insta 0.0.43 → 0.0.44

package/README.md

@@ -157,7 +157,7 @@ That host is a CloudFront cache, so after a change to the installer it can serve
 previous copy for up to about a day. This form is equivalent and always current:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/InsForge/insta-cli/main/install.sh | sh -s -- --agents --staging -y
+curl -fsSL https://raw.githubusercontent.com/InsForge/insta-cli/main/install.sh | sh -s -- --agents --staging
 ```
 
 If the environment cannot be applied — an installed CLI older than 0.0.23 has no `insta

package/dist/commands/setup.js

@@ -6,7 +6,7 @@
 // Stack skills (tigris/better-auth) intentionally stay per-project: their presence in a
 // project doubles as its stack manifest — that install happens on `project create|link`.
 import { spawn } from 'node:child_process';
-import { existsSync, readFileSync, statSync } from 'node:fs';
+import { closeSync, createReadStream, existsSync, openSync, readFileSync, statSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import os from 'node:os';
 import { createInterface } from 'node:readline';
@@ -357,8 +357,55 @@ export function shouldOfferLogin(yes, loggedIn, stdinTty, stdoutTty) {
 // One Enter continues into the browser login; only an explicit n/no declines. Matches the
 // curl-installer feel: the single command carries you as far as automation can go, and the one
 // genuinely human step (authorizing in the browser) starts itself instead of being homework.
+// Where to read the answer from. Under `curl … | sh` stdin is the SCRIPT pipe, not the human —
+// but the controlling terminal can still answer, via /dev/tty (the standard installer trick;
+// Homebrew prompts the same way). Never on Windows (no /dev/tty, and the curl path doesn't exist
+// there), and never without one (agents, CI, cron — openSync fails, so they can't be prompted).
+/** Wrap an already-open fd as a prompt input with SINGLE-OWNER cleanup: the stream owns the fd
+ *  (autoClose), close() only destroys the stream, and post-close stream errors are swallowed.
+ *  ReadStream.destroy() closes the fd asynchronously on Node 20, so a second closeSync here
+ *  would race it into an unhandled EBADF right after the user answers. */
+export function makePromptSource(fd) {
+    const stream = createReadStream('', { fd, autoClose: true });
+    stream.on('error', () => { });
+    return { input: stream, close: () => { try {
+            stream.destroy();
+        }
+        catch { /* already destroyed */ } } };
+}
+const openPromptInput = () => {
+    if (process.stdin.isTTY)
+        return { input: process.stdin, close: () => { } };
+    if (process.platform === 'win32')
+        return null;
+    try {
+        return makePromptSource(openSync('/dev/tty', 'r'));
+    }
+    catch {
+        return null;
+    }
+};
+/** Whether a human can answer a prompt at all: an interactive stdin, or a reachable /dev/tty
+ *  (the curl|sh case). The stdout-TTY requirement lives in shouldOfferLogin — an agent piping
+ *  our output must never be prompted even though its process may have a controlling terminal. */
+export function canPromptViaTty() {
+    if (process.stdin.isTTY)
+        return true;
+    if (process.platform === 'win32')
+        return false;
+    try {
+        closeSync(openSync('/dev/tty', 'r'));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 const defaultAsk = async (question) => {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const src = openPromptInput();
+    if (!src)
+        return false; // gate said yes but the terminal vanished — decline, never hang
+    const rl = createInterface({ input: src.input, output: process.stdout });
     // EOF (Ctrl-D) closes the interface without ever answering the question — resolve that as a
     // decline instead of hanging forever after the checkmarks.
     const answer = await new Promise((resolve) => {
@@ -366,12 +413,13 @@ const defaultAsk = async (question) => {
         rl.question(question, resolve);
     });
     rl.close();
+    src.close();
     return !/^n/i.test(answer.trim());
 };
 export async function setupAgent(opts, run = defaultRunner, mint, installConfigs = installAgentConfigs, ensure = (r) => ensureCliInstalled(r), readStored = readPersistedGlobal, switchEnv = (n) => envUse(n), loginFlow = {
     ask: defaultAsk,
     login: () => loginOauth('github', {}),
-    stdinTty: !!process.stdin.isTTY,
+    stdinTty: canPromptViaTty(),
     stdoutTty: !!process.stdout.isTTY,
 }) {
     if (!opts.yes && !process.stdout.isTTY) {
@@ -445,7 +493,7 @@ export async function setupAgent(opts, run = defaultRunner, mint, installConfigs
     // (project create/link, deploys, login via the device flow), so the human just asks for the
     // thing they actually want.
     info(loggedIn
-        ? 'next: open your coding agent inside your app and ask it to "deploy this app on InstaCloud"'
-        : 'next: open your coding agent inside your app and ask it to "deploy this app on InstaCloud" — it will walk you through `insta login`');
+        ? 'next: open your coding agent inside your app and start building — ask it to "deploy this app on InstaCloud" when you\'re ready'
+        : 'next: open your coding agent inside your app and start building — ask it to "deploy this app on InstaCloud" when you\'re ready (it will walk you through `insta login`)');
 }
 //# sourceMappingURL=setup.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.43",
+  "version": "0.0.44",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [