hereya-cli 0.95.5 → 0.96.0

package/dist/commands/devenv/config/index.js

@@ -6,20 +6,43 @@ import { getBackend } from '../../../backend/index.js';
 import { getExecutorForWorkspace } from '../../../executor/context.js';
 import { setKeyFilePermissions, setSshDirPermissions } from '../../../lib/ssh-utils.js';
 export function buildSshConfigBlock(options) {
-    const { host, hostAlias, keyFilePath, sshUser } = options;
+    const { host, hostAlias, keyFilePath, proxyCommand, sshUser } = options;
     const knownHostsFile = process.platform === 'win32' ? 'NUL' : '/dev/null';
     const beginMarker = `# hereya-managed:${hostAlias} BEGIN`;
     const endMarker = `# hereya-managed:${hostAlias} END`;
-    return [
+    // On-demand devenvs (proxyCommand provided) need a placeholder HostName —
+    // ssh requires HostName to start a connection but the actual address is
+    // resolved by ProxyCommand at connect time. The alias itself is fine as
+    // a placeholder; ProxyCommand ignores %h.
+    const lines = [
         beginMarker,
         `Host ${hostAlias}`,
         `  HostName ${host}`,
         `  User ${sshUser}`,
         `  IdentityFile ${keyFilePath}`,
-        `  StrictHostKeyChecking no`,
-        `  UserKnownHostsFile ${knownHostsFile}`,
-        endMarker,
-    ].join('\n');
+    ];
+    if (proxyCommand) {
+        lines.push(`  ProxyCommand ${proxyCommand}`);
+    }
+    lines.push(`  StrictHostKeyChecking no`, `  UserKnownHostsFile ${knownHostsFile}`, endMarker);
+    return lines.join('\n');
+}
+/**
+ * Resolve the path to the hereya binary so we can bake an absolute
+ * ProxyCommand into the SSH config. SSH invokes ProxyCommand without
+ * inheriting the user's interactive shell PATH (it uses /bin/sh and the
+ * stripped login env), so a bare `hereya` often won't resolve. Prefer
+ * `process.argv[1]` (the actual binary that ran us) — that path is what's
+ * already on the user's machine and just worked. Fall back to `hereya` if
+ * argv[1] is missing for any reason; users can fix their PATH or re-run
+ * `devenv config` from a binary they want the SSH proxy to use.
+ */
+export function resolveHereyaBinForProxyCommand() {
+    const argv1 = process.argv[1];
+    if (argv1 && argv1.length > 0) {
+        return argv1;
+    }
+    return 'hereya';
 }
 export function upsertSshConfigBlock(existingConfig, newBlock, hostAlias) {
     const beginMarker = `# hereya-managed:${hostAlias} BEGIN`;
@@ -37,7 +60,7 @@ export function upsertSshConfigBlock(existingConfig, newBlock, hostAlias) {
     return existingConfig.trimEnd() + '\n\n' + newBlock + '\n';
 }
 export default class DevenvConfig extends Command {
-    static description = 'Configure SSH for a dev environment and display connection details.';
+    static description = 'Configure SSH for a dev environment and display connection details. On-demand devenvs use a ProxyCommand that wakes the instance on first connection.';
     static examples = [
         '<%= config.bin %> <%= command.id %> -w my-workspace',
     ];
@@ -67,10 +90,15 @@ export default class DevenvConfig extends Command {
         const sshPrivateKey = env.devEnvSshPrivateKey;
         const sshUser = env.devEnvSshUser;
         const sshHostDns = env.devEnvSshHostDns;
-        if (!sshHost || !sshPrivateKey || !sshUser) {
-            this.error('devEnvSshHost, devEnvSshPrivateKey, and devEnvSshUser must be set in the workspace environment');
+        const wakeUrl = env.devEnvWakeUrl;
+        if (!sshPrivateKey || !sshUser) {
+            this.error('devEnvSshPrivateKey and devEnvSshUser must be set in the workspace environment');
+        }
+        // Always-on devenvs need a cached host; on-demand devenvs resolve via
+        // the broker so devEnvSshHost is just a hint (and is often stale).
+        if (!wakeUrl && !sshHost) {
+            this.error('devEnvSshHost must be set in the workspace environment for always-on devenvs');
         }
-        const host = sshHostDns || sshHost;
         const sshDir = path.join(os.homedir(), '.ssh');
         const sanitizedWorkspace = workspace.replaceAll('/', '-');
         const keyFilePath = path.join(sshDir, `hereya-devenv-${sanitizedWorkspace}`);
@@ -87,15 +115,40 @@ export default class DevenvConfig extends Command {
         catch {
             // File doesn't exist yet, that's fine
         }
-        const newBlock = buildSshConfigBlock({ host, hostAlias, keyFilePath, sshUser });
-        const updatedConfig = upsertSshConfigBlock(existingConfig, newBlock, hostAlias);
+        // For on-demand devenvs, emit a ProxyCommand that calls back into this
+        // CLI to wake the box and resolve the live IP every connection. The
+        // cached devEnvSshHost would otherwise drift on every stop/start (EC2
+        // reassigns public IPs). The HostName field still has to be present
+        // for ssh to even try the connection — use the alias as a placeholder
+        // since ProxyCommand ignores %h.
+        const isOnDemand = Boolean(wakeUrl);
+        const block = isOnDemand
+            ? buildSshConfigBlock({
+                host: hostAlias,
+                hostAlias,
+                keyFilePath,
+                proxyCommand: `${resolveHereyaBinForProxyCommand()} devenv ssh-proxy -w ${workspace}`,
+                sshUser,
+            })
+            : buildSshConfigBlock({
+                host: sshHostDns || sshHost,
+                hostAlias,
+                keyFilePath,
+                sshUser,
+            });
+        const updatedConfig = upsertSshConfigBlock(existingConfig, block, hostAlias);
         await fs.writeFile(sshConfigPath, updatedConfig, { mode: 0o600 });
         this.log('SSH connection configured successfully.');
         this.log('');
         this.log('Fill in the Claude Code SSH connection form with:');
         this.log('');
         this.log(`  Name:                ${workspace}`);
-        this.log(`  SSH Host:            ${sshUser}@${host}`);
+        if (isOnDemand) {
+            this.log(`  SSH Host:            ${hostAlias}   (on-demand; wake handled automatically via ProxyCommand)`);
+        }
+        else {
+            this.log(`  SSH Host:            ${sshUser}@${sshHostDns || sshHost}`);
+        }
         this.log(`  SSH Port:            22`);
         this.log(`  Identity File:       ${keyFilePath}`);
         this.log('');

package/dist/commands/devenv/ssh-proxy/index.d.ts

@@ -0,0 +1,27 @@
+import { Command } from '@oclif/core';
+/**
+ * Hidden command used as `ProxyCommand` from the SSH config block written
+ * by `hereya devenv config`. Wakes the devenv (on-demand path) via the
+ * broker, resolves the live IP, then pipes stdin/stdout to <host>:22 so
+ * any SSH client (plain `ssh`, VS Code Remote SSH, Cursor, etc.) connects
+ * through the resolved address transparently.
+ *
+ * Equivalent to `ssh -W %h:%p` semantics, except %h/%p are resolved here
+ * (host comes from the broker, port is fixed at 22). Uses Node's built-in
+ * `net` module so we don't depend on an external `nc`/`ncat` being on PATH.
+ */
+export default class DevenvSshProxy extends Command {
+    static description: string;
+    static flags: {
+        workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    static hidden: boolean;
+    /**
+     * Open a TCP socket to <host>:<port> and pipe between stdin/stdout and
+     * the socket — the canonical SSH ProxyCommand contract. Resolves when
+     * the SSH client closes (EOF on stdin / socket end), with the appropriate
+     * exit code on error.
+     */
+    protected pipeToHost(host: string, port: number): Promise<void>;
+    run(): Promise<void>;
+}

package/dist/commands/devenv/ssh-proxy/index.js

@@ -0,0 +1,80 @@
+import { Command, Flags } from '@oclif/core';
+import * as net from 'node:net';
+import { getBackend } from '../../../backend/index.js';
+import { getExecutorForWorkspace } from '../../../executor/context.js';
+import { resolveDevenvSshHost } from '../../../lib/devenv-wake.js';
+/**
+ * Hidden command used as `ProxyCommand` from the SSH config block written
+ * by `hereya devenv config`. Wakes the devenv (on-demand path) via the
+ * broker, resolves the live IP, then pipes stdin/stdout to <host>:22 so
+ * any SSH client (plain `ssh`, VS Code Remote SSH, Cursor, etc.) connects
+ * through the resolved address transparently.
+ *
+ * Equivalent to `ssh -W %h:%p` semantics, except %h/%p are resolved here
+ * (host comes from the broker, port is fixed at 22). Uses Node's built-in
+ * `net` module so we don't depend on an external `nc`/`ncat` being on PATH.
+ */
+export default class DevenvSshProxy extends Command {
+    static description = 'Internal: SSH ProxyCommand for on-demand devenvs (wake + connect).';
+    static flags = {
+        workspace: Flags.string({
+            char: 'w',
+            description: 'name of the workspace to proxy SSH for',
+            required: true,
+        }),
+    };
+    static hidden = true;
+    /**
+     * Open a TCP socket to <host>:<port> and pipe between stdin/stdout and
+     * the socket — the canonical SSH ProxyCommand contract. Resolves when
+     * the SSH client closes (EOF on stdin / socket end), with the appropriate
+     * exit code on error.
+     */
+    pipeToHost(host, port) {
+        return new Promise((resolve, reject) => {
+            const socket = net.createConnection({ host, port });
+            socket.once('error', (err) => {
+                process.stderr.write(`hereya devenv ssh-proxy: failed to connect to ${host}:${port}: ${err.message}\n`);
+                reject(err);
+            });
+            socket.once('connect', () => {
+                process.stdin.pipe(socket);
+                socket.pipe(process.stdout);
+            });
+            socket.once('end', () => {
+                resolve();
+            });
+            socket.once('close', () => {
+                resolve();
+            });
+        });
+    }
+    async run() {
+        const { flags } = await this.parse(DevenvSshProxy);
+        const { workspace } = flags;
+        const backend = await getBackend();
+        const getWorkspaceEnvOutput = await backend.getWorkspaceEnv({ workspace });
+        if (!getWorkspaceEnvOutput.success) {
+            this.error(getWorkspaceEnvOutput.reason);
+        }
+        let { env } = getWorkspaceEnvOutput;
+        const executor$ = await getExecutorForWorkspace(workspace);
+        if (!executor$.success) {
+            this.error(executor$.reason);
+        }
+        const { executor } = executor$;
+        env = await executor.resolveEnvValues({ env });
+        let host;
+        try {
+            host = await resolveDevenvSshHost(env);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            // Print to stderr so SSH surfaces it, then exit non-zero so SSH
+            // reports a clean failure to the user.
+            process.stderr.write(`hereya devenv ssh-proxy: ${message}\n`);
+            this.exit(1);
+        }
+        await this.pipeToHost(host, 22);
+    }
+}

package/dist/commands/workspace/executor/install/index.js

@@ -10,14 +10,14 @@ export default class WorkspaceExecutorInstall extends Command {
     static description = `Install a remote executor into a workspace.
 
 Provisions hereya/remote-executor-aws. Two modes are supported:
-  - always-on (default): a long-lived EC2 polls hereya-cloud 24/7.
-  - ephemeral: ASG scaled to 0 with a broker Lambda + OIDC for on-demand wake.`;
+  - ephemeral (default): ASG scaled to 0 with a broker Lambda + OIDC for on-demand wake.
+  - always-on: a long-lived EC2 polls hereya-cloud 24/7 (legacy).`;
     static flags = {
         debug: Flags.boolean({ default: false, description: 'enable debug mode' }),
         force: Flags.boolean({ char: 'f', default: false, description: 'force reinstall even if executor is already installed' }),
         mode: Flags.string({
-            default: 'always-on',
-            description: 'executor mode: always-on (legacy long-lived EC2) or ephemeral (ASG min=0/max=1 with broker Lambda)',
+            default: 'ephemeral',
+            description: 'executor mode: ephemeral (ASG min=0/max=1 with broker Lambda) or always-on (legacy long-lived EC2)',
             options: ['ephemeral', 'always-on'],
         }),
         parameter: Flags.string({

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { type GetInfrastructureFn, type GetWorkspaceEnvFn, type MintInstallationTokenFn, type ResolveEnvProviders, resolveEnvValues, type ResolveEnvValuesInput, type ResolveEnvValuesOutput, resolveGithubAppMarkers, type ResolveSimpleEnvFn, } from './executor/resolve-env.js';
 export { InfrastructureType } from './infrastructure/common.js';
 export { awsProviderFactory, getInfrastructure, type GetInfrastructureInput, type GetInfrastructureOutput, type InfrastructureProviderFactory, registerInfrastructureProvider, resetInfrastructureProviders, } from './infrastructure/registry.js';
+export { mintInstallationToken, type MintInstallationTokenInput, } from './lib/github-app.js';
 export { run } from '@oclif/core';

package/dist/index.js

@@ -5,4 +5,5 @@
 export { resolveEnvValues, resolveGithubAppMarkers, } from './executor/resolve-env.js';
 export { InfrastructureType } from './infrastructure/common.js';
 export { awsProviderFactory, getInfrastructure, registerInfrastructureProvider, resetInfrastructureProviders, } from './infrastructure/registry.js';
+export { mintInstallationToken, } from './lib/github-app.js';
 export { run } from '@oclif/core';