@instafy/cli 0.1.9 → 0.1.11

package/dist/api.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
-import { resolveConfiguredAccessToken } from "./config.js";
+import { resolveActiveProfileName, resolveConfiguredAccessToken } from "./config.js";
 import { formatAuthRejectedError } from "./errors.js";
+import { fetchWithControllerAuth } from "./controller-fetch.js";
 function normalizeUrl(raw) {
     const value = (raw ?? "").trim();
     if (!value)
@@ -13,15 +14,31 @@ function normalizeToken(raw) {
     const trimmed = raw.trim();
     return trimmed.length ? trimmed : null;
 }
-function resolveBearerToken(options) {
-    return (normalizeToken(options.accessToken) ??
-        normalizeToken(options.serviceToken) ??
-        normalizeToken(process.env["CONTROLLER_ACCESS_TOKEN"]) ??
-        normalizeToken(process.env["INSTAFY_ACCESS_TOKEN"]) ??
-        normalizeToken(process.env["INSTAFY_SERVICE_TOKEN"]) ??
-        normalizeToken(process.env["CONTROLLER_TOKEN"]) ??
-        normalizeToken(process.env["SUPABASE_ACCESS_TOKEN"]) ??
-        resolveConfiguredAccessToken());
+function resolveBearerTokenWithSource(options) {
+    const cwd = process.cwd();
+    const profile = resolveActiveProfileName({ cwd });
+    const stored = resolveConfiguredAccessToken({ profile, cwd });
+    const explicit = normalizeToken(options.accessToken) ?? normalizeToken(options.serviceToken);
+    if (explicit) {
+        return { token: explicit, source: "explicit", profile };
+    }
+    const envKeys = [
+        "CONTROLLER_ACCESS_TOKEN",
+        "INSTAFY_ACCESS_TOKEN",
+        "INSTAFY_SERVICE_TOKEN",
+        "CONTROLLER_TOKEN",
+        "SUPABASE_ACCESS_TOKEN",
+    ];
+    for (const key of envKeys) {
+        const value = normalizeToken(process.env[key]);
+        if (value) {
+            return { token: value, source: "env", profile };
+        }
+    }
+    if (stored) {
+        return { token: stored, source: "config", profile };
+    }
+    return { token: null, source: "none", profile };
 }
 function parseKeyValue(raw) {
     const trimmed = raw.trim();
@@ -99,12 +116,10 @@ function maybePrettyPrintJson(text, pretty) {
 }
 export async function requestControllerApi(options) {
     const url = buildRequestUrl(options);
-    const bearer = resolveBearerToken(options);
+    const resolved = resolveBearerTokenWithSource(options);
+    const bearer = resolved.token;
     const headers = new Headers();
     headers.set("accept", "application/json");
-    if (bearer) {
-        headers.set("authorization", `Bearer ${bearer}`);
-    }
     for (const header of options.headers ?? []) {
         const { key, value } = parseHeader(header);
         headers.set(key, value);
@@ -113,11 +128,21 @@ export async function requestControllerApi(options) {
     if (body !== undefined && !headers.has("content-type")) {
         headers.set("content-type", "application/json");
     }
-    const response = await fetch(url, {
+    const init = {
         method: options.method,
         headers,
         body,
-    });
+    };
+    const response = bearer
+        ? (await fetchWithControllerAuth({
+            url: url.toString(),
+            init,
+            accessToken: bearer,
+            tokenSource: resolved.source,
+            profile: resolved.profile,
+            cwd: process.cwd(),
+        })).response
+        : await fetch(url, init);
     const responseText = await response.text().catch(() => "");
     const contentType = response.headers.get("content-type") ?? "";
     const isJson = contentType.includes("application/json") || contentType.includes("+json");

package/dist/auth.js

@@ -53,7 +53,13 @@ async function loginWithPassword(params) {
     if (!accessToken) {
         throw new Error("Supabase login response missing access_token");
     }
-    return accessToken;
+    const refreshToken = typeof body["refresh_token"] === "string" ? body["refresh_token"] : null;
+    return {
+        accessToken,
+        refreshToken: normalizeToken(refreshToken),
+        supabaseUrl: normalizeUrl(params.supabaseUrl),
+        supabaseAnonKey: normalizeToken(params.supabaseAnonKey),
+    };
 }
 function looksLikeLocalControllerUrl(controllerUrl) {
     try {
@@ -173,18 +179,47 @@ async function startCliLoginCallbackServer() {
             const body = await readRequestBody(request);
             const contentType = typeof request.headers["content-type"] === "string" ? request.headers["content-type"] : "";
             let parsedToken = null;
+            let parsedRefreshToken = null;
+            let parsedSupabaseUrl = null;
+            let parsedSupabaseAnonKey = null;
             let parsedState = null;
             if (contentType.includes("application/json")) {
                 const json = JSON.parse(body);
-                parsedToken = typeof json.token === "string" ? json.token : null;
+                parsedToken =
+                    typeof json.token === "string"
+                        ? json.token
+                        : typeof json.accessToken === "string"
+                            ? json.accessToken
+                            : typeof json.access_token === "string"
+                                ? json.access_token
+                                : null;
+                parsedRefreshToken =
+                    typeof json.refreshToken === "string"
+                        ? json.refreshToken
+                        : typeof json.refresh_token === "string"
+                            ? json.refresh_token
+                            : null;
+                parsedSupabaseUrl = typeof json.supabaseUrl === "string" ? json.supabaseUrl : null;
+                parsedSupabaseAnonKey =
+                    typeof json.supabaseAnonKey === "string"
+                        ? json.supabaseAnonKey
+                        : typeof json.supabase_anon_key === "string"
+                            ? json.supabase_anon_key
+                            : null;
                 parsedState = typeof json.state === "string" ? json.state : null;
             }
             else {
                 const params = new URLSearchParams(body);
                 parsedToken = params.get("token");
+                parsedRefreshToken = params.get("refreshToken") ?? params.get("refresh_token");
+                parsedSupabaseUrl = params.get("supabaseUrl") ?? params.get("supabase_url");
+                parsedSupabaseAnonKey = params.get("supabaseAnonKey") ?? params.get("supabase_anon_key");
                 parsedState = params.get("state");
             }
             const token = normalizeToken(parsedToken);
+            const refreshToken = normalizeToken(parsedRefreshToken);
+            const supabaseUrl = normalizeUrl(parsedSupabaseUrl);
+            const supabaseAnonKey = normalizeToken(parsedSupabaseAnonKey);
             const receivedState = normalizeToken(parsedState);
             if (!token) {
                 response.statusCode = 400;
@@ -202,7 +237,12 @@ async function startCliLoginCallbackServer() {
             response.statusCode = 200;
             response.setHeader("content-type", "application/json");
             response.end(JSON.stringify({ ok: true }));
-            resolveToken?.(token);
+            resolveToken?.({
+                accessToken: token,
+                refreshToken,
+                supabaseUrl,
+                supabaseAnonKey,
+            });
             resolveToken = null;
         }
         catch (error) {
@@ -283,9 +323,11 @@ export async function login(options) {
     }
     const existing = resolveUserAccessToken({ profile });
     const provided = normalizeToken(options.token ?? null);
-    let token = provided;
+    let authPayload = provided
+        ? { accessToken: provided, refreshToken: null, supabaseUrl: null, supabaseAnonKey: null }
+        : null;
     let usedPasswordGrant = false;
-    if (!token) {
+    if (!authPayload) {
         const email = normalizeToken(options.email ?? null) ?? normalizeToken(process.env["INSTAFY_LOGIN_EMAIL"] ?? null);
         const password = normalizeToken(options.password ?? null) ??
             normalizeToken(process.env["INSTAFY_LOGIN_PASSWORD"] ?? null);
@@ -298,12 +340,12 @@ export async function login(options) {
             if (!supabaseUrl || !supabaseAnonKey) {
                 throw new Error("Email/password login requires Supabase env.\n\nSet:\n- SUPABASE_URL + SUPABASE_ANON_KEY (or VITE_SUPABASE_URL + VITE_SUPABASE_ANON_KEY)\n\nThen retry: instafy login --email <email> --password <password>");
             }
-            token = await loginWithPassword({ supabaseUrl, supabaseAnonKey, email, password });
+            authPayload = await loginWithPassword({ supabaseUrl, supabaseAnonKey, email, password });
             usedPasswordGrant = true;
         }
     }
     let callbackServer = null;
-    if (!token) {
+    if (!authPayload) {
         try {
             callbackServer = await startCliLoginCallbackServer();
             url.searchParams.set("cliCallbackUrl", callbackServer.callbackUrl);
@@ -315,7 +357,7 @@ export async function login(options) {
     }
     console.log(kleur.green("Instafy CLI login"));
     console.log("");
-    if (!token) {
+    if (!authPayload) {
         console.log("1) Open this URL in your browser:");
         console.log(kleur.cyan(url.toString()));
         console.log("");
@@ -332,7 +374,7 @@ export async function login(options) {
         console.log(kleur.gray("Authenticated via email/password."));
         console.log("");
     }
-    if (!token && callbackServer) {
+    if (!authPayload && callbackServer) {
         if (input.isTTY) {
             console.log(kleur.gray("Waiting for browser login…"));
             console.log(kleur.gray("If it doesn't continue, paste the token here and press Enter."));
@@ -343,9 +385,40 @@ export async function login(options) {
                 while (true) {
                     const answer = await rl.question("Paste token (or wait): ", { signal: abort.signal });
                     const candidate = normalizeToken(answer);
-                    if (candidate) {
-                        return candidate;
+                    if (!candidate)
+                        continue;
+                    if (candidate.startsWith("{")) {
+                        try {
+                            const json = JSON.parse(candidate);
+                            const accessToken = typeof json.accessToken === "string"
+                                ? json.accessToken
+                                : typeof json.access_token === "string"
+                                    ? json.access_token
+                                    : typeof json.token === "string"
+                                        ? json.token
+                                        : "";
+                            if (accessToken.trim()) {
+                                return {
+                                    accessToken: accessToken.trim(),
+                                    refreshToken: typeof json.refreshToken === "string"
+                                        ? json.refreshToken.trim()
+                                        : typeof json.refresh_token === "string"
+                                            ? json.refresh_token.trim()
+                                            : null,
+                                    supabaseUrl: typeof json.supabaseUrl === "string" ? json.supabaseUrl.trim() : null,
+                                    supabaseAnonKey: typeof json.supabaseAnonKey === "string"
+                                        ? json.supabaseAnonKey.trim()
+                                        : typeof json.supabase_anon_key === "string"
+                                            ? json.supabase_anon_key.trim()
+                                            : null,
+                                };
+                            }
+                        }
+                        catch {
+                            // ignore and fall back to treating this as an access token
+                        }
                     }
+                    return { accessToken: candidate, refreshToken: null, supabaseUrl: null, supabaseAnonKey: null };
                 }
             })();
             try {
@@ -355,7 +428,7 @@ export async function login(options) {
                         .then((tokenValue) => ({ source: "browser", token: tokenValue })),
                     manualTokenPromise.then((tokenValue) => ({ source: "manual", token: tokenValue })),
                 ]);
-                token = result.token;
+                authPayload = result.token;
                 if (result.source === "browser") {
                     abort.abort();
                 }
@@ -365,7 +438,7 @@ export async function login(options) {
             }
             catch (_error) {
                 // If browser login fails, keep waiting for a pasted token.
-                token = await manualTokenPromise;
+                authPayload = await manualTokenPromise;
                 callbackServer.cancel();
             }
             finally {
@@ -381,7 +454,7 @@ export async function login(options) {
         }
         else {
             try {
-                token = await callbackServer.waitForToken(10 * 60000);
+                authPayload = await callbackServer.waitForToken(10 * 60000);
             }
             catch (_error) {
                 // Ignore and fall back to manual copy/paste if possible.
@@ -392,27 +465,69 @@ export async function login(options) {
             }
         }
     }
-    if (!token) {
+    if (!authPayload?.accessToken) {
         if (!input.isTTY) {
             throw new Error("No token provided.");
         }
         const rl = createInterface({ input, output });
         try {
-            token = normalizeToken(await rl.question("Paste token: "));
+            const raw = normalizeToken(await rl.question("Paste token: "));
+            if (raw) {
+                if (raw.startsWith("{")) {
+                    try {
+                        const json = JSON.parse(raw);
+                        const accessToken = typeof json.accessToken === "string"
+                            ? json.accessToken
+                            : typeof json.access_token === "string"
+                                ? json.access_token
+                                : typeof json.token === "string"
+                                    ? json.token
+                                    : "";
+                        if (accessToken.trim()) {
+                            authPayload = {
+                                accessToken: accessToken.trim(),
+                                refreshToken: typeof json.refreshToken === "string"
+                                    ? json.refreshToken.trim()
+                                    : typeof json.refresh_token === "string"
+                                        ? json.refresh_token.trim()
+                                        : null,
+                                supabaseUrl: typeof json.supabaseUrl === "string" ? json.supabaseUrl.trim() : null,
+                                supabaseAnonKey: typeof json.supabaseAnonKey === "string"
+                                    ? json.supabaseAnonKey.trim()
+                                    : typeof json.supabase_anon_key === "string"
+                                        ? json.supabase_anon_key.trim()
+                                        : null,
+                            };
+                        }
+                    }
+                    catch {
+                        // ignore and fall through to raw token
+                    }
+                }
+                authPayload ?? (authPayload = { accessToken: raw, refreshToken: null, supabaseUrl: null, supabaseAnonKey: null });
+            }
         }
         finally {
             rl.close();
         }
     }
-    if (!token) {
+    if (!authPayload?.accessToken) {
         throw new Error("No token provided.");
     }
     if (!options.noStore) {
+        const update = {
+            controllerUrl,
+            studioUrl,
+            accessToken: authPayload.accessToken,
+            refreshToken: authPayload.refreshToken ?? undefined,
+            supabaseUrl: authPayload.supabaseUrl ?? undefined,
+            supabaseAnonKey: authPayload.supabaseAnonKey ?? undefined,
+        };
         if (profile) {
-            writeInstafyProfileConfig(profile, { controllerUrl, studioUrl, accessToken: token });
+            writeInstafyProfileConfig(profile, update);
         }
         else {
-            writeInstafyCliConfig({ controllerUrl, studioUrl, accessToken: token });
+            writeInstafyCliConfig(update);
         }
         console.log("");
         console.log(kleur.green(`Saved token to ${profile ? getInstafyProfileConfigPath(profile) : getInstafyConfigPath()}`));
@@ -439,10 +554,10 @@ export async function login(options) {
 }
 export async function logout(options) {
     if (options?.profile) {
-        clearInstafyProfileConfig(options.profile, ["accessToken"]);
+        clearInstafyProfileConfig(options.profile, ["accessToken", "refreshToken", "supabaseUrl", "supabaseAnonKey"]);
     }
     else {
-        clearInstafyCliConfig(["accessToken"]);
+        clearInstafyCliConfig(["accessToken", "refreshToken", "supabaseUrl", "supabaseAnonKey"]);
         try {
             uninstallGitCredentialHelper();
         }

package/dist/config-command.js

@@ -51,6 +51,7 @@ export function configList(options) {
         controllerUrl: config.controllerUrl ?? null,
         studioUrl: config.studioUrl ?? null,
         accessTokenSet: Boolean(config.accessToken),
+        refreshTokenSet: Boolean(config.refreshToken),
         updatedAt: config.updatedAt ?? null,
     };
     if (options?.json) {
@@ -62,6 +63,7 @@ export function configList(options) {
     console.log(`controller-url: ${payload.controllerUrl ?? kleur.yellow("(not set)")}`);
     console.log(`studio-url: ${payload.studioUrl ?? kleur.yellow("(not set)")}`);
     console.log(`access-token: ${payload.accessTokenSet ? kleur.green("(set)") : kleur.yellow("(not set)")}`);
+    console.log(`refresh-token: ${payload.refreshTokenSet ? kleur.green("(set)") : kleur.yellow("(not set)")}`);
     if (payload.updatedAt) {
         console.log(`updated-at: ${payload.updatedAt}`);
     }

package/dist/config.js

@@ -92,6 +92,9 @@ export function readInstafyCliConfig() {
             controllerUrl: normalizeUrl(typeof record.controllerUrl === "string" ? record.controllerUrl : null),
             studioUrl: normalizeUrl(typeof record.studioUrl === "string" ? record.studioUrl : null),
             accessToken: normalizeToken(typeof record.accessToken === "string" ? record.accessToken : null),
+            refreshToken: normalizeToken(typeof record.refreshToken === "string" ? record.refreshToken : null),
+            supabaseUrl: normalizeUrl(typeof record.supabaseUrl === "string" ? record.supabaseUrl : null),
+            supabaseAnonKey: normalizeToken(typeof record.supabaseAnonKey === "string" ? record.supabaseAnonKey : null),
             updatedAt: typeof record.updatedAt === "string" ? record.updatedAt : null,
         };
     }
@@ -112,6 +115,9 @@ export function readInstafyProfileConfig(profile) {
             controllerUrl: normalizeUrl(typeof record.controllerUrl === "string" ? record.controllerUrl : null),
             studioUrl: normalizeUrl(typeof record.studioUrl === "string" ? record.studioUrl : null),
             accessToken: normalizeToken(typeof record.accessToken === "string" ? record.accessToken : null),
+            refreshToken: normalizeToken(typeof record.refreshToken === "string" ? record.refreshToken : null),
+            supabaseUrl: normalizeUrl(typeof record.supabaseUrl === "string" ? record.supabaseUrl : null),
+            supabaseAnonKey: normalizeToken(typeof record.supabaseAnonKey === "string" ? record.supabaseAnonKey : null),
             updatedAt: typeof record.updatedAt === "string" ? record.updatedAt : null,
         };
     }
@@ -125,6 +131,9 @@ export function writeInstafyCliConfig(update) {
         controllerUrl: normalizeUrl(update.controllerUrl ?? existing.controllerUrl ?? null),
         studioUrl: normalizeUrl(update.studioUrl ?? existing.studioUrl ?? null),
         accessToken: normalizeToken(update.accessToken ?? existing.accessToken ?? null),
+        refreshToken: normalizeToken(update.refreshToken ?? existing.refreshToken ?? null),
+        supabaseUrl: normalizeUrl(update.supabaseUrl ?? existing.supabaseUrl ?? null),
+        supabaseAnonKey: normalizeToken(update.supabaseAnonKey ?? existing.supabaseAnonKey ?? null),
         updatedAt: new Date().toISOString(),
     };
     fs.mkdirSync(INSTAFY_DIR, { recursive: true });
@@ -144,6 +153,9 @@ export function writeInstafyProfileConfig(profile, update) {
         controllerUrl: normalizeUrl(update.controllerUrl ?? existing.controllerUrl ?? null),
         studioUrl: normalizeUrl(update.studioUrl ?? existing.studioUrl ?? null),
         accessToken: normalizeToken(update.accessToken ?? existing.accessToken ?? null),
+        refreshToken: normalizeToken(update.refreshToken ?? existing.refreshToken ?? null),
+        supabaseUrl: normalizeUrl(update.supabaseUrl ?? existing.supabaseUrl ?? null),
+        supabaseAnonKey: normalizeToken(update.supabaseAnonKey ?? existing.supabaseAnonKey ?? null),
         updatedAt: new Date().toISOString(),
     };
     fs.mkdirSync(PROFILES_DIR, { recursive: true });
@@ -253,3 +265,28 @@ export function resolveUserAccessToken(params) {
         normalizeToken(process.env["SUPABASE_ACCESS_TOKEN"] ?? null) ??
         normalizeToken(config.accessToken ?? null));
 }
+export function resolveUserAccessTokenWithSource(params) {
+    const profile = resolveActiveProfileName({ profile: params?.profile ?? null, cwd: params?.cwd ?? null });
+    const config = profile ? readInstafyProfileConfig(profile) : readInstafyCliConfig();
+    const explicit = normalizeToken(params?.accessToken ?? null);
+    if (explicit) {
+        return { token: explicit, source: "explicit", profile };
+    }
+    const envKeys = [
+        "INSTAFY_ACCESS_TOKEN",
+        "CONTROLLER_ACCESS_TOKEN",
+        "RUNTIME_ACCESS_TOKEN",
+        "SUPABASE_ACCESS_TOKEN",
+    ];
+    for (const key of envKeys) {
+        const value = normalizeToken(process.env[key] ?? null);
+        if (value) {
+            return { token: value, source: "env", profile };
+        }
+    }
+    const stored = normalizeToken(config.accessToken ?? null);
+    if (stored) {
+        return { token: stored, source: "config", profile };
+    }
+    return { token: null, source: "none", profile };
+}

package/dist/controller-fetch.js

@@ -0,0 +1,33 @@
+import { extractControllerErrorMessage } from "./errors.js";
+import { refreshStoredSupabaseSession } from "./supabase-session.js";
+function shouldAttemptRefresh(status, body) {
+    if (status !== 401) {
+        return false;
+    }
+    const message = extractControllerErrorMessage(body) ?? "";
+    return message.toLowerCase().includes("expired");
+}
+function withBearer(init, token) {
+    const headers = new Headers(init?.headers);
+    headers.set("authorization", `Bearer ${token}`);
+    return { ...init, headers };
+}
+export async function fetchWithControllerAuth(params) {
+    const response = await fetch(params.url, withBearer(params.init, params.accessToken));
+    if (response.ok) {
+        return { response, accessToken: params.accessToken };
+    }
+    if (params.tokenSource !== "config") {
+        return { response, accessToken: params.accessToken };
+    }
+    const responseText = await response.clone().text().catch(() => "");
+    if (!shouldAttemptRefresh(response.status, responseText)) {
+        return { response, accessToken: params.accessToken };
+    }
+    const refreshed = await refreshStoredSupabaseSession({ profile: params.profile ?? null, cwd: params.cwd ?? null });
+    if (!refreshed?.accessToken) {
+        return { response, accessToken: params.accessToken };
+    }
+    const retry = await fetch(params.url, withBearer(params.init, refreshed.accessToken));
+    return { response: retry, accessToken: refreshed.accessToken };
+}

package/dist/org.js

@@ -1,14 +1,19 @@
 import kleur from "kleur";
-import { resolveControllerUrl, resolveUserAccessToken } from "./config.js";
+import { resolveControllerUrl, resolveUserAccessTokenWithSource } from "./config.js";
 import { formatAuthRejectedError, formatAuthRequiredError } from "./errors.js";
+import { fetchWithControllerAuth } from "./controller-fetch.js";
 export async function listOrganizations(params) {
     const controllerUrl = resolveControllerUrl({ controllerUrl: params.controllerUrl ?? null });
-    const token = resolveUserAccessToken({ accessToken: params.accessToken ?? null });
-    if (!token) {
+    const resolved = resolveUserAccessTokenWithSource({ accessToken: params.accessToken ?? null });
+    if (!resolved.token) {
         throw formatAuthRequiredError({ retryCommand: "instafy org list" });
     }
-    const response = await fetch(`${controllerUrl}/orgs`, {
-        headers: { authorization: `Bearer ${token}` },
+    const { response } = await fetchWithControllerAuth({
+        url: `${controllerUrl}/orgs`,
+        accessToken: resolved.token,
+        tokenSource: resolved.source,
+        profile: resolved.profile,
+        cwd: process.cwd(),
     });
     if (!response.ok) {
         const text = await response.text().catch(() => "");

package/dist/project.js

@@ -2,20 +2,29 @@ import fs from "node:fs";
 import path from "node:path";
 import kleur from "kleur";
 import { stdin as input } from "node:process";
-import { getInstafyProfileConfigPath, resolveConfiguredStudioUrl, resolveControllerUrl, resolveUserAccessToken, } from "./config.js";
+import { getInstafyProfileConfigPath, resolveConfiguredStudioUrl, resolveControllerUrl, resolveUserAccessTokenWithSource, } from "./config.js";
 import { formatAuthRejectedError, formatAuthRequiredError } from "./errors.js";
 import { findProjectManifest } from "./project-manifest.js";
+import { fetchWithControllerAuth } from "./controller-fetch.js";
 let promptsModule = null;
 async function loadPrompts() {
     promptsModule ?? (promptsModule = import("@clack/prompts"));
     return promptsModule;
 }
-async function fetchOrganizations(controllerUrl, token, retryCommand) {
-    const response = await fetch(`${controllerUrl}/orgs`, {
-        headers: {
-            authorization: `Bearer ${token}`,
-        },
+async function controllerFetch(controllerUrl, auth, pathname, init) {
+    const { response, accessToken } = await fetchWithControllerAuth({
+        url: `${controllerUrl}${pathname}`,
+        init,
+        accessToken: auth.accessToken,
+        tokenSource: auth.tokenSource,
+        profile: auth.profile,
+        cwd: auth.cwd,
     });
+    auth.accessToken = accessToken;
+    return response;
+}
+async function fetchOrganizations(controllerUrl, auth, retryCommand) {
+    const response = await controllerFetch(controllerUrl, auth, "/orgs");
     if (!response.ok) {
         const text = await response.text().catch(() => "");
         if (response.status === 401 || response.status === 403) {
@@ -30,12 +39,8 @@ async function fetchOrganizations(controllerUrl, token, retryCommand) {
     const body = (await response.json());
     return Array.isArray(body.orgs) ? body.orgs : [];
 }
-async function fetchOrgProjects(controllerUrl, token, orgId, retryCommand) {
-    const response = await fetch(`${controllerUrl}/orgs/${encodeURIComponent(orgId)}/projects`, {
-        headers: {
-            authorization: `Bearer ${token}`,
-        },
-    });
+async function fetchOrgProjects(controllerUrl, auth, orgId, retryCommand) {
+    const response = await controllerFetch(controllerUrl, auth, `/orgs/${encodeURIComponent(orgId)}/projects`);
     if (!response.ok) {
         const text = await response.text().catch(() => "");
         if (response.status === 401 || response.status === 403) {
@@ -50,11 +55,10 @@ async function fetchOrgProjects(controllerUrl, token, orgId, retryCommand) {
     const body = (await response.json());
     return Array.isArray(body.projects) ? body.projects : [];
 }
-async function createOrganization(controllerUrl, token, payload, retryCommand) {
-    const response = await fetch(`${controllerUrl}/orgs`, {
+async function createOrganization(controllerUrl, auth, payload, retryCommand) {
+    const response = await controllerFetch(controllerUrl, auth, "/orgs", {
         method: "POST",
         headers: {
-            authorization: `Bearer ${token}`,
             "content-type": "application/json",
         },
         body: JSON.stringify(payload),
@@ -77,7 +81,7 @@ async function createOrganization(controllerUrl, token, payload, retryCommand) {
     }
     return { orgId, orgName: json.org_name ?? json.orgName ?? null };
 }
-async function resolveOrg(controllerUrl, token, options, retryCommand) {
+async function resolveOrg(controllerUrl, auth, options, retryCommand) {
     if (options.orgId) {
         return { orgId: options.orgId, orgName: options.orgName ?? null };
     }
@@ -112,18 +116,18 @@ async function resolveOrg(controllerUrl, token, options, retryCommand) {
         if (chosenSlug) {
             payload.orgSlug = chosenSlug;
         }
-        const created = await createOrganization(controllerUrl, token, payload, retryCommand);
+        const created = await createOrganization(controllerUrl, auth, payload, retryCommand);
         return { orgId: created.orgId, orgName: created.orgName ?? chosenName };
     }
     if (orgSlug) {
-        const orgs = await fetchOrganizations(controllerUrl, token, retryCommand);
+        const orgs = await fetchOrganizations(controllerUrl, auth, retryCommand);
         const matches = orgs.filter((org) => org.slug === orgSlug);
         if (matches.length === 1) {
             return { orgId: matches[0].id, orgName: matches[0].name ?? null };
         }
     }
     if (!orgSlug && !orgName) {
-        const orgs = await fetchOrganizations(controllerUrl, token, retryCommand);
+        const orgs = await fetchOrganizations(controllerUrl, auth, retryCommand);
         if (orgs.length === 0) {
             if (allowInteractive) {
                 const { confirm, isCancel } = await loadPrompts();
@@ -191,7 +195,7 @@ async function resolveOrg(controllerUrl, token, options, retryCommand) {
             if (options.ownerUserId) {
                 payload.ownerUserId = options.ownerUserId;
             }
-            const created = await createOrganization(controllerUrl, token, payload, retryCommand);
+            const created = await createOrganization(controllerUrl, auth, payload, retryCommand);
             return { orgId: created.orgId, orgName: created.orgName ?? chosenName };
         }
         throw new Error(`Organization slug "${orgSlug}" did not match an existing org, and org name is required to create one.\n\nNext:\n- Create an org in Studio: ${studioOrgUrl}\n- Or rerun: instafy project init --org-name \"My Org\" --org-slug "${orgSlug}"`);
@@ -209,17 +213,23 @@ async function resolveOrg(controllerUrl, token, options, retryCommand) {
     if (!payload.orgName) {
         throw new Error(`Organization name is required.\n\nNext:\n- Create an org in Studio: ${studioOrgUrl}\n- Or rerun: instafy project init --org-name \"My Org\"`);
     }
-    const created = await createOrganization(controllerUrl, token, payload, retryCommand);
+    const created = await createOrganization(controllerUrl, auth, payload, retryCommand);
     return { orgId: created.orgId, orgName: created.orgName ?? orgName ?? null };
 }
 export async function listProjects(options) {
     const controllerUrl = resolveControllerUrl({ controllerUrl: options.controllerUrl ?? null });
-    const token = resolveUserAccessToken({ accessToken: options.accessToken ?? null });
-    if (!token) {
+    const resolved = resolveUserAccessTokenWithSource({ accessToken: options.accessToken ?? null });
+    if (!resolved.token) {
         throw formatAuthRequiredError({ retryCommand: "instafy project list" });
     }
     const retryCommand = "instafy project list";
-    const orgs = await fetchOrganizations(controllerUrl, token, retryCommand);
+    const auth = {
+        accessToken: resolved.token,
+        tokenSource: resolved.source,
+        profile: resolved.profile,
+        cwd: process.cwd(),
+    };
+    const orgs = await fetchOrganizations(controllerUrl, auth, retryCommand);
     let targetOrgs = orgs;
     if (options.orgId) {
         targetOrgs = orgs.filter((org) => org.id === options.orgId);
@@ -235,7 +245,7 @@ export async function listProjects(options) {
     }
     const summaries = [];
     for (const org of targetOrgs) {
-        const projects = await fetchOrgProjects(controllerUrl, token, org.id, retryCommand);
+        const projects = await fetchOrgProjects(controllerUrl, auth, org.id, retryCommand);
         summaries.push({ org, projects });
     }
     if (options.json) {
@@ -267,27 +277,32 @@ export async function projectInit(options) {
         profile: options.profile ?? null,
         cwd: rootDir,
     });
-    const token = resolveUserAccessToken({
+    const resolved = resolveUserAccessTokenWithSource({
         accessToken: options.accessToken ?? null,
         profile: options.profile ?? null,
         cwd: rootDir,
     });
-    if (!token) {
+    if (!resolved.token) {
         throw formatAuthRequiredError({
             retryCommand: "instafy project init",
             advancedHint: "pass --access-token or set INSTAFY_ACCESS_TOKEN / SUPABASE_ACCESS_TOKEN",
         });
     }
     const retryCommand = "instafy project init";
-    const org = await resolveOrg(controllerUrl, token, options, retryCommand);
+    const auth = {
+        accessToken: resolved.token,
+        tokenSource: resolved.source,
+        profile: resolved.profile,
+        cwd: rootDir,
+    };
+    const org = await resolveOrg(controllerUrl, auth, options, retryCommand);
     const body = {
         projectType: options.projectType,
         ownerUserId: options.ownerUserId,
     };
-    const response = await fetch(`${controllerUrl}/orgs/${encodeURIComponent(org.orgId)}/projects`, {
+    const response = await controllerFetch(controllerUrl, auth, `/orgs/${encodeURIComponent(org.orgId)}/projects`, {
         method: "POST",
         headers: {
-            authorization: `Bearer ${token}`,
             "content-type": "application/json",
         },
         body: JSON.stringify(body),

package/dist/runtime.js

@@ -6,9 +6,10 @@ import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";
 import os from "node:os";
 import { ensureRatholeBinary } from "./rathole.js";
-import { resolveConfiguredAccessToken } from "./config.js";
+import { resolveActiveProfileName, resolveConfiguredAccessToken } from "./config.js";
 import { formatAuthRejectedError } from "./errors.js";
 import { findProjectManifest } from "./project-manifest.js";
+import { fetchWithControllerAuth } from "./controller-fetch.js";
 const INSTAFY_DIR = path.join(os.homedir(), ".instafy");
 const STATE_FILE = path.join(INSTAFY_DIR, "cli-runtime-state.json");
 const LOG_DIR = path.join(INSTAFY_DIR, "cli-runtime-logs");
@@ -188,13 +189,28 @@ function findRatholeOnPath() {
     }
     return null;
 }
-function resolveControllerAccessTokenForCli(options, env, supabaseAccessToken) {
-    return (normalizeToken(options.controllerAccessToken) ??
-        normalizeToken(env["INSTAFY_ACCESS_TOKEN"]) ??
-        normalizeToken(env["CONTROLLER_ACCESS_TOKEN"]) ??
-        supabaseAccessToken ??
-        normalizeToken(env["SUPABASE_ACCESS_TOKEN"]) ??
-        resolveConfiguredAccessToken());
+function resolveControllerAccessTokenForCliWithSource(options, env, supabaseAccessToken, profile, cwd) {
+    const explicit = normalizeToken(options.controllerAccessToken);
+    if (explicit) {
+        return { token: explicit, source: "explicit" };
+    }
+    const envToken = normalizeToken(env["INSTAFY_ACCESS_TOKEN"]) ??
+        normalizeToken(env["CONTROLLER_ACCESS_TOKEN"]);
+    if (envToken) {
+        return { token: envToken, source: "env" };
+    }
+    if (supabaseAccessToken) {
+        return { token: supabaseAccessToken, source: "explicit" };
+    }
+    const supabaseEnvToken = normalizeToken(env["SUPABASE_ACCESS_TOKEN"]);
+    if (supabaseEnvToken) {
+        return { token: supabaseEnvToken, source: "env" };
+    }
+    const stored = resolveConfiguredAccessToken({ profile, cwd });
+    if (stored) {
+        return { token: stored, source: "config" };
+    }
+    return { token: null, source: "none" };
 }
 export async function resolveRatholeBinaryForCli(options) {
     const warn = options.warn ??
@@ -245,16 +261,23 @@ export async function resolveRatholeBinaryForCli(options) {
 export async function mintRuntimeAccessToken(params) {
     const url = params.controllerUrl.replace(/\/$/, "");
     const target = `${url}/projects/${encodeURIComponent(params.projectId)}/runtime/token`;
-    const response = await fetch(target, {
-        method: "POST",
-        headers: {
-            authorization: `Bearer ${params.controllerAccessToken}`,
-            "content-type": "application/json",
+    const { response } = await fetchWithControllerAuth({
+        url: target,
+        init: {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                runtimeId: params.runtimeId,
+                leaseId: params.leaseId,
+                scopes: params.scopes,
+            }),
         },
-        body: JSON.stringify({
-            runtimeId: params.runtimeId,
-            scopes: params.scopes,
-        }),
+        accessToken: params.controllerAccessToken,
+        tokenSource: params.tokenSource ?? "env",
+        profile: params.profile ?? null,
+        cwd: params.cwd ?? null,
     });
     if (!response.ok) {
         const text = await response.text().catch(() => "");
@@ -273,6 +296,55 @@ export async function mintRuntimeAccessToken(params) {
     }
     return token;
 }
+async function requestRuntimeLease(params) {
+    const url = params.controllerUrl.replace(/\/$/, "");
+    const target = `${url}/projects/${encodeURIComponent(params.projectId)}/runtime/request`;
+    const { response, accessToken } = await fetchWithControllerAuth({
+        url: target,
+        init: {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                provider: params.provider,
+                displayName: params.displayName,
+                idleTtlSeconds: params.idleTtlSeconds,
+                requestTunnel: params.requestTunnel,
+                runtimeId: params.runtimeId,
+            }),
+        },
+        accessToken: params.accessToken,
+        tokenSource: params.tokenSource,
+        profile: params.profile,
+        cwd: params.cwd,
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        if (response.status === 401 || response.status === 403) {
+            throw formatAuthRejectedError({
+                status: response.status,
+                responseBody: text,
+            });
+        }
+        throw new Error(`Instafy server rejected runtime request (${response.status} ${response.statusText}): ${text}`);
+    }
+    const payload = (await response.json());
+    const runtime = (payload["runtime"] ?? payload);
+    const runtimeId = (typeof runtime?.["runtimeId"] === "string" ? runtime["runtimeId"] : null) ??
+        (typeof runtime?.["runtime_id"] === "string" ? runtime["runtime_id"] : null) ??
+        null;
+    const leaseId = (typeof runtime?.["leaseId"] === "string" ? runtime["leaseId"] : null) ??
+        (typeof runtime?.["lease_id"] === "string" ? runtime["lease_id"] : null) ??
+        null;
+    if (!runtimeId || !runtimeId.trim()) {
+        throw new Error("Instafy server response missing runtimeId while requesting runtime lease.");
+    }
+    if (!leaseId || !leaseId.trim()) {
+        throw new Error("Instafy server response missing leaseId while requesting runtime lease.");
+    }
+    return { runtimeId: runtimeId.trim(), leaseId: leaseId.trim(), accessToken };
+}
 function isProcessAlive(pid) {
     try {
         process.kill(pid, 0);
@@ -284,6 +356,7 @@ function isProcessAlive(pid) {
 }
 export async function runtimeStart(options) {
     const env = { ...process.env };
+    const cwd = process.cwd();
     const existing = readState();
     if (existing) {
         if (existing.runner === "docker" && existing.containerId && dockerContainerRunning(existing.containerId)) {
@@ -293,7 +366,7 @@ export async function runtimeStart(options) {
             throw new Error(`Runtime already running (pid ${existing.pid}) for project ${existing.projectId}. Stop it first.`);
         }
     }
-    const manifestInfo = findProjectManifest(process.cwd());
+    const manifestInfo = findProjectManifest(cwd);
     const projectId = options.project ?? env["PROJECT_ID"] ?? manifestInfo.manifest?.projectId ?? null;
     if (!projectId) {
         throw new Error("No project configured. Run `instafy project init` in this folder (recommended) or pass --project.");
@@ -303,7 +376,10 @@ export async function runtimeStart(options) {
     if (supabaseAccessToken) {
         env["SUPABASE_ACCESS_TOKEN"] = supabaseAccessToken;
     }
-    let controllerAccessToken = resolveControllerAccessTokenForCli(options, env, supabaseAccessToken);
+    const profile = resolveActiveProfileName({ cwd });
+    const controllerAccessTokenResult = resolveControllerAccessTokenForCliWithSource(options, env, supabaseAccessToken, profile, cwd);
+    let controllerAccessToken = controllerAccessTokenResult.token;
+    const controllerAccessTokenSource = controllerAccessTokenResult.source;
     let runtimeAccessToken = normalizeToken(options.runtimeToken) ?? normalizeToken(env["RUNTIME_ACCESS_TOKEN"]);
     const agentKey = options.controllerToken ??
         env["INSTAFY_SERVICE_TOKEN"] ??
@@ -324,16 +400,6 @@ export async function runtimeStart(options) {
             env["CONTROLLER_BASE_URL"] ??
             manifestInfo.manifest?.controllerUrl ??
             "http://127.0.0.1:8788";
-    if (!runtimeAccessToken && controllerAccessToken) {
-        runtimeAccessToken = await mintRuntimeAccessToken({
-            controllerUrl: env["CONTROLLER_BASE_URL"],
-            controllerAccessToken,
-            projectId,
-        });
-    }
-    if (runtimeAccessToken) {
-        env["RUNTIME_ACCESS_TOKEN"] = runtimeAccessToken;
-    }
     if (options.codexBin)
         env["CODEX_BIN"] = options.codexBin;
     if (options.proxyBaseUrl)
@@ -352,22 +418,6 @@ export async function runtimeStart(options) {
     if (options.originEndpoint && options.originEndpoint.trim()) {
         env["ORIGIN_ENDPOINT"] = options.originEndpoint.trim();
     }
-    let originToken = normalizeToken(options.originToken) ?? normalizeToken(env["ORIGIN_INTERNAL_TOKEN"]);
-    if (!originToken && runtimeAccessToken) {
-        originToken = runtimeAccessToken;
-    }
-    if (!originToken && controllerAccessToken) {
-        originToken = await mintRuntimeAccessToken({
-            controllerUrl: env["CONTROLLER_BASE_URL"],
-            controllerAccessToken,
-            projectId,
-            runtimeId: env["RUNTIME_ID"],
-        });
-    }
-    if (!originToken) {
-        throw new Error("Runtime/origin token is required (--origin-token or ORIGIN_INTERNAL_TOKEN), or provide --runtime-token/--controller-access-token to mint/use one");
-    }
-    env["ORIGIN_INTERNAL_TOKEN"] = originToken;
     const skipAuthRaw = env["ORIGIN_SKIP_AUTH"]?.trim().toLowerCase();
     const skipAuth = skipAuthRaw === "1" || skipAuthRaw === "true" || skipAuthRaw === "yes";
     const usesTunnel = !env["ORIGIN_ENDPOINT"];
@@ -378,12 +428,10 @@ export async function runtimeStart(options) {
     }
     env["RUNTIME_DISPLAY_NAME"] =
         options.displayName ?? env["RUNTIME_DISPLAY_NAME"] ?? "Instafy CLI Runtime";
-    const manifestProvider = manifestInfo.manifest?.orgName?.trim() ||
-        manifestInfo.manifest?.orgId?.toString().trim();
     env["RUNTIME_PROVIDER"] =
-        options.provider ?? env["RUNTIME_PROVIDER"] ?? manifestProvider ?? "self-hosted";
+        options.provider ?? env["RUNTIME_PROVIDER"] ?? "self-hosted";
     env["RUNTIME_VERSION"] = env["RUNTIME_VERSION"] ?? "0.1.0";
-    env["RUNTIME_REQUIRE_CODEX_BIN"] = env["RUNTIME_REQUIRE_CODEX_BIN"] || "1";
+    env["RUNTIME_REQUIRE_CODEX_BIN"] = env["RUNTIME_REQUIRE_CODEX_BIN"] || "0";
     env["RUNTIME_CAPABILITIES"] =
         env["RUNTIME_CAPABILITIES"] ||
             JSON.stringify({ fs: true, github: true, supabase: true, runs: true, agent: true, origin: true });
@@ -397,6 +445,90 @@ export async function runtimeStart(options) {
     const runtimeBin = runtimeMode === "docker" ? null : tryResolveRuntimeBinary();
     const useDocker = runtimeMode === "docker" ||
         (runtimeMode === "auto" && !runtimeBin);
+    if (useDocker && !isDockerAvailable()) {
+        throw new Error("runtime-agent is not available (no local binary and docker is not installed). Install Docker Desktop, or build runtime-agent from source.");
+    }
+    const originEnabledRaw = env["ORIGIN_ENABLED"]?.trim().toLowerCase();
+    const originEnabled = !originEnabledRaw ||
+        originEnabledRaw === "1" ||
+        originEnabledRaw === "true" ||
+        originEnabledRaw === "yes" ||
+        originEnabledRaw === "on";
+    if (originEnabled && usesTunnel && !useDocker) {
+        const ratholeResolved = await resolveRatholeBinaryForCli({
+            env,
+            version: process.env["RATHOLE_VERSION"] ?? null,
+            cacheDir: process.env["RATHOLE_CACHE_DIR"] ?? null,
+            logger: (message) => console.log(kleur.cyan(`[rathole] ${message}`)),
+            warn: (message) => console.warn(kleur.yellow(message)),
+        });
+        if (!ratholeResolved) {
+            throw new Error("Tunnel is required but rathole is unavailable. Set RATHOLE_BIN (recommended) or pass --origin-endpoint to use a reachable URL.");
+        }
+    }
+    if (originEnabled && usesTunnel && !env["RUNTIME_LEASE_ID"]) {
+        const bearer = controllerAccessToken ?? runtimeAccessToken;
+        const tokenSource = controllerAccessToken ? controllerAccessTokenSource : "env";
+        if (!bearer) {
+            throw new Error("Login required to request a tunnel-enabled runtime lease. Run `instafy login` or pass --controller-access-token/--runtime-token.");
+        }
+        const ttl = typeof env["RUNTIME_LEASE_SECONDS"] === "string" ? Number(env["RUNTIME_LEASE_SECONDS"]) : NaN;
+        const idleTtlSeconds = Number.isFinite(ttl) && ttl > 0 ? ttl : undefined;
+        const lease = await requestRuntimeLease({
+            controllerUrl: env["CONTROLLER_BASE_URL"],
+            accessToken: bearer,
+            tokenSource,
+            profile,
+            cwd,
+            projectId,
+            provider: env["RUNTIME_PROVIDER"],
+            displayName: env["RUNTIME_DISPLAY_NAME"],
+            idleTtlSeconds,
+            requestTunnel: false,
+            runtimeId: env["RUNTIME_ID"],
+        });
+        env["RUNTIME_ID"] = lease.runtimeId;
+        env["RUNTIME_LEASE_ID"] = lease.leaseId;
+        if (controllerAccessToken && bearer === controllerAccessToken) {
+            controllerAccessToken = lease.accessToken;
+            env["CONTROLLER_ACCESS_TOKEN"] = controllerAccessToken;
+        }
+    }
+    if (!runtimeAccessToken && controllerAccessToken) {
+        runtimeAccessToken = await mintRuntimeAccessToken({
+            controllerUrl: env["CONTROLLER_BASE_URL"],
+            controllerAccessToken,
+            projectId,
+            runtimeId: env["RUNTIME_ID"],
+            leaseId: env["RUNTIME_LEASE_ID"],
+            tokenSource: controllerAccessTokenSource,
+            profile,
+            cwd,
+        });
+    }
+    if (runtimeAccessToken) {
+        env["RUNTIME_ACCESS_TOKEN"] = runtimeAccessToken;
+    }
+    let originToken = normalizeToken(options.originToken) ?? normalizeToken(env["ORIGIN_INTERNAL_TOKEN"]);
+    if (!originToken && runtimeAccessToken) {
+        originToken = runtimeAccessToken;
+    }
+    if (!originToken && controllerAccessToken) {
+        originToken = await mintRuntimeAccessToken({
+            controllerUrl: env["CONTROLLER_BASE_URL"],
+            controllerAccessToken,
+            projectId,
+            runtimeId: env["RUNTIME_ID"],
+            leaseId: env["RUNTIME_LEASE_ID"],
+            tokenSource: controllerAccessTokenSource,
+            profile,
+            cwd,
+        });
+    }
+    if (!originToken) {
+        throw new Error("Runtime/origin token is required (--origin-token or ORIGIN_INTERNAL_TOKEN), or provide --runtime-token/--controller-access-token to mint/use one");
+    }
+    env["ORIGIN_INTERNAL_TOKEN"] = originToken;
     if (!useDocker) {
         if (!env["ORIGIN_ENDPOINT"]) {
             const ratholeResolved = await resolveRatholeBinaryForCli({
@@ -461,9 +593,6 @@ export async function runtimeStart(options) {
         });
         return;
     }
-    if (!isDockerAvailable()) {
-        throw new Error("runtime-agent is not available (no local binary and docker is not installed). Install Docker Desktop, or build runtime-agent from source.");
-    }
     const image = resolveRuntimeAgentImage();
     const containerName = `instafy-runtime-${originId}`;
     const hostPort = String(options.bindPort ?? env["ORIGIN_BIND_PORT"] ?? 54332);
@@ -471,6 +600,9 @@ export async function runtimeStart(options) {
     const dockerEnv = { ...env };
     dockerEnv["WORKSPACE_DIR"] = "/workspace";
     dockerEnv["CODEX_HOME"] = "/workspace/.codex";
+    dockerEnv["TMPDIR"] = "/tmp";
+    dockerEnv["TMP"] = "/tmp";
+    dockerEnv["TEMP"] = "/tmp";
     dockerEnv["ORIGIN_BIND_HOST"] = "0.0.0.0";
     dockerEnv["CONTROLLER_BASE_URL"] = normalizeControllerUrlForDocker(env["CONTROLLER_BASE_URL"] ?? "");
     const envArgs = [];
@@ -500,7 +632,14 @@ export async function runtimeStart(options) {
     const started = spawnSync("docker", runArgs, { encoding: "utf8" });
     if (started.status !== 0) {
         const stderr = String(started.stderr ?? "").trim();
-        throw new Error(`docker run failed: ${stderr || "unknown error"}`);
+        const normalized = (stderr || "").toLowerCase();
+        const hints = [];
+        if (image.startsWith("ghcr.io/") && (normalized.includes("not found") || normalized.includes("denied") || normalized.includes("unauthorized") || normalized.includes("manifest unknown"))) {
+            hints.push("If this is a GHCR image, ensure it's published and you are authenticated (`docker login ghcr.io`).");
+        }
+        hints.push("Override the image with `INSTAFY_RUNTIME_AGENT_IMAGE=... instafy runtime start`.");
+        const suffix = hints.length > 0 ? `\n\nNext:\n- ${hints.join("\n- ")}` : "";
+        throw new Error(`docker run failed: ${stderr || "unknown error"}${suffix}`);
     }
     const containerId = String(started.stdout ?? "").trim();
     if (!containerId) {
@@ -740,15 +879,27 @@ export async function runtimeStop(options) {
     }
 }
 export async function runtimeToken(options) {
+    const cwd = process.cwd();
     const controllerUrl = options.controllerUrl ??
         process.env["INSTAFY_SERVER_URL"] ??
         process.env["CONTROLLER_BASE_URL"] ??
         "http://127.0.0.1:8788";
+    const profile = resolveActiveProfileName({ cwd });
+    const stored = resolveConfiguredAccessToken({ profile, cwd });
+    const tokenSource = options.controllerAccessToken
+        ? "explicit"
+        : process.env["INSTAFY_ACCESS_TOKEN"] ||
+            process.env["CONTROLLER_ACCESS_TOKEN"] ||
+            process.env["SUPABASE_ACCESS_TOKEN"]
+            ? "env"
+            : stored
+                ? "config"
+                : "none";
     const token = options.controllerAccessToken ??
         process.env["INSTAFY_ACCESS_TOKEN"] ??
         process.env["CONTROLLER_ACCESS_TOKEN"] ??
         process.env["SUPABASE_ACCESS_TOKEN"] ??
-        resolveConfiguredAccessToken();
+        stored;
     if (!token) {
         throw new Error("Login required. Run `instafy login` or pass --access-token / set SUPABASE_ACCESS_TOKEN.");
     }
@@ -758,6 +909,9 @@ export async function runtimeToken(options) {
         projectId: options.project,
         runtimeId: options.runtimeId,
         scopes: options.scopes,
+        tokenSource: tokenSource === "none" ? "env" : tokenSource,
+        profile,
+        cwd,
     });
     if (options.json) {
         console.log(JSON.stringify({ token: minted }));

package/dist/supabase-session.js

@@ -0,0 +1,89 @@
+import { readInstafyCliConfig, readInstafyProfileConfig, resolveActiveProfileName, writeInstafyCliConfig, writeInstafyProfileConfig, } from "./config.js";
+function normalizeToken(value) {
+    const trimmed = typeof value === "string" ? value.trim() : "";
+    if (!trimmed)
+        return null;
+    const lowered = trimmed.toLowerCase();
+    if (lowered === "null" || lowered === "undefined")
+        return null;
+    return trimmed;
+}
+function normalizeUrl(value) {
+    const trimmed = typeof value === "string" ? value.trim() : "";
+    if (!trimmed)
+        return null;
+    return trimmed.replace(/\/$/, "");
+}
+function resolveSupabaseUrl(configured) {
+    return (normalizeUrl(configured) ??
+        normalizeUrl(process.env["SUPABASE_URL"]) ??
+        normalizeUrl(process.env["VITE_SUPABASE_URL"]) ??
+        normalizeUrl(process.env["SUPABASE_PROJECT_URL"]) ??
+        null);
+}
+function resolveSupabaseAnonKey(configured) {
+    return (normalizeToken(configured) ??
+        normalizeToken(process.env["SUPABASE_ANON_KEY"]) ??
+        normalizeToken(process.env["VITE_SUPABASE_ANON_KEY"]) ??
+        null);
+}
+async function refreshSupabaseSession(params) {
+    const response = await fetch(`${params.supabaseUrl}/auth/v1/token?grant_type=refresh_token`, {
+        method: "POST",
+        headers: {
+            apikey: params.supabaseAnonKey,
+            authorization: `Bearer ${params.supabaseAnonKey}`,
+            "content-type": "application/json",
+        },
+        body: JSON.stringify({ refresh_token: params.refreshToken }),
+    });
+    if (!response.ok) {
+        return null;
+    }
+    const body = (await response.json());
+    const accessToken = typeof body["access_token"] === "string" ? body["access_token"].trim() : "";
+    if (!accessToken) {
+        return null;
+    }
+    const refreshToken = typeof body["refresh_token"] === "string" ? body["refresh_token"].trim() : null;
+    return {
+        accessToken,
+        refreshToken,
+        supabaseUrl: params.supabaseUrl,
+        supabaseAnonKey: params.supabaseAnonKey,
+    };
+}
+export async function refreshStoredSupabaseSession(params) {
+    const profile = resolveActiveProfileName(params);
+    const config = profile ? readInstafyProfileConfig(profile) : readInstafyCliConfig();
+    const refreshToken = normalizeToken(config.refreshToken ?? null);
+    if (!refreshToken) {
+        return null;
+    }
+    const supabaseUrl = resolveSupabaseUrl(config.supabaseUrl ?? null);
+    const supabaseAnonKey = resolveSupabaseAnonKey(config.supabaseAnonKey ?? null);
+    if (!supabaseUrl || !supabaseAnonKey) {
+        return null;
+    }
+    const refreshed = await refreshSupabaseSession({
+        supabaseUrl,
+        supabaseAnonKey,
+        refreshToken,
+    });
+    if (!refreshed) {
+        return null;
+    }
+    const next = {
+        accessToken: refreshed.accessToken,
+        refreshToken: refreshed.refreshToken ?? refreshToken,
+        supabaseUrl: refreshed.supabaseUrl,
+        supabaseAnonKey: refreshed.supabaseAnonKey,
+    };
+    if (profile) {
+        writeInstafyProfileConfig(profile, next);
+    }
+    else {
+        writeInstafyCliConfig(next);
+    }
+    return refreshed;
+}

package/dist/tunnel.js

@@ -5,8 +5,9 @@ import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import kleur from "kleur";
 import { findProjectManifest, resolveRatholeBinaryForCli } from "./runtime.js";
-import { resolveConfiguredControllerUrl, resolveControllerUrl as resolveDefaultControllerUrl, resolveUserAccessToken, } from "./config.js";
+import { resolveConfiguredControllerUrl, resolveControllerUrl as resolveDefaultControllerUrl, resolveUserAccessTokenWithSource, } from "./config.js";
 import { formatAuthRejectedError, formatAuthRequiredError } from "./errors.js";
+import { fetchWithControllerAuth } from "./controller-fetch.js";
 const INSTAFY_DIR = path.join(os.homedir(), ".instafy");
 const TUNNEL_STATE_FILE = path.join(INSTAFY_DIR, "cli-tunnel-state.json");
 const TUNNEL_LOG_DIR = path.join(INSTAFY_DIR, "cli-tunnel-logs");
@@ -56,11 +57,11 @@ function resolveTunnelControllerUrl(opts) {
 function resolveControllerToken(opts, retryCommand = "instafy tunnel start") {
     const explicit = opts.controllerToken?.trim();
     if (explicit) {
-        return explicit;
+        return { token: explicit, source: "explicit", profile: null };
     }
-    const accessToken = resolveUserAccessToken();
-    if (accessToken) {
-        return accessToken;
+    const resolved = resolveUserAccessTokenWithSource();
+    if (resolved.token) {
+        return { token: resolved.token, source: resolved.source, profile: resolved.profile };
     }
     const serviceToken = readEnv("INSTAFY_SERVICE_TOKEN") ||
         readEnv("CONTROLLER_BEARER") ||
@@ -71,7 +72,7 @@ function resolveControllerToken(opts, retryCommand = "instafy tunnel start") {
         readEnv("CONTROLLER_INTERNAL_TOKEN") ||
         null;
     if (serviceToken) {
-        return serviceToken;
+        return { token: serviceToken, source: "env", profile: null };
     }
     throw formatAuthRequiredError({
         retryCommand,
@@ -156,16 +157,22 @@ function removeTunnelState(tunnelId) {
     writeStateFile({ version: 1, tunnels: next });
     return existing;
 }
-async function requestTunnel(controllerUrl, token, projectId, metadata) {
+async function requestTunnel(controllerUrl, auth, projectId, metadata) {
     const target = `${cleanUrl(controllerUrl)}/projects/${encodeURIComponent(projectId)}/tunnels/request`;
-    const response = await fetch(target, {
-        method: "POST",
-        headers: {
-            authorization: `Bearer ${token}`,
-            "content-type": "application/json",
-            accept: "application/json",
+    const { response } = await fetchWithControllerAuth({
+        url: target,
+        init: {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                accept: "application/json",
+            },
+            body: JSON.stringify({ metadata }),
         },
-        body: JSON.stringify({ metadata }),
+        accessToken: auth.token,
+        tokenSource: auth.source,
+        profile: auth.profile,
+        cwd: process.cwd(),
     });
     if (!response.ok) {
         const text = await response.text().catch(() => "");
@@ -262,7 +269,7 @@ export async function startTunnelSession(opts) {
             return;
         cleanedUp = true;
         child.kill("SIGTERM");
-        await revokeTunnel(controllerUrl, controllerToken, projectId, grant.tunnelId);
+        await revokeTunnel(controllerUrl, controllerToken.token, projectId, grant.tunnelId);
         fs.rmSync(workdir, { recursive: true, force: true });
     };
     child.on("exit", () => {
@@ -413,7 +420,7 @@ export async function stopTunnelSession(opts) {
         }
     }
     const controllerToken = resolveControllerToken(opts, `instafy tunnel stop ${tunnelId}`);
-    await revokeTunnel(entry.controllerUrl, controllerToken, entry.projectId, entry.tunnelId);
+    await revokeTunnel(entry.controllerUrl, controllerToken.token, entry.projectId, entry.tunnelId);
     try {
         fs.rmSync(entry.workdir, { recursive: true, force: true });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instafy/cli",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "Run Instafy projects locally, link folders to Studio, and share previews/webhooks via tunnels.",
   "private": false,
   "publishConfig": {