            await fs.rm(tmpFolder, { force: true, recursive: true });
+            }
         }
         catch (error) {
             // Clean up on error

package/dist/lib/package/github.js

@@ -13,33 +13,77 @@ export class GitHubPackageManager {
         if (await isNotEmpty(destPath)) {
             return destPath;
         }
-        await fs.mkdir(destPath, { recursive: true });
-        // Initialize simple-git
-        const git = simpleGit();
-        // Parse version from URL if present (format: url#version)
-        const [repoUrl, version] = pkgUrl.split('#');
-        if (version) {
-            // Clone repository and checkout specific version tag
-            await git.clone(repoUrl, destPath, ['--no-checkout']);
-            const repoGit = simpleGit(destPath);
-            try {
-                // Try to checkout the version as a tag (e.g., v1.2.3 or 1.2.3)
-                await repoGit.checkout(`v${version}`);
-            }
-            catch {
+        const tmpFolder = path.join(os.homedir(), '.hereya', 'downloads', randomUUID());
+        try {
+            // Initialize simple-git
+            const git = simpleGit();
+            // Parse version from URL if present (format: url#version)
+            const [repoUrl, version] = pkgUrl.split('#');
+            if (version) {
+                // Clone repository and checkout specific version tag
+                await git.clone(repoUrl, tmpFolder, ['--no-checkout']);
+                const repoGit = simpleGit(tmpFolder);
                 try {
-                    // If v-prefixed tag doesn't exist, try without prefix
-                    await repoGit.checkout(version);
+                    // Try to checkout the version as a tag (e.g., v1.2.3 or 1.2.3)
+                    await repoGit.checkout(`v${version}`);
                 }
                 catch {
-                    // If neither tag exists, fail with clear error
-                    throw new Error(`Version '${version}' not found in repository ${repoUrl}. Available tags can be found at ${repoUrl}/tags`);
+                    try {
+                        // If v-prefixed tag doesn't exist, try without prefix
+                        await repoGit.checkout(version);
+                    }
+                    catch {
+                        // If neither tag exists, fail with clear error
+                        throw new Error(`Version '${version}' not found in repository ${repoUrl}. Available tags can be found at ${repoUrl}/tags`);
+                    }
+                }
+            }
+            else {
+                // Clone repository at default branch
+                await git.clone(pkgUrl, tmpFolder, ['--depth=1']);
+            }
+            // Drop .git so the published artifact is clean — and so the directory
+            // rename below carries only the package contents.
+            await fs.rm(path.join(tmpFolder, '.git'), { force: true, recursive: true });
+            // Atomic publish: rename the whole tmpFolder onto destPath in one
+            // syscall. POSIX rename succeeds when destPath doesn't exist or is an
+            // empty directory; if a concurrent install already populated destPath
+            // (peer won the race), we get ENOTEMPTY/EEXIST and treat that as
+            // success — their result is valid because they ran the same clone we
+            // did.
+            //
+            // Pre-fix: we mkdir'd destPath then cloned directly into it, so two
+            // concurrent jobs racing on the same package both passed
+            // isNotEmpty(destPath) === false and both tried to clone into the same
+            // directory. simple-git fails when the target is non-empty, and the
+            // executor reported the job failed even though one peer succeeded.
+            await fs.mkdir(path.dirname(destPath), { recursive: true });
+            try {
+                await fs.rename(tmpFolder, destPath);
+            }
+            catch (renameError) {
+                const { code } = renameError;
+                if (code === 'ENOTEMPTY' || code === 'EEXIST') {
+                    // Peer install won. Discard our copy.
+                    await fs.rm(tmpFolder, { force: true, recursive: true });
+                    if (!(await isNotEmpty(destPath))) {
+                        throw new Error(`Concurrent install for ${pkgUrl} reported as won but left ${destPath} empty`);
+                    }
+                }
+                else {
+                    throw renameError;
                 }
             }
         }
-        else {
-            // Clone repository at default branch
-            await git.clone(pkgUrl, destPath, ['--depth=1']);
+        catch (error) {
+            // Clean up on error
+            try {
+                await fs.rm(tmpFolder, { force: true, recursive: true });
+            }
+            catch {
+                // Ignore cleanup errors
+            }
+            throw error;
         }
         return destPath;
     }