insta 0.0.25 → 0.0.27

package/README.md

@@ -79,8 +79,8 @@ plane's address, not the CLI's loopback address.
 ### Services are branch-scoped
 
 A project holds services (`postgres`, `storage`, `compute`) and each branch owns its own
-set. `insta branch create feature-x` forks the parent's services: a Neon branch per
-Postgres, a copy-on-write bucket per storage, a clone of every compute service. From there
+set. `insta branch create feature-x` forks the parent's services: a copy-on-write database
+branch per Postgres, a copy-on-write bucket per storage, a clone of every compute service. From there
 the two branches diverge independently. A project is capped at 10 branches.
 
 ### Credentials come from the secret seam, not a file you maintain
@@ -207,8 +207,9 @@ build never reaches a production installer.
 The `insta` skill and its task guides live in
 [InsForge/insta-skills](https://github.com/InsForge/insta-skills). `insta setup agent`
 installs it user-globally for every coding agent on the machine. `insta project create` and
-`insta project link` additionally install the stack skills (Neon Postgres, Tigris, Better
-Auth) into the project, along with the `insta observe` credential-audit hook.
+`insta project link` additionally install the stack skills (Tigris, Better Auth) into the
+project, along with the `insta observe` credential-audit hook. Postgres needs no stack
+skill — it's plain Postgres, reached directly via `DATABASE_URL`.
 
 ## Contributing
 

package/dist/commands/auth.js

@@ -1,6 +1,6 @@
 import { createServer } from 'node:http';
 import { randomBytes } from 'node:crypto';
-import { ApiClient, linkedProject } from '../api.js';
+import { ApiClient, ApiError, linkedProject } from '../api.js';
 import { ENVS, ENV_NAMES, envForApiUrl, isEnvName } from '../env.js';
 import { info, die, printJson, promptPassword, openUrl } from '../util.js';
 /** --api-url and --env both set the target host; --api-url wins (more specific), matching the
@@ -17,6 +17,8 @@ function targetApiUrl(opts) {
     return ENVS[want].api;
 }
 export async function login(opts) {
+    if (opts.device)
+        return loginDevice(opts);
     if (opts.oauth)
         return loginOauth(opts.oauth, opts);
     const api = await ApiClient.load();
@@ -24,7 +26,7 @@ export async function login(opts) {
     if (target)
         api.setApiUrl(target);
     if (!opts.email)
-        die('--email is required (or use --oauth <github|google>)');
+        die('--email is required (or use --oauth <github|google>; on a headless machine, --device)');
     const password = opts.password ?? process.env.INSTA_PASSWORD ?? (await promptPassword());
     const res = await api.request('POST', '/auth/login', { email: opts.email, password }, { auth: false });
     api.setSession(res, res.user);
@@ -47,6 +49,80 @@ export async function loginOauth(provider, opts) {
     await api.persist();
     info(`logged in as ${me.user.email ?? me.user.id} @ ${api.apiUrl}`);
 }
+// RFC 8628 device authorization — login from a machine with no usable browser (VM, SSH box, CI
+// container). The loopback --oauth flow can never work there: its callback targets 127.0.0.1 on
+// THIS machine. Here the roles invert — we mint a code, print a link the human opens on ANY
+// device, and poll the platform until they approve in the console.
+export async function loginDevice(opts) {
+    const api = await ApiClient.load();
+    const target = targetApiUrl(opts);
+    if (target)
+        api.setApiUrl(target);
+    const token = await deviceGrant((path, body) => api.request('POST', path, body, { auth: false }));
+    api.setSession({ accessToken: token, refreshToken: token });
+    const me = await api.request('GET', '/me');
+    api.setSession({ accessToken: token, refreshToken: token }, me.user);
+    await api.persist();
+    info(`logged in as ${me.user.email ?? me.user.id} @ ${api.apiUrl}`);
+}
+const sleepSeconds = (s) => new Promise((r) => setTimeout(r, s * 1000));
+// Drives the device grant against the platform's Better Auth mount (/api/auth/device*) and
+// returns the approved session token. Injectable poster + wait keep this testable without a
+// network or real timers. Poll errors arrive as ApiError with the OAuth error code as message.
+export async function deviceGrant(post, wait = sleepSeconds) {
+    const start = (await post('/api/auth/device/code', { client_id: 'insta-cli' }));
+    // A missing/garbage expires_in must fail loudly here — carried into the deadline arithmetic it
+    // becomes NaN, every `Date.now() < deadline` is false, and login dies as a bogus instant expiry.
+    // Cap the lifetime too: a huge-but-finite value (Number.MAX_VALUE) overflows the ms conversion
+    // to Infinity and would otherwise pin the CLI polling forever.
+    const expiresIn = Number(start.expires_in);
+    if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
+        throw new Error('malformed device authorization response (missing expires_in) — is the platform up to date?');
+    }
+    const lifetime = Math.min(expiresIn, 3600); // no device code sensibly outlives an hour
+    info('to log in, open this link in a browser on any device:');
+    info(`  ${start.verification_uri_complete ?? start.verification_uri}`);
+    info(`and check it shows this code: ${start.user_code}`);
+    info(`waiting for approval… (expires in ${Math.round(lifetime / 60)}m, ctrl-c to abort)`);
+    // Absent OR non-finite interval = the RFC 8628 §3.2 default 5s: NaN would fire the timer
+    // instantly and Infinity gets truncated to ~1ms by Node — both hot-poll the token endpoint.
+    const rawInterval = Number(start.interval);
+    let interval = Number.isFinite(rawInterval) ? Math.max(rawInterval, 1) : 5;
+    const deadline = Date.now() + lifetime * 1000;
+    while (Date.now() < deadline) {
+        await wait(interval);
+        let grant = null;
+        try {
+            grant = (await post('/api/auth/device/token', {
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                device_code: start.device_code,
+                client_id: 'insta-cli',
+            }));
+        }
+        catch (e) {
+            if (!(e instanceof ApiError))
+                continue; // transport blip (dropped SSH/CI link) — keep polling until deadline
+            const code = e.message;
+            if (code === 'authorization_pending')
+                continue;
+            if (code === 'slow_down') {
+                interval += 5;
+                continue;
+            } // RFC 8628 §3.5: back off by 5s
+            if (code === 'expired_token')
+                break;
+            if (code === 'access_denied')
+                throw new Error('login request was denied in the console');
+            throw e; // a definite API-level error (invalid_grant, …) — not retryable
+        }
+        // Validated OUTSIDE the try: a 200 without a token is a malformed response that must fail
+        // loudly, not be mistaken for a transport blip and retried into an empty stored session.
+        if (!grant?.access_token)
+            throw new Error('malformed token response (missing access_token)');
+        return grant.access_token;
+    }
+    throw new Error('device login expired before it was approved — run `insta login --device` again');
+}
 // Start a loopback server, open the browser at the platform bridge, and await the token.
 function browserOauth(apiUrl, provider) {
     return new Promise((resolve, reject) => {

package/dist/commands/setup.js

@@ -3,7 +3,7 @@
 // every agent the skills tool knows: the skill is pure product knowledge with brand-gated
 // triggers — no project state in it (the project binding is carried by ./.insta/project.json
 // at command time), so one machine-level copy is strictly better than per-project copies.
-// Stack skills (neon/tigris/better-auth) intentionally stay per-project: their presence in a
+// Stack skills (tigris/better-auth) intentionally stay per-project: their presence in a
 // project doubles as its stack manifest — that install happens on `project create|link`.
 import { spawn } from 'node:child_process';
 import os from 'node:os';

package/dist/ensure-skills.js

@@ -1,6 +1,7 @@
 // Install the related agent skills into a linked project so the developer's coding agent has
-// context for what InstaCloud provisions — the `insta` CLI itself plus the three services you build
-// directly against (Neon Postgres, Tigris storage, Better Auth). Runs `npx skills add`
+// context for what InstaCloud provisions — the `insta` CLI itself plus the services you build
+// directly against (Tigris storage, Better Auth). Postgres gets no vendor skill: instadb is
+// plain Postgres, and agents talk to it directly via DATABASE_URL. Runs `npx skills add`
 // (vercel-labs/skills) fully non-interactively. Best-effort: a failure (offline, npx missing, a
 // repo moved) prints a manual fallback and never blocks or fails the host command — same contract
 // as the observe-hook install.
@@ -13,8 +14,8 @@ import { DEFAULT_ENV, ENVS } from './env.js';
 // Codex → .agents/skills/ (.github/skills/ is the third well-known dir). These are regenerable
 // agent context, not the developer's source — keep them out of git.
 const SKILL_DIRS = ['.claude/skills/', '.agents/skills/', '.github/skills/'];
-// `skills` prints a full-screen ASCII banner at the top of every `add`, so our 4 invocations
-// would stack 4 banners. It skips the banner when it detects an agent driving it rather than a
+// `skills` prints a full-screen ASCII banner at the top of every `add`, so our 3 invocations
+// would stack 3 banners. It skips the banner when it detects an agent driving it rather than a
 // human — AI_AGENT is its first-checked signal (any non-empty value ⇒ agent mode). Setting it is
 // honest here (this IS programmatic, not an interactive prompt) and, because we already pin the
 // agents/skills/-y, has no effect on the install beyond quieting the banner. Preserve a caller's
@@ -32,10 +33,9 @@ const defaultRunner = (cmd, args, inherit = false) => new Promise((resolve) => {
 const AGENT_FLAGS = ['-a', 'claude-code', '-a', 'codex', '-y', '--copy'];
 // `instaSpec` is the insta skill source for the resolved environment (`owner/repo[@ref]`), so a
 // project created against staging gets the staging skill text. The third-party stack skills are
-// environment-independent — they document Neon/Tigris/Better Auth, not our control plane.
+// environment-independent — they document Tigris/Better Auth, not our control plane.
 const skillTargets = (instaSpec) => [
     { label: 'insta', args: ['skills', 'add', instaSpec, '-s', 'insta', ...AGENT_FLAGS] },
-    { label: 'neon-postgres', args: ['skills', 'add', 'neondatabase/agent-skills', '-s', 'neon-postgres', ...AGENT_FLAGS] },
     { label: 'tigris', args: ['skills', 'add', 'tigrisdata/skills',
             '-s', 'tigris-object-operations', '-s', 'file-storage', '-s', 'tigris-sdk-guide',
             '-s', 'tigris-security-access-control', '-s', 'tigris-image-optimization',
@@ -63,7 +63,7 @@ export async function installSkills(deps) {
             targets = skillTargets(skills);
         }
         catch { /* keep production defaults */ }
-        print('  installing related agent skills (insta, neon-postgres, tigris, better-auth) …');
+        print('  installing related agent skills (insta, tigris, better-auth) …');
         for (const s of targets) {
             // Don't stream: the `skills` tool's clack UI (clone spinner, banners) is noise. Run it
             // silent (stdio 'ignore') and let the per-skill ✓/failed line below be the clean output —

package/dist/index.js

@@ -54,10 +54,11 @@ function resolveVersion() {
 }
 program.name('insta').description('InstaCloud CLI — manage projects, branches, secrets, deploys').version(resolveVersion());
 // ---- auth ----
-program.command('login').description('Log in with email + password, or --oauth <github|google> (browser)')
+program.command('login').description('Log in with email + password, --oauth <github|google> (browser), or --device (headless)')
     .option('--email <email>', 'account email')
     .option('--password <password>', 'account password (else $INSTA_PASSWORD or prompt)')
     .option('--oauth <provider>', 'browser OAuth login: github | google')
+    .option('--device', 'device-code login: approve from a browser on any other machine (VMs, SSH, CI)')
     .option('--api-url <url>', 'control-plane API base URL')
     .option('--env <name>', `deployment environment: ${ENV_NAMES.join(' | ')}`)
     .action(guard((o) => auth.login(o)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.25",
+  "version": "0.0.27",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [