insta 0.0.48 → 0.0.51

package/README.md

@@ -61,7 +61,7 @@ off with `insta autoupdate off`.
 ## Quickstart
 
 ```bash
-insta login --oauth github
+insta login
 insta project create my-app
 insta services add postgres db
 insta services add compute api
@@ -79,13 +79,19 @@ service; it needs a `Dockerfile`, but no local Docker.
 ## Authentication
 
 ```bash
+insta login                                  # sign in from the browser (any account type)
 insta login --email you@example.com          # password from $INSTA_PASSWORD or a prompt
 insta login --oauth github                   # or google, through the browser
-insta login --env staging --oauth github     # log in to a specific deployment
+insta login --env staging                    # log in to a specific deployment
 ```
 
 Tokens are stored in `~/.insta/config.json` and refresh automatically.
 
+Bare `insta login` opens the console's device-approval page in your browser: sign in there
+with whatever your account uses (email, GitHub, Google), check the code matches, and approve.
+On a machine that can't open a browser, `--device` prints the same link to open from any
+other device.
+
 `--oauth` starts a loopback listener on `127.0.0.1`, opens the browser at the control
 plane's `/auth/cli/authorize`, and receives the token back on that listener once the
 provider has authorized you. Nothing is pasted by hand.
@@ -189,7 +195,7 @@ build never reaches a production installer.
 
 | Command | What it covers |
 |---|---|
-| `insta login` · `logout` · `status` | Email/password or `--oauth github\|google`; `status` shows the environment, login and linked project/branch |
+| `insta login` · `logout` · `status` | Browser sign-in (default), `--email` + password, or `--oauth github\|google`; `status` shows the environment, login and linked project/branch |
 | `insta env` | `show` · `use <prod\|staging>` |
 | `insta setup` | `agent` — install the CLI (if missing), the skill, and MCP for every coding agent; targets prod, `--env staging` for staging |
 | `insta mcp` | `install` — register the remote MCP server only |

package/dist/api.js

@@ -130,7 +130,7 @@ export async function requireProject() {
     }
     catch (e) {
         if (e instanceof ApiError && e.status === 401) {
-            die('not logged in — run `insta login --oauth github` (cloud) or point INSTA_API_URL at your insta-oss daemon');
+            die('not logged in — run `insta login` (cloud) or point INSTA_API_URL at your insta-oss daemon');
         }
         die(e instanceof Error ? e.message : String(e));
     }

package/dist/commands/auth.js

@@ -16,7 +16,8 @@ function targetApiUrl(opts) {
         die(`unknown --env "${opts.env}" — expected one of: ${ENV_NAMES.join(', ')}`);
     return ENVS[want].api;
 }
-export async function login(opts) {
+// `device` is injectable so the dispatch itself is testable (repo pattern: DI fakes, no mocks).
+export async function login(opts, device = loginDevice) {
     // Login modes are exclusive — pick one. Check presence (not truthiness) so an explicit
     // empty --api-key= is rejected by validation rather than silently falling through.
     if (opts.apiKey !== undefined) {
@@ -25,15 +26,24 @@ export async function login(opts) {
         return loginApiKey(opts.apiKey, opts);
     }
     if (opts.device)
-        return loginDevice(opts);
+        return device(opts);
     if (opts.oauth)
         return loginOauth(opts.oauth, opts);
+    // An explicitly empty --email is a mistake, not a request for the bare browser flow.
+    if (opts.email === '')
+        die('--email must not be empty');
+    if (!opts.email) {
+        // Bare `insta login` = sign in from the browser. The device grant is the one flow that covers
+        // every account type (email, GitHub, Google): the console approval page owns the signin
+        // round-trip, so the CLI just opens it here instead of only printing the link.
+        if (opts.password !== undefined || process.env.INSTA_PASSWORD !== undefined)
+            die('a password (--password / $INSTA_PASSWORD) is only used with --email <email>');
+        return device(opts, openUrl);
+    }
     const api = await ApiClient.load();
     const target = targetApiUrl(opts);
     if (target)
         api.setApiUrl(target);
-    if (!opts.email)
-        die('--email is required (or use --oauth <github|google>; on a headless machine, --device)');
     const password = opts.password ?? process.env.INSTA_PASSWORD ?? (await promptPassword());
     const res = await api.request('POST', '/auth/login', { email: opts.email, password }, { auth: false });
     api.setSession(res, res.user);
@@ -56,16 +66,17 @@ export async function loginOauth(provider, opts) {
     await api.persist();
     info(`logged in as ${me.user.email ?? me.user.id} @ ${api.apiUrl}`);
 }
-// RFC 8628 device authorization — login from a machine with no usable browser (VM, SSH box, CI
-// container). The loopback --oauth flow can never work there: its callback targets 127.0.0.1 on
-// THIS machine. Here the roles invert — we mint a code, print a link the human opens on ANY
-// device, and poll the platform until they approve in the console.
-export async function loginDevice(opts) {
+// RFC 8628 device authorization — the default login (bare `insta login` passes `open` to also
+// launch the browser here), and as --device the flow for a machine with no usable browser (VM,
+// SSH box, CI container), where the loopback --oauth flow can never work: its callback targets
+// 127.0.0.1 on THIS machine. We mint a code, hand the human a link to the console approval page
+// (which owns the signin round-trip), and poll the platform until they approve.
+export async function loginDevice(opts, open) {
     const api = await ApiClient.load();
     const target = targetApiUrl(opts);
     if (target)
         api.setApiUrl(target);
-    const token = await deviceGrant((path, body) => api.request('POST', path, body, { auth: false }));
+    const token = await deviceGrant((path, body) => api.request('POST', path, body, { auth: false }), sleepSeconds, open);
     api.setSession({ accessToken: token, refreshToken: token });
     const me = await api.request('GET', '/me');
     api.setSession({ accessToken: token, refreshToken: token }, me.user);
@@ -106,7 +117,9 @@ const sleepSeconds = (s) => new Promise((r) => setTimeout(r, s * 1000));
 // Drives the device grant against the platform's Better Auth mount (/api/auth/device*) and
 // returns the approved session token. Injectable poster + wait keep this testable without a
 // network or real timers. Poll errors arrive as ApiError with the OAuth error code as message.
-export async function deviceGrant(post, wait = sleepSeconds) {
+// `open` (the default browser-login path) launches the verification link locally on top of
+// printing it; without it (--device) the link is print-only, for a browser on another machine.
+export async function deviceGrant(post, wait = sleepSeconds, open) {
     const start = (await post('/api/auth/device/code', { client_id: 'insta-cli' }));
     // A missing/garbage expires_in must fail loudly here — carried into the deadline arithmetic it
     // becomes NaN, every `Date.now() < deadline` is false, and login dies as a bogus instant expiry.
@@ -117,8 +130,18 @@ export async function deviceGrant(post, wait = sleepSeconds) {
         throw new Error('malformed device authorization response (missing expires_in) — is the platform up to date?');
     }
     const lifetime = Math.min(expiresIn, 3600); // no device code sensibly outlives an hour
-    info('to log in, open this link in a browser on any device:');
-    info(`  ${start.verification_uri_complete ?? start.verification_uri}`);
+    const url = start.verification_uri_complete ?? start.verification_uri;
+    if (open) {
+        info('opening your browser to sign in…');
+        // Always print the link too: a launcher that fails to start reports it on spawn's ASYNC
+        // error event, so open's return value cannot see it (same reasoning as browserOauth).
+        info(`if nothing opens, use this link in a browser on any device:\n  ${url}`);
+        open(url);
+    }
+    else {
+        info('to log in, open this link in a browser on any device:');
+        info(`  ${url}`);
+    }
     info(`and check it shows this code: ${start.user_code}`);
     info(`waiting for approval… (expires in ${Math.round(lifetime / 60)}m, ctrl-c to abort)`);
     // Absent OR non-finite interval = the RFC 8628 §3.2 default 5s: NaN would fire the timer
@@ -158,7 +181,7 @@ export async function deviceGrant(post, wait = sleepSeconds) {
             throw new Error('malformed token response (missing access_token)');
         return grant.access_token;
     }
-    throw new Error('device login expired before it was approved — run `insta login --device` again');
+    throw new Error(`device login expired before it was approved — run \`insta login${open ? '' : ' --device'}\` again`);
 }
 // Start a loopback server, open the browser at the platform bridge, and await the token.
 function browserOauth(apiUrl, provider) {

package/dist/commands/billing.js

@@ -8,7 +8,10 @@ async function resolveOrgId(opts) {
     return (await requireProject()).orgId;
 }
 // Format the billing overview into printable lines (pure, so it's unit-testable).
-export function billingLines(s) {
+// `org` is the caller's --org, echoed into the portal hint: `billing` and `billing portal` resolve
+// the target independently, so a hint that drops the flag sends someone reading org A's overview to
+// org B's portal.
+export function billingLines(s, org) {
     const t = s.totals;
     const lines = [
         `tier:      ${s.tier}`,
@@ -23,7 +26,37 @@ export function billingLines(s) {
     if (s.subscriptionStatus)
         lines.push(`subscription: ${s.subscriptionStatus}`);
     if (s.billingStatus === 'suspended') {
-        lines.push('⚠  org suspended — billing limit reached; resumes next cycle (or `insta billing upgrade pro`)');
+        // Four causes, five messages, and every one is a dead end for the others. Tier first: only a
+        // free org can spend a prepaid wallet, and waiting for the next cycle genuinely fixes that one.
+        // (Tier, not subscriptionStatus, because rows written before non-payment suspended carry
+        // `unpaid` beside tier 'free' and survive with no migration.) Then the status splits the paid
+        // branch three ways: an invoice to settle, a subscription to replace, or — when it reads
+        // healthy — a suspension that outlived its cause, which is what a recovery whose compute failed
+        // to restart looks like, and where telling them to pay means re-settling a paid invoice. The
+        // replace case is the one that splits again, because enterprise has no self-serve checkout.
+        //
+        // EVERY command here carries the caller's --org. `billing` and the command being suggested
+        // resolve the target independently, so a hint that drops the flag acts on a different org than
+        // the one being read — and two of them take payment.
+        const flag = org ? ` --org ${org}` : '';
+        const lapsed = s.subscriptionStatus === 'past_due' || s.subscriptionStatus === 'unpaid';
+        const ended = s.subscriptionStatus === 'canceled' || s.subscriptionStatus === 'incomplete_expired';
+        lines.push(s.tier === 'free'
+            ? `⚠  org suspended — billing limit reached; resumes next cycle (or \`insta billing upgrade pro${flag}\`)`
+            : lapsed
+                ? `⚠  org suspended — subscription payment did not go through; settle it in \`insta billing portal${flag}\``
+                : ended
+                    ? s.tier === 'enterprise'
+                        // Per-deal, and `billing upgrade` cannot create one: naming a self-serve tier here
+                        // would move them off the plan they negotiated.
+                        ? '⚠  org suspended — the subscription ended; contact support to restore this plan'
+                        // Their OWN tier, not a hardcoded one: suggesting `upgrade pro` to a Team org
+                        // resubscribes it onto the wrong plan.
+                        : `⚠  org suspended — the subscription ended; resubscribe with \`insta billing upgrade ${s.tier}${flag}\``
+                    // Deliberately claims nothing about the subscription: `incomplete` reaches here too,
+                    // and that one is neither current nor failed. All this branch knows is that the
+                    // suspension has no billing cause it can name.
+                    : '⚠  org suspended — no failed payment on file; contact support');
     }
     if (s.byDimension?.length) {
         lines.push('by dimension:');
@@ -44,13 +77,17 @@ export async function billing(opts) {
     const s = await api.request('GET', `/orgs/${orgId}/billing/overview`);
     if (opts.json)
         return printJson(s);
-    for (const l of billingLines(s))
+    for (const l of billingLines(s, opts.org))
         info(l);
 }
 // insta billing upgrade <tier> — start a Stripe Checkout to subscribe the org to a paid tier.
 export async function billingUpgrade(tier, opts) {
-    if (tier !== 'pro' && tier !== 'enterprise')
-        die('tier must be pro|enterprise');
+    // pro|team, matching what POST /orgs/:orgId/billing/checkout actually accepts. This said
+    // pro|enterprise, which was wrong both ways: `team` is a real self-serve tier and was refused
+    // here, and `enterprise` is per-deal and 400s at the server. The suspension hint above now names
+    // the org's own tier, so a Team org was being sent to a command that rejected it.
+    if (tier !== 'pro' && tier !== 'team')
+        die('tier must be pro|team');
     const api = await ApiClient.load();
     const orgId = await resolveOrgId(opts);
     const { url } = await api.request('POST', `/orgs/${orgId}/billing/checkout`, { tier });

package/dist/commands/build.js

@@ -154,14 +154,31 @@ export async function buildReport(dirArg, opts, deps) {
     const envExample = join(dir, '.env.example');
     const envKeys = existsSync(envExample) ? envKeysFromDotEnvExample(readFileSync(envExample, 'utf8')) : [];
     const checks = [];
-    checks.push({
-        id: 'dockerfile',
-        severity: 'critical',
-        status: dockerfile.source ? 'pass' : 'fail',
-        title: 'Dockerfile',
-        detail: dockerfileDetail,
-        ...(dockerfile.source ? {} : { nextAction: `add a Dockerfile at ${userDockerfilePath}, or install nixpacks (https://nixpacks.com/docs/install) so insta can generate one` }),
-    });
+    // Only a Dockerfile IN the directory passes. A nixpacks-generated one is a real plan, but it is
+    // not a plan `insta deploy <dir>` can execute: that path builds the directory's own Dockerfile and
+    // dies without one, and the nixpacks lane runs server-side for GitHub-connected repos only. This
+    // check used to pass on the generated Dockerfile, so a verifier said "deployable" about a
+    // directory `deploy` refuses — the whole point of the command is to not do that.
+    checks.push(dockerfile.source === 'nixpacks'
+        ? {
+            id: 'dockerfile',
+            severity: 'warning',
+            status: 'fail',
+            title: 'Dockerfile',
+            detail: `${dockerfileDetail} — but \`insta deploy <dir>\` builds the directory's own Dockerfile; the nixpacks lane runs server-side for GitHub-connected repos only`,
+            // NOT "save the generated Dockerfile here": it is not standalone (it COPYs the
+            // .nixpacks/nixpkgs-<hash>.nix support files nixpacks writes beside it, which this
+            // directory does not have). The detected commands above are the reusable part.
+            nextAction: `to deploy this directory, write a Dockerfile at ${userDockerfilePath} — the detected install/start commands above are the starting point; or connect the repo on GitHub to use the nixpacks lane`,
+        }
+        : {
+            id: 'dockerfile',
+            severity: 'critical',
+            status: dockerfile.source ? 'pass' : 'fail',
+            title: 'Dockerfile',
+            detail: dockerfileDetail,
+            ...(dockerfile.source ? {} : { nextAction: `add a Dockerfile at ${userDockerfilePath}, or install nixpacks (https://nixpacks.com/docs/install) so insta can show you the one it would generate` }),
+        });
     if (builder === 'dockerfile') {
         const hasCmd = /^\s*(CMD|ENTRYPOINT)\s/im.test(dockerfile.content ?? '');
         checks.push({
@@ -207,7 +224,10 @@ const MARK = { pass: '✓', fail: '✗', skip: '·' };
 export function renderReport(r, explain) {
     const lines = [];
     lines.push(`plan for ${r.dir}:`);
-    lines.push(`  builder: ${r.plan.builder ?? 'none'}${r.plan.providers.length ? ` (providers: ${r.plan.providers.join(', ')})` : ''}`);
+    // The builder line is the first thing read (and the thing an agent scrapes), so it carries the
+    // lane caveat too — "builder: nixpacks" on its own reads as a promise `insta deploy <dir>` breaks.
+    const lane = r.plan.builder === 'nixpacks' ? ' — GitHub lane only; `insta deploy <dir>` needs a Dockerfile' : '';
+    lines.push(`  builder: ${r.plan.builder ?? 'none'}${r.plan.providers.length ? ` (providers: ${r.plan.providers.join(', ')})` : ''}${lane}`);
     if (r.plan.installCommand)
         lines.push(`  install: ${r.plan.installCommand}`);
     if (r.plan.buildCommand)
@@ -226,6 +246,11 @@ export function renderReport(r, explain) {
     }
     if (explain && r.dockerfile.content) {
         lines.push(`dockerfile (${r.dockerfile.source}):`);
+        // A nixpacks Dockerfile is shown for inspection, NOT for copying: it COPYs the
+        // .nixpacks/nixpkgs-<hash>.nix support files nixpacks generates beside it, so saving this text
+        // alone as ./Dockerfile produces a build that fails on the missing COPY.
+        if (r.dockerfile.source === 'nixpacks')
+            lines.push('  # for inspection — not standalone: it COPYs .nixpacks/ support files generated alongside it');
         for (const l of r.dockerfile.content.trimEnd().split('\n'))
             lines.push(`  ${l}`);
     }