insta 0.0.3 → 0.0.5

package/dist/commands/secrets.js

@@ -1,6 +1,6 @@
 import { writeFile } from 'node:fs/promises';
 import { ApiClient, requireProject } from '../api.js';
-import { info, printJson, serializeEnv, handleApproval } from '../util.js';
+import { info, printJson, serializeEnv, handleApproval, die } from '../util.js';
 function q(branch) {
     return branch ? `?branch=${encodeURIComponent(branch)}` : '';
 }
@@ -33,4 +33,33 @@ export async function secretsList(opts) {
     for (const name of Object.keys(res.body.secrets))
         info(name);
 }
+async function readStdin() {
+    let data = '';
+    for await (const chunk of process.stdin)
+        data += chunk;
+    return data.trim();
+}
+// Set a user secret. Project-wide by default; --branch scopes it to one branch. Value comes from
+// the argument, or stdin when omitted (keeps secret values out of shell history).
+export async function secretsSet(name, value, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const v = value ?? (await readStdin());
+    if (!v)
+        die('value is required (pass as an argument or on stdin)');
+    const payload = opts.branch ? { value: v, branch: opts.branch } : { value: v };
+    const res = await api.rawRequest('PUT', `/projects/${p.projectId}/secrets/${encodeURIComponent(name)}`, payload);
+    if (handleApproval(res))
+        return;
+    info(`set ${name} (${opts.branch ? `branch ${opts.branch}` : 'project-wide'})`);
+}
+export async function secretsUnset(name, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const qs = opts.branch ? `?branch=${encodeURIComponent(opts.branch)}` : '';
+    const res = await api.rawRequest('DELETE', `/projects/${p.projectId}/secrets/${encodeURIComponent(name)}${qs}`);
+    if (handleApproval(res))
+        return;
+    info(`unset ${name} (${opts.branch ? `branch ${opts.branch}` : 'project-wide'})`);
+}
 //# sourceMappingURL=secrets.js.map

package/dist/ensure-skills.js

@@ -11,8 +11,15 @@ import { join } from 'node:path';
 // Codex → .agents/skills/ (.github/skills/ is the third well-known dir). These are regenerable
 // agent context, not the developer's source — keep them out of git.
 const SKILL_DIRS = ['.claude/skills/', '.agents/skills/', '.github/skills/'];
+// `skills` prints a full-screen ASCII banner at the top of every `add`, so our 4 invocations
+// would stack 4 banners. It skips the banner when it detects an agent driving it rather than a
+// human — AI_AGENT is its first-checked signal (any non-empty value ⇒ agent mode). Setting it is
+// honest here (this IS programmatic, not an interactive prompt) and, because we already pin the
+// agents/skills/-y, has no effect on the install beyond quieting the banner. Preserve a caller's
+// existing AI_AGENT (e.g. running inside another agent) rather than clobbering it.
 const defaultRunner = (cmd, args, inherit = false) => new Promise((resolve) => {
-    const p = spawn(cmd, args, { stdio: inherit ? 'inherit' : 'ignore' });
+    const env = { ...process.env, AI_AGENT: process.env.AI_AGENT || 'insta' };
+    const p = spawn(cmd, args, { stdio: inherit ? 'inherit' : 'ignore', env });
     p.on('error', () => resolve({ ok: false })); // e.g. npx not on PATH
     p.on('close', (code) => resolve({ ok: code === 0 }));
 });

package/dist/index.js

@@ -24,6 +24,14 @@ function onError(e) {
 // Wrap an async action so rejections surface as clean CLI errors.
 const guard = (fn) => (...a) => fn(...a).then(() => undefined).catch(onError);
 const program = new Command();
+// Positional options: some command groups (e.g. `secrets`, `billing`) declare a flag (like
+// --branch or --org) both on the group itself (for its own default action) and on a subcommand
+// of that group. Without this, commander lets the group's own option greedily match the flag
+// no matter where it appears, so e.g. `secrets set NAME val --branch b` silently drops --branch
+// into the (unused) group-level options instead of the subcommand's. Positional parsing makes a
+// group's own options only match before the subcommand name, so occurrences after it are matched
+// against the subcommand's own (identically-named) option instead.
+program.enablePositionalOptions();
 // Version resolution: INSTA_CLI_VERSION (baked into the standalone binary via bun build --define) →
 // the installed package.json (npm/node — ../package.json sits beside dist/) → 0.0.0.
 function resolveVersion() {
@@ -78,6 +86,10 @@ const sec = program.command('secrets').description('Fetch the credential bundle
     .option('--branch <branch>').option('-o, --output <file>', 'output file (default .env)').option('--print', 'print instead of writing').option('--json')
     .action(guard((o) => secretsCmd.secrets(o)));
 sec.command('list').description('List secret names only').option('--branch <branch>').action(guard((o) => secretsCmd.secretsList(o)));
+sec.command('set <name> [value]').description('Set a user secret (project-wide; value from stdin if omitted)')
+    .option('--branch <branch>', 'scope to one branch').action(guard((n, v, o) => secretsCmd.secretsSet(n, v, o)));
+sec.command('unset <name>').description('Remove a user secret')
+    .option('--branch <branch>', 'scope to one branch').action(guard((n, o) => secretsCmd.secretsUnset(n, o)));
 // ---- deploy ----
 program.command('deploy [dir]').description('Deploy a source directory (built remotely on Fly) or a prebuilt --image to a branch compute group')
     .option('--image <url>', 'prebuilt container image to deploy (instead of a source dir)').option('--branch <b>').option('--group <g>').option('--port <p>')
@@ -127,6 +139,6 @@ ob.command('sync').description('Upload findings into the project timeline').acti
 // ---- policy ----
 const pol = program.command('policy').description('Governance policy');
 pol.command('get').option('--json').action(guard((o) => govern.policyGet(o)));
-pol.command('set <action> <decision>').description('action: secrets.read|deploy|project.delete|branch.delete|service.add|service.remove|service.scale|service.upgrade; decision: allow|deny|approve').action(guard((a, d) => govern.policySet(a, d)));
+pol.command('set <action> <decision>').description('action: secrets.read|secrets.write|deploy|project.delete|branch.delete|service.add|service.remove|service.scale|service.upgrade; decision: allow|deny|approve').action(guard((a, d) => govern.policySet(a, d)));
 program.parseAsync(process.argv);
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": ["insta", "insforge", "cli", "backend", "baas", "platform"],