@instafy/cli 0.1.7 → 0.1.8

package/README.md

@@ -6,6 +6,8 @@ Run Instafy projects locally and connect them back to Instafy Studio — from an
 
 ## Quickstart
 
+0. Log in once: `instafy login`
+   - Optional: set defaults with `instafy config set controller-url <url>` / `instafy config set studio-url <url>`
 1. Link a folder to a project:
    - VS Code: install the Instafy extension and run `Instafy: Link Workspace to Project`, or
    - Terminal: `instafy project:init`

package/dist/api.js

@@ -1,4 +1,5 @@
 import fs from "node:fs";
+import { resolveConfiguredAccessToken } from "./config.js";
 function normalizeUrl(raw) {
     const value = (raw ?? "").trim();
     if (!value)
@@ -18,7 +19,8 @@ function resolveBearerToken(options) {
         normalizeToken(process.env["INSTAFY_ACCESS_TOKEN"]) ??
         normalizeToken(process.env["INSTAFY_SERVICE_TOKEN"]) ??
         normalizeToken(process.env["CONTROLLER_TOKEN"]) ??
-        normalizeToken(process.env["SUPABASE_ACCESS_TOKEN"]));
+        normalizeToken(process.env["SUPABASE_ACCESS_TOKEN"]) ??
+        resolveConfiguredAccessToken());
 }
 function parseKeyValue(raw) {
     const trimmed = raw.trim();

package/dist/auth.js

@@ -0,0 +1,94 @@
+import kleur from "kleur";
+import { createInterface } from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+import { clearInstafyCliConfig, getInstafyConfigPath, resolveConfiguredStudioUrl, resolveControllerUrl, resolveUserAccessToken, writeInstafyCliConfig, } from "./config.js";
+function normalizeUrl(raw) {
+    const trimmed = typeof raw === "string" ? raw.trim() : "";
+    if (!trimmed) {
+        return null;
+    }
+    return trimmed.replace(/\/$/, "");
+}
+function normalizeToken(raw) {
+    const trimmed = typeof raw === "string" ? raw.trim() : "";
+    if (!trimmed) {
+        return null;
+    }
+    const lowered = trimmed.toLowerCase();
+    if (lowered === "null" || lowered === "undefined") {
+        return null;
+    }
+    return trimmed;
+}
+function looksLikeLocalControllerUrl(controllerUrl) {
+    try {
+        const parsed = new URL(controllerUrl);
+        const host = parsed.hostname.toLowerCase();
+        return host === "127.0.0.1" || host === "localhost" || host === "::1";
+    }
+    catch {
+        return controllerUrl.includes("127.0.0.1") || controllerUrl.includes("localhost");
+    }
+}
+function deriveDefaultStudioUrl(controllerUrl) {
+    if (looksLikeLocalControllerUrl(controllerUrl)) {
+        return "http://localhost:5173";
+    }
+    return "https://staging.instafy.dev";
+}
+export async function login(options) {
+    const controllerUrl = resolveControllerUrl({ controllerUrl: options.controllerUrl ?? null });
+    const studioUrl = normalizeUrl(options.studioUrl ?? null) ??
+        normalizeUrl(process.env["INSTAFY_STUDIO_URL"] ?? null) ??
+        resolveConfiguredStudioUrl() ??
+        deriveDefaultStudioUrl(controllerUrl);
+    const url = new URL("/cli/login", studioUrl);
+    url.searchParams.set("serverUrl", controllerUrl);
+    if (options.json) {
+        console.log(JSON.stringify({ url: url.toString(), configPath: getInstafyConfigPath() }));
+        return;
+    }
+    console.log(kleur.green("Instafy CLI login"));
+    console.log("");
+    console.log("1) Open this URL in your browser:");
+    console.log(kleur.cyan(url.toString()));
+    console.log("");
+    console.log("2) After you sign in, copy the token shown on that page.");
+    console.log("");
+    const provided = normalizeToken(options.token ?? null);
+    const existing = resolveUserAccessToken();
+    let token = provided;
+    if (!token) {
+        const rl = createInterface({ input, output });
+        try {
+            token = normalizeToken(await rl.question("Paste token: "));
+        }
+        finally {
+            rl.close();
+        }
+    }
+    if (!token) {
+        throw new Error("No token provided.");
+    }
+    if (!options.noStore) {
+        writeInstafyCliConfig({ controllerUrl, studioUrl, accessToken: token });
+        console.log("");
+        console.log(kleur.green(`Saved token to ${getInstafyConfigPath()}`));
+    }
+    else if (existing) {
+        console.log("");
+        console.log(kleur.yellow("Token not stored (existing token kept)."));
+    }
+    console.log("");
+    console.log("Next:");
+    console.log(`- ${kleur.cyan("instafy project:init")}`);
+    console.log(`- ${kleur.cyan("instafy runtime:start")}`);
+}
+export async function logout(options) {
+    clearInstafyCliConfig(["accessToken"]);
+    if (options?.json) {
+        console.log(JSON.stringify({ ok: true }));
+        return;
+    }
+    console.log(kleur.green("Logged out (cleared saved access token)."));
+}

package/dist/config-command.js

@@ -0,0 +1,104 @@
+import kleur from "kleur";
+import { clearInstafyCliConfig, getInstafyConfigPath, readInstafyCliConfig, writeInstafyCliConfig, } from "./config.js";
+function normalizeKey(raw) {
+    const key = raw.trim().toLowerCase().replace(/_/g, "-");
+    if (key === "controller-url" || key === "controllerurl" || key === "server-url") {
+        return "controller-url";
+    }
+    if (key === "studio-url" || key === "studiourl") {
+        return "studio-url";
+    }
+    throw new Error(`Unknown config key: ${raw} (supported: controller-url, studio-url)`);
+}
+function getValue(config, key) {
+    if (key === "controller-url")
+        return config.controllerUrl ?? null;
+    if (key === "studio-url")
+        return config.studioUrl ?? null;
+    return null;
+}
+function updateConfig(key, value) {
+    if (key === "controller-url") {
+        return writeInstafyCliConfig({ controllerUrl: value });
+    }
+    if (key === "studio-url") {
+        return writeInstafyCliConfig({ studioUrl: value });
+    }
+    return writeInstafyCliConfig({});
+}
+function clearConfig(key) {
+    if (key === "controller-url") {
+        clearInstafyCliConfig(["controllerUrl"]);
+        return;
+    }
+    if (key === "studio-url") {
+        clearInstafyCliConfig(["studioUrl"]);
+        return;
+    }
+}
+export function configPath(options) {
+    const path = getInstafyConfigPath();
+    if (options?.json) {
+        console.log(JSON.stringify({ path }, null, 2));
+        return;
+    }
+    console.log(path);
+}
+export function configList(options) {
+    const config = readInstafyCliConfig();
+    const payload = {
+        path: getInstafyConfigPath(),
+        controllerUrl: config.controllerUrl ?? null,
+        studioUrl: config.studioUrl ?? null,
+        accessTokenSet: Boolean(config.accessToken),
+        updatedAt: config.updatedAt ?? null,
+    };
+    if (options?.json) {
+        console.log(JSON.stringify(payload, null, 2));
+        return;
+    }
+    console.log(kleur.green("Instafy CLI config"));
+    console.log(`Path: ${payload.path}`);
+    console.log(`controller-url: ${payload.controllerUrl ?? kleur.yellow("(not set)")}`);
+    console.log(`studio-url: ${payload.studioUrl ?? kleur.yellow("(not set)")}`);
+    console.log(`access-token: ${payload.accessTokenSet ? kleur.green("(set)") : kleur.yellow("(not set)")}`);
+    if (payload.updatedAt) {
+        console.log(`updated-at: ${payload.updatedAt}`);
+    }
+}
+export function configGet(params) {
+    const key = normalizeKey(params.key);
+    const config = readInstafyCliConfig();
+    const value = getValue(config, key);
+    if (!value) {
+        throw new Error(`Config key ${key} is not set. Run \`instafy config set ${key} <value>\`.`);
+    }
+    if (params.json) {
+        console.log(JSON.stringify({ key, value }, null, 2));
+        return;
+    }
+    console.log(value);
+}
+export function configSet(params) {
+    const key = normalizeKey(params.key);
+    const updated = updateConfig(key, params.value);
+    const value = getValue(updated, key);
+    if (!value) {
+        throw new Error(`Failed to set ${key}.`);
+    }
+    if (params.json) {
+        console.log(JSON.stringify({ key, value, path: getInstafyConfigPath() }, null, 2));
+        return;
+    }
+    console.log(kleur.green(`Set ${key}`));
+    console.log(value);
+}
+export function configUnset(params) {
+    const key = normalizeKey(params.key);
+    clearConfig(key);
+    if (params.json) {
+        console.log(JSON.stringify({ ok: true, key }, null, 2));
+        return;
+    }
+    console.log(kleur.green(`Unset ${key}`));
+}

package/dist/config.js

@@ -0,0 +1,111 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+const INSTAFY_DIR = path.join(os.homedir(), ".instafy");
+const CONFIG_PATH = path.join(INSTAFY_DIR, "config.json");
+function normalizeToken(value) {
+    if (typeof value !== "string") {
+        return null;
+    }
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return null;
+    }
+    const lowered = trimmed.toLowerCase();
+    if (lowered === "null" || lowered === "undefined") {
+        return null;
+    }
+    return trimmed;
+}
+function normalizeUrl(value) {
+    const trimmed = typeof value === "string" ? value.trim() : "";
+    if (!trimmed) {
+        return null;
+    }
+    return trimmed.replace(/\/$/, "");
+}
+export function getInstafyConfigPath() {
+    return CONFIG_PATH;
+}
+export function readInstafyCliConfig() {
+    try {
+        const raw = fs.readFileSync(CONFIG_PATH, "utf8");
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object") {
+            return {};
+        }
+        const record = parsed;
+        return {
+            controllerUrl: normalizeUrl(typeof record.controllerUrl === "string" ? record.controllerUrl : null),
+            studioUrl: normalizeUrl(typeof record.studioUrl === "string" ? record.studioUrl : null),
+            accessToken: normalizeToken(typeof record.accessToken === "string" ? record.accessToken : null),
+            updatedAt: typeof record.updatedAt === "string" ? record.updatedAt : null,
+        };
+    }
+    catch {
+        return {};
+    }
+}
+export function writeInstafyCliConfig(update) {
+    const existing = readInstafyCliConfig();
+    const next = {
+        controllerUrl: normalizeUrl(update.controllerUrl ?? existing.controllerUrl ?? null),
+        studioUrl: normalizeUrl(update.studioUrl ?? existing.studioUrl ?? null),
+        accessToken: normalizeToken(update.accessToken ?? existing.accessToken ?? null),
+        updatedAt: new Date().toISOString(),
+    };
+    fs.mkdirSync(INSTAFY_DIR, { recursive: true });
+    fs.writeFileSync(CONFIG_PATH, JSON.stringify(next, null, 2), { encoding: "utf8" });
+    try {
+        fs.chmodSync(CONFIG_PATH, 0o600);
+    }
+    catch {
+        // ignore chmod failures (windows / unusual fs)
+    }
+    return next;
+}
+export function clearInstafyCliConfig(keys) {
+    if (!keys || keys.length === 0) {
+        try {
+            fs.rmSync(CONFIG_PATH, { force: true });
+        }
+        catch {
+            // ignore
+        }
+        return;
+    }
+    const existing = readInstafyCliConfig();
+    const next = { ...existing };
+    for (const key of keys) {
+        next[key] = null;
+    }
+    writeInstafyCliConfig(next);
+}
+export function resolveConfiguredControllerUrl() {
+    const config = readInstafyCliConfig();
+    return normalizeUrl(config.controllerUrl ?? null);
+}
+export function resolveConfiguredStudioUrl() {
+    const config = readInstafyCliConfig();
+    return normalizeUrl(config.studioUrl ?? null);
+}
+export function resolveConfiguredAccessToken() {
+    const config = readInstafyCliConfig();
+    return normalizeToken(config.accessToken ?? null);
+}
+export function resolveControllerUrl(params) {
+    const config = readInstafyCliConfig();
+    return (normalizeUrl(params?.controllerUrl ?? null) ??
+        normalizeUrl(process.env["INSTAFY_SERVER_URL"] ?? null) ??
+        normalizeUrl(process.env["CONTROLLER_BASE_URL"] ?? null) ??
+        normalizeUrl(config.controllerUrl ?? null) ??
+        "http://127.0.0.1:8788");
+}
+export function resolveUserAccessToken(params) {
+    const config = readInstafyCliConfig();
+    return (normalizeToken(params?.accessToken ?? null) ??
+        normalizeToken(process.env["INSTAFY_ACCESS_TOKEN"] ?? null) ??
+        normalizeToken(process.env["CONTROLLER_ACCESS_TOKEN"] ?? null) ??
+        normalizeToken(process.env["SUPABASE_ACCESS_TOKEN"] ?? null) ??
+        normalizeToken(config.accessToken ?? null));
+}

package/dist/git.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import kleur from "kleur";
+import { resolveConfiguredAccessToken } from "./config.js";
 function normalizeToken(value) {
     if (typeof value !== "string") {
         return null;
@@ -27,6 +28,7 @@ function resolveControllerAccessToken(options) {
         normalizeToken(options.supabaseAccessToken) ??
         readTokenFromFile(options.supabaseAccessTokenFile) ??
         normalizeToken(process.env["SUPABASE_ACCESS_TOKEN"]) ??
+        resolveConfiguredAccessToken() ??
         null);
 }
 export async function mintGitAccessToken(params) {
@@ -74,7 +76,7 @@ export async function gitToken(options) {
         supabaseAccessTokenFile: options.supabaseAccessTokenFile,
     });
     if (!token) {
-        throw new Error("Access token is required (--access-token/INSTAFY_ACCESS_TOKEN or --supabase-access-token/SUPABASE_ACCESS_TOKEN).");
+        throw new Error("Login required. Run `instafy login` or pass --access-token / --supabase-access-token.");
     }
     const minted = await mintGitAccessToken({
         controllerUrl,

package/dist/index.js

@@ -2,11 +2,13 @@ import { Command, Option } from "commander";
 import { pathToFileURL } from "node:url";
 import { createRequire } from "node:module";
 import kleur from "kleur";
-import { runtimeStart, runtimeStatus, runtimeStop, runtimeToken, } from "./runtime.js";
+import { runtimeStart, runtimeStatus, runtimeStop, runtimeToken, findProjectManifest, } from "./runtime.js";
+import { login, logout } from "./auth.js";
 import { gitToken } from "./git.js";
 import { projectInit } from "./project.js";
 import { runTunnelCommand } from "./tunnel.js";
 import { requestControllerApi } from "./api.js";
+import { configGet, configList, configPath, configSet, configUnset } from "./config-command.js";
 export const program = new Command();
 const require = createRequire(import.meta.url);
 const pkg = require("../package.json");
@@ -32,6 +34,112 @@ program
     .name("instafy")
     .description("Instafy CLI — run your project locally and connect to Studio")
     .version(pkg.version ?? "0.1.0");
+program
+    .command("login")
+    .description("Log in and save an access token for future CLI commands")
+    .option("--studio-url <url>", "Studio web URL (default: staging or localhost)")
+    .option("--server-url <url>", "Instafy server/controller URL")
+    .option("--token <token>", "Provide token directly (skips prompt)")
+    .option("--no-store", "Do not save token to ~/.instafy/config.json")
+    .option("--json", "Output JSON")
+    .action(async (opts) => {
+    try {
+        await login({
+            controllerUrl: opts.serverUrl,
+            studioUrl: opts.studioUrl,
+            token: opts.token,
+            noStore: opts.store === false,
+            json: opts.json,
+        });
+    }
+    catch (error) {
+        console.error(kleur.red(String(error)));
+        process.exit(1);
+    }
+});
+program
+    .command("logout")
+    .description("Clear the saved CLI access token")
+    .option("--json", "Output JSON")
+    .action(async (opts) => {
+    try {
+        await logout({ json: opts.json });
+    }
+    catch (error) {
+        console.error(kleur.red(String(error)));
+        process.exit(1);
+    }
+});
+const configCommand = program.command("config").description("Get/set saved CLI configuration");
+configCommand
+    .command("path")
+    .description("Print the config file path")
+    .option("--json", "Output JSON")
+    .action(async (opts) => {
+    try {
+        configPath({ json: opts.json });
+    }
+    catch (error) {
+        console.error(kleur.red(String(error)));
+        process.exit(1);
+    }
+});
+configCommand
+    .command("list")
+    .description("List saved configuration")
+    .option("--json", "Output JSON")
+    .action(async (opts) => {
+    try {
+        configList({ json: opts.json });
+    }
+    catch (error) {
+        console.error(kleur.red(String(error)));
+        process.exit(1);
+    }
+});
+configCommand
+    .command("get")
+    .description("Get a config value (controller-url, studio-url)")
+    .argument("<key>", "Config key")
+    .option("--json", "Output JSON")
+    .action(async (key, opts) => {
+    try {
+        configGet({ key, json: opts.json });
+    }
+    catch (error) {
+        console.error(kleur.red(String(error)));
+        process.exit(1);
+    }
+});
+configCommand
+    .command("set")
+    .description("Set a config value (controller-url, studio-url)")
+    .argument("<key>", "Config key")
+    .argument("<value>", "Config value")
+    .option("--json", "Output JSON")
+    .action(async (key, value, opts) => {
+    try {
+        configSet({ key, value, json: opts.json });
+    }
+    catch (error) {
+        console.error(kleur.red(String(error)));
+        process.exit(1);
+    }
+});
+configCommand
+    .command("unset")
+    .description("Unset a config value (controller-url, studio-url)")
+    .argument("<key>", "Config key")
+    .option("--json", "Output JSON")
+    .action(async (key, opts) => {
+    try {
+        configUnset({ key, json: opts.json });
+    }
+    catch (error) {
+        console.error(kleur.red(String(error)));
+        process.exit(1);
+    }
+});
 const runtimeStartCommand = program
     .command("runtime:start")
     .description("Start a local runtime for this project")
@@ -46,6 +154,7 @@ runtimeStartCommand
     .option("--codex-bin <path>", "Path to codex binary (fallback to PATH)")
     .option("--proxy-base-url <url>", "Codex proxy base URL")
     .option("--workspace <path>", "Workspace directory (defaults to ./.instafy/workspace)")
+    .option("--runtime-mode <mode>", "Runtime runner (auto|docker|process)", "auto")
     .option("--origin-id <uuid>", "Origin ID to use (auto-generated if omitted)")
     .option("--origin-endpoint <url>", "Explicit origin endpoint (skip tunnel setup when provided)")
     .option("--origin-token <token>", "Runtime/origin access token for Studio registration")
@@ -100,7 +209,7 @@ program
 const runtimeTokenCommand = program
     .command("runtime:token")
     .description("Mint a runtime access token")
-    .requiredOption("--project <id>", "Project UUID");
+    .option("--project <id>", "Project UUID (defaults to .instafy/project.json)");
 addServerUrlOptions(runtimeTokenCommand);
 addAccessTokenOptions(runtimeTokenCommand, "Instafy access token (required)");
 runtimeTokenCommand
@@ -109,8 +218,14 @@ runtimeTokenCommand
     .option("--json", "Output token as JSON")
     .action(async (opts) => {
     try {
+        const project = typeof opts.project === "string" && opts.project.trim()
+            ? opts.project.trim()
+            : findProjectManifest(process.cwd()).manifest?.projectId ?? null;
+        if (!project) {
+            throw new Error("No project configured. Run `instafy project:init` or pass --project.");
+        }
         await runtimeToken({
-            project: opts.project,
+            project,
             controllerUrl: opts.serverUrl ?? opts.controllerUrl,
             controllerAccessToken: opts.accessToken ?? opts.controllerAccessToken,
             runtimeId: opts.runtimeId,
@@ -126,7 +241,7 @@ runtimeTokenCommand
 const gitTokenCommand = program
     .command("git:token")
     .description("Mint a git access token for the project repo")
-    .requiredOption("--project <id>", "Project UUID");
+    .option("--project <id>", "Project UUID (defaults to .instafy/project.json)");
 addServerUrlOptions(gitTokenCommand);
 addAccessTokenOptions(gitTokenCommand, "Instafy access token (required)");
 gitTokenCommand
@@ -137,13 +252,19 @@ gitTokenCommand
     .option("--json", "Output token response as JSON")
     .action(async (opts) => {
     try {
+        const project = typeof opts.project === "string" && opts.project.trim()
+            ? opts.project.trim()
+            : findProjectManifest(process.cwd()).manifest?.projectId ?? null;
+        if (!project) {
+            throw new Error("No project configured. Run `instafy project:init` or pass --project.");
+        }
         const ttlSecondsRaw = typeof opts.ttlSeconds === "string" ? opts.ttlSeconds.trim() : "";
         const ttlSeconds = ttlSecondsRaw.length > 0 ? Number.parseInt(ttlSecondsRaw, 10) : undefined;
         if (ttlSecondsRaw.length > 0 && (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0)) {
             throw new Error("--ttl-seconds must be a positive integer");
         }
         await gitToken({
-            project: opts.project,
+            project,
             controllerUrl: opts.serverUrl ?? opts.controllerUrl,
             controllerAccessToken: opts.accessToken ?? opts.controllerAccessToken,
             supabaseAccessToken: opts.supabaseAccessToken,
@@ -193,11 +314,12 @@ projectInitCommand
 const tunnelCommand = program
     .command("tunnel")
     .description("Create a shareable tunnel URL for a local port")
-    .option("--project <id>", "Project UUID (or set PROJECT_ID)");
+    .option("--port <port>", "Local port to expose (default 3000)")
+    .option("--project <id>", "Project UUID (defaults to .instafy/project.json or PROJECT_ID)");
 addServerUrlOptions(tunnelCommand);
+addAccessTokenOptions(tunnelCommand, "Instafy access token (defaults to saved `instafy login` token)");
 addServiceTokenOptions(tunnelCommand, "Instafy service token (advanced)");
 tunnelCommand
-    .option("--port <port>", "Local port to expose (default 3000)")
     .option("--rathole-bin <path>", "Path to rathole binary (or set RATHOLE_BIN)")
     .action(async (opts) => {
     try {
@@ -205,7 +327,10 @@ tunnelCommand
         await runTunnelCommand({
             project: opts.project,
             controllerUrl: opts.serverUrl ?? opts.controllerUrl,
-            controllerToken: opts.serviceToken ?? opts.controllerToken,
+            controllerToken: opts.serviceToken ??
+                opts.controllerToken ??
+                opts.accessToken ??
+                opts.controllerAccessToken,
             port,
             ratholeBin: opts.ratholeBin,
         });
@@ -292,22 +417,22 @@ function configureApiCommand(command, method) {
 }
 const apiGetCommand = program
     .command("api:get")
-    .description("Perform an authenticated GET request to the controller API")
+    .description("Advanced: authenticated GET request to the controller API")
     .argument("<path>", "API path (or full URL), e.g. /conversations/<id>/messages?limit=50");
 configureApiCommand(apiGetCommand, "GET");
 const apiPostCommand = program
     .command("api:post")
-    .description("Perform an authenticated POST request to the controller API")
+    .description("Advanced: authenticated POST request to the controller API")
     .argument("<path>", "API path (or full URL)");
 configureApiCommand(apiPostCommand, "POST");
 const apiPatchCommand = program
     .command("api:patch")
-    .description("Perform an authenticated PATCH request to the controller API")
+    .description("Advanced: authenticated PATCH request to the controller API")
     .argument("<path>", "API path (or full URL)");
 configureApiCommand(apiPatchCommand, "PATCH");
 const apiDeleteCommand = program
     .command("api:delete")
-    .description("Perform an authenticated DELETE request to the controller API")
+    .description("Advanced: authenticated DELETE request to the controller API")
     .argument("<path>", "API path (or full URL)");
 configureApiCommand(apiDeleteCommand, "DELETE");
 export async function runCli(argv = process.argv) {

package/dist/org.js

@@ -1,24 +1,13 @@
 import kleur from "kleur";
-function normalizeUrl(raw) {
-    const value = (raw ?? "").trim();
-    if (!value)
-        return "http://127.0.0.1:8788";
-    return value.replace(/\/$/, "");
-}
-function normalizeToken(raw) {
-    if (!raw)
-        return null;
-    const trimmed = raw.trim();
-    return trimmed.length ? trimmed : null;
+import { resolveControllerUrl, resolveUserAccessToken } from "./config.js";
+function formatAuthRequiredError() {
+    return new Error("Login required. Run `instafy login` (recommended) or pass --access-token / set SUPABASE_ACCESS_TOKEN.");
 }
 export async function listOrganizations(params) {
-    const controllerUrl = normalizeUrl(params.controllerUrl ?? process.env["INSTAFY_SERVER_URL"] ?? process.env["CONTROLLER_BASE_URL"]);
-    const token = normalizeToken(params.accessToken) ??
-        normalizeToken(process.env["INSTAFY_ACCESS_TOKEN"]) ??
-        normalizeToken(process.env["CONTROLLER_ACCESS_TOKEN"]) ??
-        normalizeToken(process.env["SUPABASE_ACCESS_TOKEN"]);
+    const controllerUrl = resolveControllerUrl({ controllerUrl: params.controllerUrl ?? null });
+    const token = resolveUserAccessToken({ accessToken: params.accessToken ?? null });
     if (!token) {
-        throw new Error("Instafy or Supabase access token is required (--access-token, INSTAFY_ACCESS_TOKEN, or SUPABASE_ACCESS_TOKEN).");
+        throw formatAuthRequiredError();
     }
     const response = await fetch(`${controllerUrl}/orgs`, {
         headers: { authorization: `Bearer ${token}` },

package/dist/project.js

@@ -1,17 +1,9 @@
 import fs from "node:fs";
 import path from "node:path";
 import kleur from "kleur";
-function normalizeUrl(raw) {
-    const value = (raw ?? "").trim();
-    if (!value)
-        return "http://127.0.0.1:8788";
-    return value.replace(/\/$/, "");
-}
-function normalizeToken(raw) {
-    if (!raw)
-        return null;
-    const trimmed = raw.trim();
-    return trimmed.length ? trimmed : null;
+import { resolveControllerUrl, resolveUserAccessToken } from "./config.js";
+function formatAuthRequiredError() {
+    return new Error("Login required. Run `instafy login` (recommended) or pass --access-token / set SUPABASE_ACCESS_TOKEN.");
 }
 async function fetchOrganizations(controllerUrl, token) {
     const response = await fetch(`${controllerUrl}/orgs`, {
@@ -73,13 +65,10 @@ async function resolveOrg(controllerUrl, token, options) {
     return { orgId, orgName: json.org_name ?? null };
 }
 export async function listProjects(options) {
-    const controllerUrl = normalizeUrl(options.controllerUrl ?? process.env["INSTAFY_SERVER_URL"] ?? process.env["CONTROLLER_BASE_URL"]);
-    const token = normalizeToken(options.accessToken) ??
-        normalizeToken(process.env["INSTAFY_ACCESS_TOKEN"]) ??
-        normalizeToken(process.env["CONTROLLER_ACCESS_TOKEN"]) ??
-        normalizeToken(process.env["SUPABASE_ACCESS_TOKEN"]);
+    const controllerUrl = resolveControllerUrl({ controllerUrl: options.controllerUrl ?? null });
+    const token = resolveUserAccessToken({ accessToken: options.accessToken ?? null });
     if (!token) {
-        throw new Error("Instafy or Supabase access token is required (--access-token, INSTAFY_ACCESS_TOKEN, or SUPABASE_ACCESS_TOKEN).");
+        throw formatAuthRequiredError();
     }
     const orgs = await fetchOrganizations(controllerUrl, token);
     let targetOrgs = orgs;
@@ -124,13 +113,10 @@ export async function listProjects(options) {
 }
 export async function projectInit(options) {
     const rootDir = path.resolve(options.path ?? process.cwd());
-    const controllerUrl = normalizeUrl(options.controllerUrl ?? process.env["INSTAFY_SERVER_URL"] ?? process.env["CONTROLLER_BASE_URL"]);
-    const token = normalizeToken(options.accessToken) ??
-        normalizeToken(process.env["INSTAFY_ACCESS_TOKEN"]) ??
-        normalizeToken(process.env["CONTROLLER_ACCESS_TOKEN"]) ??
-        normalizeToken(process.env["SUPABASE_ACCESS_TOKEN"]);
+    const controllerUrl = resolveControllerUrl({ controllerUrl: options.controllerUrl ?? null });
+    const token = resolveUserAccessToken({ accessToken: options.accessToken ?? null });
     if (!token) {
-        throw new Error("Instafy or Supabase access token is required (--access-token, INSTAFY_ACCESS_TOKEN, or SUPABASE_ACCESS_TOKEN).");
+        throw formatAuthRequiredError();
     }
     const org = await resolveOrg(controllerUrl, token, options);
     const body = {

package/dist/runtime.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import kleur from "kleur";
@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";
 import os from "node:os";
 import { ensureRatholeBinary } from "./rathole.js";
+import { resolveConfiguredAccessToken } from "./config.js";
 const INSTAFY_DIR = path.join(os.homedir(), ".instafy");
 const STATE_FILE = path.join(INSTAFY_DIR, "cli-runtime-state.json");
 const LOG_DIR = path.join(INSTAFY_DIR, "cli-runtime-logs");
@@ -27,7 +28,82 @@ function resolveRuntimeBinary() {
             return candidate;
         }
     }
-    throw new Error("runtime-agent binary not found. Build it with `cargo build -p runtime-agent`.");
+    throw new Error("runtime-agent binary not found. If you're in the instafy repo, run `cargo build -p runtime-agent`. Otherwise install Docker and rerun `instafy runtime:start`.");
+}
+function tryResolveRuntimeBinary() {
+    try {
+        return resolveRuntimeBinary();
+    }
+    catch {
+        return null;
+    }
+}
+function isDockerAvailable() {
+    try {
+        const result = spawnSync("docker", ["version"], { stdio: "ignore" });
+        return result.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function normalizeControllerUrlForDocker(controllerUrl) {
+    const trimmed = controllerUrl.trim().replace(/\/$/, "");
+    if (!trimmed) {
+        return trimmed;
+    }
+    try {
+        const url = new URL(trimmed);
+        const host = url.hostname.toLowerCase();
+        if (host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "0.0.0.0") {
+            url.hostname = "host.docker.internal";
+        }
+        return url.toString().replace(/\/$/, "");
+    }
+    catch {
+        return trimmed
+            .replace("127.0.0.1", "host.docker.internal")
+            .replace("localhost", "host.docker.internal")
+            .replace("0.0.0.0", "host.docker.internal")
+            .replace(/\/$/, "");
+    }
+}
+function resolveRuntimeAgentImage() {
+    const fromEnv = normalizeToken(process.env["INSTAFY_RUNTIME_AGENT_IMAGE"]) ??
+        normalizeToken(process.env["RUNTIME_AGENT_IMAGE"]) ??
+        null;
+    return fromEnv ?? "ghcr.io/instafy-dev/instafy-runtime-agent:latest";
+}
+function dockerContainerRunning(containerId) {
+    const id = containerId.trim();
+    if (!id) {
+        return false;
+    }
+    try {
+        const result = spawnSync("docker", ["inspect", "-f", "{{.State.Running}}", id], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        if (result.status !== 0) {
+            return false;
+        }
+        return String(result.stdout ?? "").trim() === "true";
+    }
+    catch {
+        return false;
+    }
+}
+function stopDockerContainer(containerId) {
+    const id = containerId.trim();
+    if (!id) {
+        return;
+    }
+    try {
+        spawnSync("docker", ["rm", "-f", id], { stdio: "ignore" });
+    }
+    catch {
+        // ignore
+    }
 }
 function printStatus(label, value) {
     console.log(`${kleur.cyan(label)} ${value}`);
@@ -131,6 +207,14 @@ function findRatholeOnPath() {
     }
     return null;
 }
+function resolveControllerAccessTokenForCli(options, env, supabaseAccessToken) {
+    return (normalizeToken(options.controllerAccessToken) ??
+        normalizeToken(env["INSTAFY_ACCESS_TOKEN"]) ??
+        normalizeToken(env["CONTROLLER_ACCESS_TOKEN"]) ??
+        supabaseAccessToken ??
+        normalizeToken(env["SUPABASE_ACCESS_TOKEN"]) ??
+        resolveConfiguredAccessToken());
+}
 export async function resolveRatholeBinaryForCli(options) {
     const warn = options.warn ??
         ((message) => {
@@ -212,33 +296,34 @@ function isProcessAlive(pid) {
     }
 }
 export async function runtimeStart(options) {
-    const bin = resolveRuntimeBinary();
     const env = { ...process.env };
     const existing = readState();
-    if (existing && isProcessAlive(existing.pid)) {
-        throw new Error(`Runtime already running (pid ${existing.pid}) for project ${existing.projectId}. Stop it first.`);
+    if (existing) {
+        if (existing.runner === "docker" && existing.containerId && dockerContainerRunning(existing.containerId)) {
+            throw new Error(`Runtime already running (docker container ${existing.containerId}) for project ${existing.projectId}. Stop it first.`);
+        }
+        if ((!existing.runner || existing.runner === "process") && isProcessAlive(existing.pid)) {
+            throw new Error(`Runtime already running (pid ${existing.pid}) for project ${existing.projectId}. Stop it first.`);
+        }
     }
-    const manifestInfo = findProjectManifest(options.workspace ?? process.cwd());
+    const manifestInfo = findProjectManifest(process.cwd());
     const projectId = options.project ?? env["PROJECT_ID"] ?? manifestInfo.manifest?.projectId ?? null;
     if (!projectId) {
-        throw new Error("Project ID is required (--project or PROJECT_ID)");
+        throw new Error("No project configured. Run `instafy project:init` in this folder (recommended) or pass --project.");
     }
     env["PROJECT_ID"] = projectId;
     const supabaseAccessToken = resolveSupabaseAccessToken(options, env);
     if (supabaseAccessToken) {
         env["SUPABASE_ACCESS_TOKEN"] = supabaseAccessToken;
     }
-    let controllerAccessToken = normalizeToken(options.controllerAccessToken) ??
-        normalizeToken(env["INSTAFY_ACCESS_TOKEN"]) ??
-        normalizeToken(env["CONTROLLER_ACCESS_TOKEN"]) ??
-        supabaseAccessToken;
+    let controllerAccessToken = resolveControllerAccessTokenForCli(options, env, supabaseAccessToken);
     let runtimeAccessToken = normalizeToken(options.runtimeToken) ?? normalizeToken(env["RUNTIME_ACCESS_TOKEN"]);
     const agentKey = options.controllerToken ??
         env["INSTAFY_SERVICE_TOKEN"] ??
         env["AGENT_LOGIN_KEY"] ??
         env["AGENT_KEY"];
     if (!agentKey && !controllerAccessToken && !runtimeAccessToken) {
-        throw new Error("Provide either --runtime-token/RUNTIME_ACCESS_TOKEN, --access-token/INSTAFY_ACCESS_TOKEN, --supabase-access-token/SUPABASE_ACCESS_TOKEN, or --service-token/INSTAFY_SERVICE_TOKEN (advanced).");
+        throw new Error("Login required. Run `instafy login`, or pass --access-token / --supabase-access-token, or provide --runtime-token.");
     }
     if (agentKey) {
         env["AGENT_LOGIN_KEY"] = agentKey;
@@ -250,6 +335,7 @@ export async function runtimeStart(options) {
         options.controllerUrl ??
             env["INSTAFY_SERVER_URL"] ??
             env["CONTROLLER_BASE_URL"] ??
+            manifestInfo.manifest?.controllerUrl ??
             "http://127.0.0.1:8788";
     if (!runtimeAccessToken && controllerAccessToken) {
         runtimeAccessToken = await mintRuntimeAccessToken({
@@ -320,47 +406,123 @@ export async function runtimeStart(options) {
     if (options.runtimeLeaseId && options.runtimeLeaseId.trim()) {
         env["RUNTIME_LEASE_ID"] = options.runtimeLeaseId.trim();
     }
-    if (!env["ORIGIN_ENDPOINT"]) {
-        const ratholeResolved = await resolveRatholeBinaryForCli({
-            env,
-            version: process.env["RATHOLE_VERSION"] ?? null,
-            cacheDir: process.env["RATHOLE_CACHE_DIR"] ?? null,
-            logger: (message) => console.log(kleur.cyan(`[rathole] ${message}`)),
-            warn: (message) => console.warn(kleur.yellow(message)),
-        });
-        if (!ratholeResolved) {
-            throw new Error("Tunnel is required but rathole is unavailable. Set RATHOLE_BIN (recommended) or pass --origin-endpoint to use a reachable URL.");
+    const runtimeMode = (options.runtimeMode ?? "auto").toLowerCase();
+    const runtimeBin = runtimeMode === "docker" ? null : tryResolveRuntimeBinary();
+    const useDocker = runtimeMode === "docker" ||
+        (runtimeMode === "auto" && !runtimeBin);
+    if (!useDocker) {
+        if (!env["ORIGIN_ENDPOINT"]) {
+            const ratholeResolved = await resolveRatholeBinaryForCli({
+                env,
+                version: process.env["RATHOLE_VERSION"] ?? null,
+                cacheDir: process.env["RATHOLE_CACHE_DIR"] ?? null,
+                logger: (message) => console.log(kleur.cyan(`[rathole] ${message}`)),
+                warn: (message) => console.warn(kleur.yellow(message)),
+            });
+            if (!ratholeResolved) {
+                throw new Error("Tunnel is required but rathole is unavailable. Set RATHOLE_BIN (recommended) or pass --origin-endpoint to use a reachable URL.");
+            }
+        }
+        const bin = runtimeBin ?? resolveRuntimeBinary();
+        printStatus("Starting runtime-agent:", bin);
+        printStatus("Project:", projectId);
+        printStatus("Workspace:", workspace);
+        printStatus("Origin:", originId);
+        const detached = Boolean(options.detach);
+        const logFile = options.logFile?.trim()
+            ? path.resolve(options.logFile)
+            : detached
+                ? path.join(LOG_DIR, `runtime-${Date.now()}.log`)
+                : undefined;
+        if (logFile) {
+            ensureLogDir();
+        }
+        let stdio;
+        if (!logFile && !detached) {
+            stdio = "inherit";
         }
+        else {
+            const out = logFile ? openSync(logFile, "a") : "ignore";
+            stdio = ["ignore", out, out];
+        }
+        const spawnOptions = { env, stdio, detached };
+        const child = spawn(bin, spawnOptions);
+        if (detached) {
+            child.unref();
+        }
+        const startedAt = new Date().toISOString();
+        writeState({
+            runner: "process",
+            pid: child.pid ?? -1,
+            projectId,
+            workspace,
+            controllerUrl: env["CONTROLLER_BASE_URL"],
+            originId,
+            runtimeId: env["RUNTIME_ID"] ?? null,
+            displayName: env["RUNTIME_DISPLAY_NAME"],
+            startedAt,
+            logFile,
+            detached,
+        });
+        child.on("exit", (code, signal) => {
+            const msg = code !== null ? `code ${code}` : `signal ${signal}`;
+            console.log(kleur.yellow(`runtime-agent exited (${msg})`));
+            const current = readState();
+            if (current && current.pid === child.pid) {
+                clearState();
+            }
+        });
+        return;
     }
-    printStatus("Starting runtime-agent:", bin);
+    if (!isDockerAvailable()) {
+        throw new Error("runtime-agent is not available (no local binary and docker is not installed). Install Docker Desktop, or build runtime-agent from source.");
+    }
+    const image = resolveRuntimeAgentImage();
+    const containerName = `instafy-runtime-${originId}`;
+    const hostPort = String(options.bindPort ?? env["ORIGIN_BIND_PORT"] ?? 54332);
+    const hostBindHost = options.bindHost ?? "127.0.0.1";
+    const dockerEnv = { ...env };
+    dockerEnv["WORKSPACE_DIR"] = "/workspace";
+    dockerEnv["CODEX_HOME"] = "/workspace/.codex";
+    dockerEnv["ORIGIN_BIND_HOST"] = "0.0.0.0";
+    dockerEnv["CONTROLLER_BASE_URL"] = normalizeControllerUrlForDocker(env["CONTROLLER_BASE_URL"] ?? "");
+    const envArgs = [];
+    for (const [key, value] of Object.entries(dockerEnv)) {
+        if (typeof value !== "string" || value.length === 0)
+            continue;
+        envArgs.push("-e", `${key}=${value}`);
+    }
+    const runArgs = [
+        "run",
+        "--detach",
+        "--name",
+        containerName,
+        "--add-host",
+        "host.docker.internal:host-gateway",
+        "-p",
+        `${hostBindHost}:${hostPort}:${hostPort}`,
+        "-v",
+        `${workspace}:/workspace`,
+        ...envArgs,
+        image,
+    ];
+    printStatus("Starting runtime-agent (docker):", image);
     printStatus("Project:", projectId);
     printStatus("Workspace:", workspace);
     printStatus("Origin:", originId);
-    const detached = Boolean(options.detach);
-    const logFile = options.logFile?.trim()
-        ? path.resolve(options.logFile)
-        : detached
-            ? path.join(LOG_DIR, `runtime-${Date.now()}.log`)
-            : undefined;
-    if (logFile) {
-        ensureLogDir();
-    }
-    let stdio;
-    if (!logFile && !detached) {
-        stdio = "inherit";
+    const started = spawnSync("docker", runArgs, { encoding: "utf8" });
+    if (started.status !== 0) {
+        const stderr = String(started.stderr ?? "").trim();
+        throw new Error(`docker run failed: ${stderr || "unknown error"}`);
     }
-    else {
-        const out = logFile ? openSync(logFile, "a") : "ignore";
-        stdio = ["ignore", out, out];
-    }
-    const spawnOptions = { env, stdio, detached };
-    const child = spawn(bin, spawnOptions);
-    if (detached) {
-        child.unref();
+    const containerId = String(started.stdout ?? "").trim();
+    if (!containerId) {
+        throw new Error("docker run did not return a container id");
     }
     const startedAt = new Date().toISOString();
     writeState({
-        pid: child.pid ?? -1,
+        runner: "docker",
+        pid: -1,
         projectId,
         workspace,
         controllerUrl: env["CONTROLLER_BASE_URL"],
@@ -368,22 +530,40 @@ export async function runtimeStart(options) {
         runtimeId: env["RUNTIME_ID"] ?? null,
         displayName: env["RUNTIME_DISPLAY_NAME"],
         startedAt,
-        logFile,
-        detached,
+        detached: Boolean(options.detach),
+        containerId,
+        containerName,
     });
-    child.on("exit", (code, signal) => {
-        const msg = code !== null ? `code ${code}` : `signal ${signal}`;
-        console.log(kleur.yellow(`runtime-agent exited (${msg})`));
+    if (options.detach) {
+        printStatus("Container:", containerId);
+        console.log(kleur.gray(`Use: docker logs -f ${containerId}`));
+        return;
+    }
+    const logs = spawn("docker", ["logs", "-f", containerId], { stdio: "inherit" });
+    const handleExit = async () => {
+        stopDockerContainer(containerId);
         const current = readState();
-        if (current && current.pid === child.pid) {
+        if (current?.containerId === containerId) {
             clearState();
         }
+    };
+    process.once("SIGINT", () => {
+        void handleExit();
+    });
+    process.once("SIGTERM", () => {
+        void handleExit();
+    });
+    logs.on("exit", () => {
+        void handleExit();
     });
 }
 function formatStatus(state, running) {
     return {
         running,
+        runner: state.runner ?? "process",
         pid: state.pid,
+        containerId: state.containerId ?? null,
+        containerName: state.containerName ?? null,
         projectId: state.projectId,
         workspace: state.workspace,
         controllerUrl: state.controllerUrl ?? null,
@@ -404,7 +584,8 @@ async function sendOfflineBeat(state) {
     let bearer = directToken;
     if (!bearer) {
         const controllerAccessToken = normalizeToken(process.env["CONTROLLER_ACCESS_TOKEN"]) ??
-            normalizeToken(process.env["SUPABASE_ACCESS_TOKEN"]);
+            normalizeToken(process.env["SUPABASE_ACCESS_TOKEN"]) ??
+            resolveConfiguredAccessToken();
         if (controllerAccessToken) {
             try {
                 bearer = await mintRuntimeAccessToken({
@@ -465,14 +646,25 @@ export async function runtimeStatus(options) {
         }
         return;
     }
-    const alive = isProcessAlive(state.pid);
+    const alive = state.runner === "docker"
+        ? Boolean(state.containerId && dockerContainerRunning(state.containerId))
+        : isProcessAlive(state.pid);
     const payload = formatStatus(state, alive);
     if (options?.json) {
         console.log(JSON.stringify(payload));
         return;
     }
     console.log(alive ? kleur.green("Runtime is running") : kleur.red("Runtime is not running"));
-    printStatus("PID:", String(state.pid));
+    printStatus("Runner:", state.runner ?? "process");
+    if (state.runner === "docker") {
+        if (state.containerId)
+            printStatus("Container:", state.containerId);
+        if (state.containerName)
+            printStatus("Name:", state.containerName);
+    }
+    else {
+        printStatus("PID:", String(state.pid));
+    }
     printStatus("Project:", state.projectId);
     printStatus("Workspace:", state.workspace);
     if (state.controllerUrl)
@@ -482,13 +674,13 @@ export async function runtimeStatus(options) {
     if (state.runtimeId)
         printStatus("Runtime:", state.runtimeId);
     if (state.displayName)
-        printStatus("Name:", state.displayName);
+        printStatus("Display:", state.displayName);
     printStatus("Started:", state.startedAt);
     if (state.logFile)
         printStatus("Log:", state.logFile);
     printStatus("Detached:", state.detached ? "yes" : "no");
     if (!alive) {
-        console.log(kleur.yellow("State file exists but process is not alive."));
+        console.log(kleur.yellow(`State file exists but ${state.runner === "docker" ? "container" : "process"} is not alive.`));
     }
 }
 export async function runtimeStop(options) {
@@ -502,6 +694,22 @@ export async function runtimeStop(options) {
         }
         return;
     }
+    if (state.runner === "docker") {
+        const running = Boolean(state.containerId && dockerContainerRunning(state.containerId));
+        if (state.containerId) {
+            stopDockerContainer(state.containerId);
+        }
+        clearState();
+        await sendOfflineBeat(state);
+        const result = { stopped: running, containerId: state.containerId ?? null };
+        if (options?.json) {
+            console.log(JSON.stringify(result));
+        }
+        else {
+            console.log(running ? kleur.green("Runtime stopped.") : kleur.yellow("Runtime not running."));
+        }
+        return;
+    }
     if (!isProcessAlive(state.pid)) {
         clearState();
         if (options?.json) {
@@ -552,9 +760,10 @@ export async function runtimeToken(options) {
     const token = options.controllerAccessToken ??
         process.env["INSTAFY_ACCESS_TOKEN"] ??
         process.env["CONTROLLER_ACCESS_TOKEN"] ??
-        process.env["SUPABASE_ACCESS_TOKEN"];
+        process.env["SUPABASE_ACCESS_TOKEN"] ??
+        resolveConfiguredAccessToken();
     if (!token) {
-        throw new Error("Access token is required (--access-token, INSTAFY_ACCESS_TOKEN, or SUPABASE_ACCESS_TOKEN).");
+        throw new Error("Login required. Run `instafy login` or pass --access-token / set SUPABASE_ACCESS_TOKEN.");
     }
     const minted = await mintRuntimeAccessToken({
         controllerUrl,

package/dist/tunnel.js

@@ -3,7 +3,8 @@ import os from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
 import kleur from "kleur";
-import { resolveRatholeBinaryForCli } from "./runtime.js";
+import { findProjectManifest, resolveRatholeBinaryForCli } from "./runtime.js";
+import { resolveConfiguredControllerUrl, resolveUserAccessToken } from "./config.js";
 function cleanUrl(raw) {
     return raw.replace(/\/+$/, "");
 }
@@ -14,31 +15,59 @@ function readEnv(key) {
     return undefined;
 }
 function resolveProject(opts) {
-    return (opts.project?.trim() ||
+    const explicit = opts.project?.trim() ||
         readEnv("PROJECT_ID") ||
         readEnv("CONTROLLER_PROJECT_ID") ||
-        (() => {
-            throw new Error("Project id is required (--project or PROJECT_ID)");
-        })());
+        null;
+    if (explicit) {
+        return explicit;
+    }
+    const manifest = findProjectManifest(process.cwd()).manifest;
+    if (manifest?.projectId) {
+        return manifest.projectId;
+    }
+    throw new Error("No project configured. Run `instafy project:init` or pass --project.");
 }
 function resolveControllerUrl(opts) {
-    return (opts.controllerUrl?.trim() ||
-        readEnv("INSTAFY_SERVER_URL") ||
+    const explicit = opts.controllerUrl?.trim();
+    if (explicit) {
+        return explicit;
+    }
+    const envUrl = readEnv("INSTAFY_SERVER_URL") ||
         readEnv("INSTAFY_URL") ||
         readEnv("CONTROLLER_URL") ||
         readEnv("CONTROLLER_BASE_URL") ||
-        "http://127.0.0.1:8788");
+        null;
+    if (envUrl) {
+        return envUrl;
+    }
+    const manifestControllerUrl = findProjectManifest(process.cwd()).manifest?.controllerUrl?.trim() ?? null;
+    if (manifestControllerUrl) {
+        return manifestControllerUrl;
+    }
+    return resolveConfiguredControllerUrl() ?? "http://127.0.0.1:8788";
 }
 function resolveControllerToken(opts) {
-    return (opts.controllerToken?.trim() ||
-        readEnv("INSTAFY_SERVICE_TOKEN") ||
+    const explicit = opts.controllerToken?.trim();
+    if (explicit) {
+        return explicit;
+    }
+    const accessToken = resolveUserAccessToken();
+    if (accessToken) {
+        return accessToken;
+    }
+    const serviceToken = readEnv("INSTAFY_SERVICE_TOKEN") ||
         readEnv("CONTROLLER_BEARER") ||
+        readEnv("CONTROLLER_TOKEN") ||
         readEnv("SERVICE_ROLE_KEY") ||
+        readEnv("CONTROLLER_SERVICE_ROLE_KEY") ||
         readEnv("SUPABASE_SERVICE_ROLE_KEY") ||
         readEnv("CONTROLLER_INTERNAL_TOKEN") ||
-        (() => {
-            throw new Error("Service token is required (--service-token, INSTAFY_SERVICE_TOKEN, or SERVICE_ROLE_KEY).");
-        })());
+        null;
+    if (serviceToken) {
+        return serviceToken;
+    }
+    throw new Error("Login required. Run `instafy login`, pass --access-token, or provide --service-token / INSTAFY_SERVICE_TOKEN.");
 }
 function resolvePort(opts) {
     const fromEnv = readEnv("WEBHOOK_LOCAL_PORT") ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instafy/cli",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Run Instafy projects locally, link folders to Studio, and share previews/webhooks via tunnels.",
   "private": false,
   "publishConfig": {