@instafy/cli 0.2.4 → 0.3.1

package/README.md

@@ -41,8 +41,8 @@ Run Instafy spaces locally and connect them back to Instafy Studio — from any
   - Like an ordinary Studio chat, the CLI marks the turn as potentially workspace-writing. Controller and member permissions still apply, and read-only questions do not require a file change.
 - `instafy bind serve <site>` — serve a bound site: a website whose clicks become typed intents, run by a handler script, with records streamed back to every viewer. "Ask Octo" clicks are handed to Studio and sent as the clicker's own chat message, so the binder needs no login. Runs the binder bundled with the CLI (`packages/instafy-bind`, copied into `dist/bind` at build time; `INSTAFY_BIND_BIN` overrides it). See `docs/Bound-Sites.md`.
 - `instafy agents list` — list available top-level agents.
-- `instafy agents settings` — inspect the linked space's shared multi-agent limits. Add `--interactive` to edit them, or use `--max-agents-per-plan <n>` and/or `--max-concurrent-agents <n>`.
-  - Plans default to at most 64 team workers (range 1–256); at most 8 team workers run concurrently across the space (range 1–64), subject to runtime capacity. Lead/root jobs and native provider subagents are outside the concurrent team-worker count. Changing settings requires permission to manage the space; runtime job tokens cannot change them.
+- `instafy agents settings` — inspect the linked space's shared multi-agent limits. Add `--interactive` to edit them, or use `--max-agents-per-plan <n>`, `--max-concurrent-agents <n>`, and/or `--max-native-subagents <n>`.
+  - Plans default to at most 64 team workers (range 1–256); at most 8 team workers run concurrently across the space (range 1–64), subject to runtime capacity. Lead/root jobs and native helpers are outside the concurrent team-worker count. Native helpers have a separate limit of 3 children per parent (range 1–64), excluding the parent itself; this setting requires a supporting controller. Changing settings requires permission to manage the space; runtime job tokens cannot change them.
 - `instafy agents context list --query "<topic>"` — inspect optional compact scoped context-card hints for cross-agent coordination.
 - `instafy agents context put --agent @octo "<summary>"` — save/update a compact context card for the current conversation when `INSTAFY_CONVERSATION_ID` is set.
 - `instafy automations create --name "Octo check-in" --mode space_review --schedule-kind hourly --interval-hours 24` — explicitly opt in to private, quiet space reviews; no custom prompt is needed.
@@ -56,6 +56,7 @@ Run Instafy spaces locally and connect them back to Instafy Studio — from any
   - `instafy tunnel logs <tunnelId> --follow` — tail tunnel logs.
   - `instafy tunnel stop <tunnelId>` — stop + revoke a tunnel.
 - `instafy preview check --port <port>` — load a local site in a headless browser and list its errors, failed requests and a blank page, with desktop and phone screenshots. Local only; see [docs/CLI.md](https://github.com/instafy-dev/instafy/blob/main/docs/CLI.md#previews) for exit codes and settings.
+- `instafy web read <url…> --json` — read up to 6 public pages over plain HTTP and get their text, links and structured data with provenance, wrapped as untrusted page content. robots.txt (including AI-agent user agents), skill-listed link-only sites, private-address checks at every redirect, stop rules and per-turn caps are enforced; see [docs/CLI.md](https://github.com/instafy-dev/instafy/blob/main/docs/CLI.md#reading-web-pages-instafy-web-read).
 - `instafy secrets list` — list space secret metadata (names/descriptions, never values).
 - `instafy secrets get <name-or-id>` — inspect one space secret metadata entry.
 - `instafy secrets put <name> --value ...` — create/update a space secret.

package/dist/bind/src/config.mjs

@@ -3,6 +3,7 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { credentialFreeEnv } from "./detached-env.mjs";
 
 export const DEFAULT_CONTROLLER_URL = "http://127.0.0.1:8788";
 
@@ -145,7 +146,6 @@ export function agentUsesOwnerConversation(config) {
 
 /** Credential names the binder itself reads as the owner's login (above). */
 const BINDER_LOGIN_ENV = ["INSTAFY_ACCESS_TOKEN", "SUPABASE_ACCESS_TOKEN"];
-const CREDENTIAL_ENV_RE = /(TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|PRIVATE|(^|_)KEY$|_KEY_|API_?KEY)/;
 
 /**
  * Why --agent-executor is refused here, or null. It treats a click from this machine's loopback as the owner's own,
@@ -158,23 +158,12 @@ export function agentExecutorRefusal(env = process.env) {
 }
 
 /**
- * The environment of a binder started with `serve --detach`. It outlives the Octo turn that started it and every
- * process in a runtime can read its /proc/<pid>/environ, so it keeps no credential it does not need: no runtime job
- * token or other CONTROLLER_* secret, no SUPABASE_* service values, no credential-like names (space secrets) except
- * names passed with --allow-env, and the owner's login only with `keepLogin` (--agent-executor, the one mode that
+ * The environment of a binder started with `serve --detach`: `credentialFreeEnv` (no runtime job token or other
+ * CONTROLLER_* secret, no SUPABASE_* service values, no credential-like names such as space secrets), except names
+ * passed with --allow-env, and the owner's login only with `keepLogin` (--agent-executor, the one mode that
  * dispatches Octo turns itself). Everything else (PATH, HOME, the space and conversation ids, plain settings a
  * handler may declare in `env`) is kept.
  */
 export function detachedBinderEnv(env = process.env, allowEnv = [], { keepLogin = false } = {}) {
-  const out = {};
-  for (const [name, value] of Object.entries(env)) {
-    if (value === undefined) continue;
-    const keep =
-      (keepLogin && BINDER_LOGIN_ENV.includes(name)) ||
-      allowEnv.includes(name) ||
-      name === "CONTROLLER_BASE_URL" ||
-      (!/^(CONTROLLER|SUPABASE)_/.test(name) && !CREDENTIAL_ENV_RE.test(name));
-    if (keep) out[name] = value;
-  }
-  return out;
+  return credentialFreeEnv(env, [...allowEnv, ...(keepLogin ? BINDER_LOGIN_ENV : [])]);
 }

package/dist/bind/src/detached-env.mjs

@@ -0,0 +1,27 @@
+// The environment of a process started to outlive the command (or Octo turn) that started it.
+// SPDX-License-Identifier: AGPL-3.0-only
+//
+// Shared by `instafy bind serve --detach` and `instafy preview open --start` (the CLI loads this file from its bundled
+// copy of the binder), so both strip the same credentials.
+
+const CREDENTIAL_ENV_RE = /(TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|PRIVATE|(^|_)KEY$|_KEY_|API_?KEY)/;
+
+/**
+ * `env` without credentials a long-lived process does not need. Such a process outlives the job that started it, and
+ * every process in a runtime can read its /proc/<pid>/environ, so it keeps no runtime job token or other CONTROLLER_*
+ * value (except CONTROLLER_BASE_URL, which is not secret), no SUPABASE_* value and no credential-like name (space
+ * secrets, logins). Names in `keep` are kept anyway. Everything else (PATH, HOME, the space and conversation ids,
+ * plain settings) is kept.
+ */
+export function credentialFreeEnv(env = process.env, keep = []) {
+  const out = {};
+  for (const [name, value] of Object.entries(env)) {
+    if (value === undefined) continue;
+    const kept =
+      keep.includes(name) ||
+      name === "CONTROLLER_BASE_URL" ||
+      (!/^(CONTROLLER|SUPABASE)_/.test(name) && !CREDENTIAL_ENV_RE.test(name));
+    if (kept) out[name] = value;
+  }
+  return out;
+}

package/dist/bind/src/net.mjs

@@ -48,8 +48,10 @@ function isPrivateV6(ip) {
   if (allZeroUpTo(7) && g[7] === 1) return true; // ::1
   const embedded = () => `${g[6] >> 8}.${g[6] & 255}.${g[7] >> 8}.${g[7] & 255}`;
   if (allZeroUpTo(5) && g[5] === 0xffff) return isPrivateV4(embedded()); // ::ffff:a.b.c.d
+  if (allZeroUpTo(4) && g[4] === 0xffff && g[5] === 0) return isPrivateV4(embedded()); // ::ffff:0:a.b.c.d (SIIT translated)
   if (allZeroUpTo(6)) return true; // ::a.b.c.d (deprecated compatible)
   if (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every((x) => x === 0)) return isPrivateV4(embedded()); // NAT64
+  if (g[0] === 0x64 && g[1] === 0xff9b && g[2] === 1) return true; // 64:ff9b:1::/48 local-use NAT64 (RFC 8215): a network's own translator
   if ((g[0] & 0xfe00) === 0xfc00) return true; // fc00::/7 unique local
   if ((g[0] & 0xffc0) === 0xfe80) return true; // fe80::/10 link local
   if ((g[0] & 0xffc0) === 0xfec0) return true; // fec0::/10 site local
@@ -70,6 +72,16 @@ export function isPrivateAddress(ip) {
 
 const LOCAL_NAME_RE = /(^|\.)(localhost|local|internal|lan|home|intranet|localdomain)$/i;
 
+/** True for a host name that names this machine or a local network (localhost, *.local, a single label, …). */
+export function isLocalHostName(host) {
+  // A fully qualified name may end in a dot ("localhost.", "router.lan."); it names the same host.
+  // Trimmed with a loop, not /\.+$/, which backtracks quadratically on a long run of dots.
+  let end = host.length;
+  while (end > 0 && host.charCodeAt(end - 1) === 0x2e) end -= 1;
+  const name = host.slice(0, end);
+  return LOCAL_NAME_RE.test(name) || !name.includes(".");
+}
+
 /**
  * Check that a URL points at a public http(s) host. Resolves DNS names.
  * Returns {ok: true, addresses} or {ok: false, reason}.
@@ -88,7 +100,7 @@ export async function checkPublicUrl(raw, { allowLocal = false, lookup = dns.pro
   if (net.isIP(host)) {
     return isPrivateAddress(host) ? { ok: false, reason: `${host} is a private or local address` } : { ok: true, addresses: [host] };
   }
-  if (LOCAL_NAME_RE.test(host) || !host.includes(".")) return { ok: false, reason: `${host} is a local host name` };
+  if (isLocalHostName(host)) return { ok: false, reason: `${host} is a local host name` };
   let addresses;
   try {
     addresses = (await lookup(host, { all: true, verbatim: true })).map((entry) => entry.address);

package/dist/bind/src/web.mjs

@@ -5,7 +5,13 @@
 import { isUnavailable, pageFetch } from "./page-fetch.mjs";
 
 export const USER_AGENT = "Instafy-Agent/1.0 (+https://instafy.dev; reads one public page on a person's request)";
-export const AI_AGENTS = ["gptbot", "chatgpt-user", "oai-searchbot", "claudebot", "claude-user", "anthropic-ai", "perplexitybot", "ccbot", "google-extended"];
+// The AI crawlers and the user-initiated AI fetchers (the closest match to a read on a person's request). A site that
+// keeps any of them out of a path is not read there.
+export const AI_AGENTS = [
+  "gptbot", "chatgpt-user", "oai-searchbot", "claudebot", "claude-user", "claude-searchbot", "anthropic-ai", "perplexitybot",
+  "perplexity-user", "ccbot", "google-extended", "applebot-extended", "meta-externalagent", "meta-externalfetcher",
+  "bytespider", "amazonbot", "cohere-ai", "mistralai-user", "duckassistbot",
+];
 
 /** robots.txt → [{ agents: [lowercase], rules: [{ allow, path }] }] */
 export function parseRobots(txt) {