@instafy/cli 0.1.8 → 0.1.9

package/README.md

@@ -7,22 +7,29 @@ Run Instafy projects locally and connect them back to Instafy Studio — from an
 ## Quickstart
 
 0. Log in once: `instafy login`
+   - Opens a Studio URL; the CLI continues automatically after you sign in.
+   - Also enables Git auth (credential helper) for Instafy Git Service. Disable with `instafy login --no-git-setup`.
+   - Multiple accounts: `instafy login --profile work` (then bind folders with `instafy project init --profile work` or `instafy project profile work`).
    - Optional: set defaults with `instafy config set controller-url <url>` / `instafy config set studio-url <url>`
 1. Link a folder to a project:
    - VS Code: install the Instafy extension and run `Instafy: Link Workspace to Project`, or
-   - Terminal: `instafy project:init`
-2. Start the runtime: `instafy runtime:start`
+   - Terminal: `instafy project init`
+2. Start the runtime: `instafy runtime start`
 3. Check status / stop:
-   - `instafy runtime:status`
-   - `instafy runtime:stop`
+   - `instafy runtime status`
+   - `instafy runtime stop`
 
 ## Common commands
 
-- `instafy runtime:start` — start a local runtime (agent + origin).
-- `instafy runtime:status` — show health of the last started runtime.
-- `instafy runtime:stop` — stop the last started runtime.
-- `instafy tunnel` — request a tunnel and forward a local port.
-- `instafy api:get` — query controller endpoints (conversations, messages, runs, etc).
+ - `instafy runtime start` — start a local runtime (agent + origin).
+- `instafy runtime status` — show health of the last started runtime.
+ - `instafy runtime stop` — stop the last started runtime.
+- `instafy git <args...>` — run git commands against an Instafy canonical checkout (`.instafy/.git`) when present.
+- `instafy tunnel start` — start a detached tunnel for a local port.
+  - `instafy tunnel list` — list local tunnels started by the CLI.
+  - `instafy tunnel logs <tunnelId> --follow` — tail tunnel logs.
+  - `instafy tunnel stop <tunnelId>` — stop + revoke a tunnel.
+- `instafy api get` — query controller endpoints (conversations, messages, runs, etc).
 
 Run `instafy --help` for the full command list and options.
 

package/dist/api.js

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import { resolveConfiguredAccessToken } from "./config.js";
+import { formatAuthRejectedError } from "./errors.js";
 function normalizeUrl(raw) {
     const value = (raw ?? "").trim();
     if (!value)
@@ -123,6 +124,14 @@ export async function requestControllerApi(options) {
     const pretty = options.pretty !== false;
     const formattedBody = isJson ? maybePrettyPrintJson(responseText, pretty) : responseText;
     if (!response.ok) {
+        if (response.status === 401 || response.status === 403) {
+            throw formatAuthRejectedError({
+                status: response.status,
+                responseBody: responseText,
+                retryCommand: "instafy login",
+                advancedHint: "pass --access-token / --service-token, or set INSTAFY_ACCESS_TOKEN / INSTAFY_SERVICE_TOKEN",
+            });
+        }
         const prefix = `Request failed (${response.status} ${response.statusText})`;
         const suffix = formattedBody.trim() ? `: ${formattedBody}` : "";
         throw new Error(`${prefix}${suffix}`);

package/dist/auth.js

@@ -1,7 +1,22 @@
 import kleur from "kleur";
+import { randomBytes } from "node:crypto";
+import * as http from "node:http";
+import { createRequire } from "node:module";
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
-import { clearInstafyCliConfig, getInstafyConfigPath, resolveConfiguredStudioUrl, resolveControllerUrl, resolveUserAccessToken, writeInstafyCliConfig, } from "./config.js";
+import { clearInstafyCliConfig, clearInstafyProfileConfig, getInstafyConfigPath, getInstafyProfileConfigPath, resolveConfiguredControllerUrl, resolveConfiguredStudioUrl, resolveUserAccessToken, writeInstafyCliConfig, writeInstafyProfileConfig, } from "./config.js";
+import { installGitCredentialHelper, uninstallGitCredentialHelper } from "./git-setup.js";
+const require = createRequire(import.meta.url);
+const cliVersion = (() => {
+    try {
+        const pkg = require("../package.json");
+        return typeof pkg.version === "string" ? pkg.version : "";
+    }
+    catch {
+        return "";
+    }
+})();
+const isStagingCli = cliVersion.includes("-staging.");
 function normalizeUrl(raw) {
     const trimmed = typeof raw === "string" ? raw.trim() : "";
     if (!trimmed) {
@@ -20,6 +35,26 @@ function normalizeToken(raw) {
     }
     return trimmed;
 }
+async function loginWithPassword(params) {
+    const response = await fetch(`${params.supabaseUrl}/auth/v1/token?grant_type=password`, {
+        method: "POST",
+        headers: {
+            apikey: params.supabaseAnonKey,
+            "content-type": "application/json",
+        },
+        body: JSON.stringify({ email: params.email, password: params.password }),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Supabase login failed (${response.status}): ${text}`);
+    }
+    const body = (await response.json());
+    const accessToken = typeof body["access_token"] === "string" ? body["access_token"] : null;
+    if (!accessToken) {
+        throw new Error("Supabase login response missing access_token");
+    }
+    return accessToken;
+}
 function looksLikeLocalControllerUrl(controllerUrl) {
     try {
         const parsed = new URL(controllerUrl);
@@ -30,35 +65,337 @@ function looksLikeLocalControllerUrl(controllerUrl) {
         return controllerUrl.includes("127.0.0.1") || controllerUrl.includes("localhost");
     }
 }
-function deriveDefaultStudioUrl(controllerUrl) {
-    if (looksLikeLocalControllerUrl(controllerUrl)) {
-        return "http://localhost:5173";
+async function isStudioHealthy(studioUrl, timeoutMs) {
+    const target = new URL("/cli/login", studioUrl).toString();
+    const abort = new AbortController();
+    const timeout = setTimeout(() => abort.abort(), timeoutMs);
+    timeout.unref?.();
+    try {
+        const response = await fetch(target, { signal: abort.signal });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function resolveDefaultStudioUrl(controllerUrl) {
+    const hosted = "https://staging.instafy.dev";
+    if (isStagingCli) {
+        return hosted;
+    }
+    if (!looksLikeLocalControllerUrl(controllerUrl)) {
+        return hosted;
     }
-    return "https://staging.instafy.dev";
+    const local = "http://localhost:5173";
+    const healthy = await isStudioHealthy(local, 250);
+    return healthy ? local : hosted;
+}
+async function isControllerHealthy(controllerUrl, timeoutMs) {
+    const target = `${controllerUrl.replace(/\/$/, "")}/healthz`;
+    const abort = new AbortController();
+    const timeout = setTimeout(() => abort.abort(), timeoutMs);
+    timeout.unref?.();
+    try {
+        const response = await fetch(target, { signal: abort.signal });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function readRequestBody(request, maxBytes = 1000000) {
+    return new Promise((resolve, reject) => {
+        let buffer = "";
+        request.setEncoding("utf8");
+        request.on("data", (chunk) => {
+            buffer += chunk;
+            if (buffer.length > maxBytes) {
+                reject(new Error("Request body too large."));
+                request.destroy();
+            }
+        });
+        request.on("end", () => resolve(buffer));
+        request.on("error", (error) => reject(error));
+    });
+}
+function applyCorsHeaders(request, response) {
+    const origin = typeof request.headers.origin === "string" ? request.headers.origin : "";
+    if (origin) {
+        response.setHeader("access-control-allow-origin", origin);
+        response.setHeader("vary", "origin");
+    }
+    else {
+        response.setHeader("access-control-allow-origin", "*");
+    }
+    response.setHeader("access-control-allow-methods", "POST, OPTIONS");
+    response.setHeader("access-control-allow-headers", "content-type");
+    // Private Network Access preflight (Chrome): allow https -> http://127.0.0.1 callbacks.
+    if (request.headers["access-control-request-private-network"] === "true") {
+        response.setHeader("access-control-allow-private-network", "true");
+    }
+}
+async function startCliLoginCallbackServer() {
+    const state = randomBytes(16).toString("hex");
+    let resolved = false;
+    let resolveToken = null;
+    let rejectToken = null;
+    const tokenPromise = new Promise((resolve, reject) => {
+        resolveToken = resolve;
+        rejectToken = reject;
+    });
+    const server = http.createServer(async (request, response) => {
+        applyCorsHeaders(request, response);
+        if (request.method === "OPTIONS") {
+            response.statusCode = 204;
+            response.end();
+            return;
+        }
+        const url = new URL(request.url ?? "/", "http://127.0.0.1");
+        if (request.method !== "POST" || url.pathname !== "/callback") {
+            response.statusCode = 404;
+            response.setHeader("content-type", "application/json");
+            response.end(JSON.stringify({ ok: false, error: "Not found" }));
+            return;
+        }
+        if (resolved) {
+            response.statusCode = 409;
+            response.setHeader("content-type", "application/json");
+            response.end(JSON.stringify({ ok: false, error: "Already completed" }));
+            return;
+        }
+        try {
+            const body = await readRequestBody(request);
+            const contentType = typeof request.headers["content-type"] === "string" ? request.headers["content-type"] : "";
+            let parsedToken = null;
+            let parsedState = null;
+            if (contentType.includes("application/json")) {
+                const json = JSON.parse(body);
+                parsedToken = typeof json.token === "string" ? json.token : null;
+                parsedState = typeof json.state === "string" ? json.state : null;
+            }
+            else {
+                const params = new URLSearchParams(body);
+                parsedToken = params.get("token");
+                parsedState = params.get("state");
+            }
+            const token = normalizeToken(parsedToken);
+            const receivedState = normalizeToken(parsedState);
+            if (!token) {
+                response.statusCode = 400;
+                response.setHeader("content-type", "application/json");
+                response.end(JSON.stringify({ ok: false, error: "Missing token" }));
+                return;
+            }
+            if (!receivedState || receivedState !== state) {
+                response.statusCode = 403;
+                response.setHeader("content-type", "application/json");
+                response.end(JSON.stringify({ ok: false, error: "Invalid state" }));
+                return;
+            }
+            resolved = true;
+            response.statusCode = 200;
+            response.setHeader("content-type", "application/json");
+            response.end(JSON.stringify({ ok: true }));
+            resolveToken?.(token);
+            resolveToken = null;
+        }
+        catch (error) {
+            response.statusCode = 500;
+            response.setHeader("content-type", "application/json");
+            response.end(JSON.stringify({ ok: false, error: error instanceof Error ? error.message : String(error) }));
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const address = server.address();
+    if (!address || typeof address !== "object" || typeof address.port !== "number") {
+        server.close();
+        throw new Error("Failed to start login callback server.");
+    }
+    return {
+        callbackUrl: `http://127.0.0.1:${address.port}/callback`,
+        state,
+        waitForToken: async (timeoutMs) => {
+            if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+                return tokenPromise;
+            }
+            const timeout = setTimeout(() => {
+                if (resolved)
+                    return;
+                resolved = true;
+                rejectToken?.(new Error("Timed out waiting for browser login. Copy the token and paste it into the CLI instead."));
+                rejectToken = null;
+            }, timeoutMs);
+            timeout.unref?.();
+            try {
+                return await tokenPromise;
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+        },
+        cancel: () => {
+            if (resolved)
+                return;
+            resolved = true;
+            rejectToken?.(new Error("Login cancelled."));
+            rejectToken = null;
+            resolveToken = null;
+        },
+        close: () => server.close(),
+    };
 }
 export async function login(options) {
-    const controllerUrl = resolveControllerUrl({ controllerUrl: options.controllerUrl ?? null });
+    const profile = typeof options.profile === "string" && options.profile.trim() ? options.profile.trim() : null;
+    const explicitControllerUrl = normalizeUrl(options.controllerUrl ?? null) ??
+        normalizeUrl(process.env["INSTAFY_SERVER_URL"] ?? null) ??
+        normalizeUrl(process.env["CONTROLLER_BASE_URL"] ?? null) ??
+        (isStagingCli ? null : resolveConfiguredControllerUrl({ profile }));
+    const defaultLocalControllerUrl = "http://127.0.0.1:8788";
+    const defaultHostedControllerUrl = "https://controller.instafy.dev";
+    const controllerUrl = explicitControllerUrl ??
+        (isStagingCli
+            ? defaultHostedControllerUrl
+            : (await isControllerHealthy(defaultLocalControllerUrl, 250))
+                ? defaultLocalControllerUrl
+                : defaultHostedControllerUrl);
     const studioUrl = normalizeUrl(options.studioUrl ?? null) ??
         normalizeUrl(process.env["INSTAFY_STUDIO_URL"] ?? null) ??
-        resolveConfiguredStudioUrl() ??
-        deriveDefaultStudioUrl(controllerUrl);
+        (isStagingCli ? null : resolveConfiguredStudioUrl({ profile })) ??
+        (await resolveDefaultStudioUrl(controllerUrl));
     const url = new URL("/cli/login", studioUrl);
     url.searchParams.set("serverUrl", controllerUrl);
     if (options.json) {
-        console.log(JSON.stringify({ url: url.toString(), configPath: getInstafyConfigPath() }));
+        console.log(JSON.stringify({
+            url: url.toString(),
+            profile,
+            configPath: profile ? getInstafyProfileConfigPath(profile) : getInstafyConfigPath(),
+        }));
         return;
     }
-    console.log(kleur.green("Instafy CLI login"));
-    console.log("");
-    console.log("1) Open this URL in your browser:");
-    console.log(kleur.cyan(url.toString()));
-    console.log("");
-    console.log("2) After you sign in, copy the token shown on that page.");
-    console.log("");
+    const existing = resolveUserAccessToken({ profile });
     const provided = normalizeToken(options.token ?? null);
-    const existing = resolveUserAccessToken();
     let token = provided;
+    let usedPasswordGrant = false;
+    if (!token) {
+        const email = normalizeToken(options.email ?? null) ?? normalizeToken(process.env["INSTAFY_LOGIN_EMAIL"] ?? null);
+        const password = normalizeToken(options.password ?? null) ??
+            normalizeToken(process.env["INSTAFY_LOGIN_PASSWORD"] ?? null);
+        if (email && password) {
+            const supabaseUrl = normalizeUrl(process.env["SUPABASE_URL"] ?? null) ??
+                normalizeUrl(process.env["VITE_SUPABASE_URL"] ?? null) ??
+                normalizeUrl(process.env["SUPABASE_PROJECT_URL"] ?? null);
+            const supabaseAnonKey = normalizeToken(process.env["SUPABASE_ANON_KEY"] ?? null) ??
+                normalizeToken(process.env["VITE_SUPABASE_ANON_KEY"] ?? null);
+            if (!supabaseUrl || !supabaseAnonKey) {
+                throw new Error("Email/password login requires Supabase env.\n\nSet:\n- SUPABASE_URL + SUPABASE_ANON_KEY (or VITE_SUPABASE_URL + VITE_SUPABASE_ANON_KEY)\n\nThen retry: instafy login --email <email> --password <password>");
+            }
+            token = await loginWithPassword({ supabaseUrl, supabaseAnonKey, email, password });
+            usedPasswordGrant = true;
+        }
+    }
+    let callbackServer = null;
+    if (!token) {
+        try {
+            callbackServer = await startCliLoginCallbackServer();
+            url.searchParams.set("cliCallbackUrl", callbackServer.callbackUrl);
+            url.searchParams.set("cliState", callbackServer.state);
+        }
+        catch {
+            callbackServer = null;
+        }
+    }
+    console.log(kleur.green("Instafy CLI login"));
+    console.log("");
+    if (!token) {
+        console.log("1) Open this URL in your browser:");
+        console.log(kleur.cyan(url.toString()));
+        console.log("");
+        if (callbackServer) {
+            console.log("2) Sign in — this terminal should continue automatically.");
+            console.log(kleur.gray("If it doesn't, copy the token shown on that page and paste it here."));
+        }
+        else {
+            console.log("2) After you sign in, copy the token shown on that page.");
+        }
+        console.log("");
+    }
+    else if (usedPasswordGrant) {
+        console.log(kleur.gray("Authenticated via email/password."));
+        console.log("");
+    }
+    if (!token && callbackServer) {
+        if (input.isTTY) {
+            console.log(kleur.gray("Waiting for browser login…"));
+            console.log(kleur.gray("If it doesn't continue, paste the token here and press Enter."));
+            console.log("");
+            const rl = createInterface({ input, output });
+            const abort = new AbortController();
+            const manualTokenPromise = (async () => {
+                while (true) {
+                    const answer = await rl.question("Paste token (or wait): ", { signal: abort.signal });
+                    const candidate = normalizeToken(answer);
+                    if (candidate) {
+                        return candidate;
+                    }
+                }
+            })();
+            try {
+                const result = await Promise.race([
+                    callbackServer
+                        .waitForToken(10 * 60000)
+                        .then((tokenValue) => ({ source: "browser", token: tokenValue })),
+                    manualTokenPromise.then((tokenValue) => ({ source: "manual", token: tokenValue })),
+                ]);
+                token = result.token;
+                if (result.source === "browser") {
+                    abort.abort();
+                }
+                else {
+                    callbackServer.cancel();
+                }
+            }
+            catch (_error) {
+                // If browser login fails, keep waiting for a pasted token.
+                token = await manualTokenPromise;
+                callbackServer.cancel();
+            }
+            finally {
+                try {
+                    rl.close();
+                }
+                catch {
+                    // ignore
+                }
+                callbackServer.close();
+                callbackServer = null;
+            }
+        }
+        else {
+            try {
+                token = await callbackServer.waitForToken(10 * 60000);
+            }
+            catch (_error) {
+                // Ignore and fall back to manual copy/paste if possible.
+            }
+            finally {
+                callbackServer.close();
+                callbackServer = null;
+            }
+        }
+    }
     if (!token) {
+        if (!input.isTTY) {
+            throw new Error("No token provided.");
+        }
         const rl = createInterface({ input, output });
         try {
             token = normalizeToken(await rl.question("Paste token: "));
@@ -71,9 +408,25 @@ export async function login(options) {
         throw new Error("No token provided.");
     }
     if (!options.noStore) {
-        writeInstafyCliConfig({ controllerUrl, studioUrl, accessToken: token });
+        if (profile) {
+            writeInstafyProfileConfig(profile, { controllerUrl, studioUrl, accessToken: token });
+        }
+        else {
+            writeInstafyCliConfig({ controllerUrl, studioUrl, accessToken: token });
+        }
         console.log("");
-        console.log(kleur.green(`Saved token to ${getInstafyConfigPath()}`));
+        console.log(kleur.green(`Saved token to ${profile ? getInstafyProfileConfigPath(profile) : getInstafyConfigPath()}`));
+        if (options.gitSetup !== false) {
+            try {
+                const result = installGitCredentialHelper();
+                if (result.changed) {
+                    console.log(kleur.green("Enabled git auth (credential helper installed)."));
+                }
+            }
+            catch (error) {
+                console.log(kleur.yellow(`Warning: failed to configure git credential helper: ${error instanceof Error ? error.message : String(error)}`));
+            }
+        }
     }
     else if (existing) {
         console.log("");
@@ -81,14 +434,30 @@ export async function login(options) {
     }
     console.log("");
     console.log("Next:");
-    console.log(`- ${kleur.cyan("instafy project:init")}`);
-    console.log(`- ${kleur.cyan("instafy runtime:start")}`);
+    console.log(`- ${kleur.cyan("instafy project init")}`);
+    console.log(`- ${kleur.cyan("instafy runtime start")}`);
 }
 export async function logout(options) {
-    clearInstafyCliConfig(["accessToken"]);
+    if (options?.profile) {
+        clearInstafyProfileConfig(options.profile, ["accessToken"]);
+    }
+    else {
+        clearInstafyCliConfig(["accessToken"]);
+        try {
+            uninstallGitCredentialHelper();
+        }
+        catch {
+            // ignore git helper cleanup failures
+        }
+    }
     if (options?.json) {
         console.log(JSON.stringify({ ok: true }));
         return;
     }
-    console.log(kleur.green("Logged out (cleared saved access token)."));
+    if (options?.profile) {
+        console.log(kleur.green(`Logged out (cleared saved access token for profile "${options.profile}").`));
+    }
+    else {
+        console.log(kleur.green("Logged out (cleared saved access token)."));
+    }
 }