insta 0.0.48 → 0.0.51

package/dist/commands/db-query.js

@@ -0,0 +1,102 @@
+// `insta db query <service> [args...]` — run a query/command against a MANAGED database
+// (mysql/redis/mongodb) through the platform's console exec API. Postgres is not a console target
+// (it has the SQL editor / DATABASE_URL, and `insta db url|connect`), so a postgres service is
+// rejected here. The shape logic — path, request body, result rendering — lives in pure,
+// unit-tested seams; the handler just resolves the service and wires them to the API, this repo's
+// pure-seam convention.
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson, die, handleApproval } from '../util.js';
+import { q } from './services.js';
+export const MANAGED_ENGINES = ['mysql', 'redis', 'mongodb'];
+// pure: the console exec route for a managed-DB service.
+export function consoleExecPath(projectId, serviceId) {
+    return `/projects/${projectId}/database/console/${serviceId}/exec`;
+}
+// pure: map the engine + trailing args to the exec request body. mysql/mongodb take a single
+// command string (args joined with a space — the user quotes the whole statement); redis takes a
+// pre-tokenized argv (each arg verbatim, so a value with spaces survives as one token). Only
+// mongodb carries an optional --database.
+export function execBody(engine, args, database) {
+    if (engine === 'redis')
+        return { argv: args };
+    const command = args.join(' ');
+    if (engine === 'mongodb')
+        return { command, ...(database ? { database } : {}) };
+    return { command };
+}
+// pure: render a mysql result set as a simple left-aligned table — the header from columns, then
+// the rows, every column but the last padded so cells line up. A null cell renders as an em-dash
+// (the repo norm for a missing value), never an empty string. A trailing count line closes it.
+export function renderMysqlRows(data) {
+    const headers = (data.columns ?? []).map((c) => c.name);
+    const rows = data.rows ?? [];
+    const cell = (v) => (v === null || v === undefined ? '—' : String(v));
+    const widths = headers.map((h, i) => {
+        let w = h.length;
+        for (const r of rows)
+            w = Math.max(w, cell(r[i]).length);
+        return w;
+    });
+    const fmtRow = (vals) => vals.map((v, i) => (i === vals.length - 1 ? v : v.padEnd(widths[i] ?? 0))).join('  ');
+    const lines = [fmtRow(headers)];
+    for (const r of rows)
+        lines.push(fmtRow(headers.map((_, i) => cell(r[i]))));
+    const rowCount = typeof data.rowCount === 'number' ? data.rowCount : rows.length;
+    lines.push(`(${rowCount} rows${data.truncated ? ', truncated' : ''})`);
+    return lines;
+}
+// pure: a redis reply — a scalar prints raw, anything structured pretty-prints as JSON.
+export function renderRedisReply(reply) {
+    if (typeof reply === 'string' || typeof reply === 'number')
+        return String(reply);
+    return JSON.stringify(reply, null, 2);
+}
+// pure: a mongodb result is arbitrary JSON — pretty-print it.
+export function renderMongoResult(result) {
+    return JSON.stringify(result, null, 2);
+}
+async function dbQueryDeps(deps) {
+    if (deps)
+        return deps;
+    const [api, project] = [await ApiClient.load(), await requireProject()];
+    return { api, project };
+}
+// Resolve <service> (a service NAME) to its id + engine, then dispatch to the console exec API.
+export async function dbQuery(service, args, opts = {}, deps) {
+    // An empty command is never valid — reject it before loading config or hitting the network,
+    // rather than posting an empty statement/argv to the console.
+    if (args.length === 0) {
+        die('usage: insta db query <service> <query…> (mysql/mongodb: one quoted statement; redis: e.g. GET mykey)');
+    }
+    const { api, project: p } = await dbQueryDeps(deps);
+    const branch = opts.branch ?? p.branch;
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
+    const svc = services.find((s) => s.name === service);
+    if (!svc)
+        die(`service not found: ${service}`);
+    if (!MANAGED_ENGINES.includes(svc.type)) {
+        die('db query is for managed databases (mysql/redis/mongodb); postgres uses the SQL editor / DATABASE_URL');
+    }
+    const engine = svc.type;
+    // --database is a mongodb-only selector (execBody drops it for the others). Rejecting it here,
+    // rather than silently ignoring it, keeps the documented mongodb-only contract honest.
+    if (opts.database !== undefined && engine !== 'mongodb') {
+        die('--database is only supported for mongodb services');
+    }
+    const res = await api.rawRequest('POST', consoleExecPath(p.projectId, svc.id), execBody(engine, args, opts.database));
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    if (engine === 'mysql') {
+        for (const line of renderMysqlRows(res.body ?? {}))
+            info(line);
+    }
+    else if (engine === 'redis') {
+        info(renderRedisReply(res.body?.reply));
+    }
+    else {
+        info(renderMongoResult(res.body?.result));
+    }
+}
+//# sourceMappingURL=db-query.js.map

package/dist/commands/deploy.js

@@ -29,6 +29,25 @@ export function dockerfileExposedPort(dockerfile) {
     }
     return port;
 }
+// A directory deploy builds the Dockerfile IN the directory — there is no no-Dockerfile lane here.
+// The nixpacks (no-Dockerfile) lane is real but server-side: it runs on the build gateway for
+// GitHub-connected repos only, and nothing reachable from `insta deploy <dir>` can enter it. So the
+// dead-end message names every way forward instead of the bare "add one".
+//
+// It deliberately does NOT say "save the Dockerfile `insta build --explain` prints": that file is
+// not standalone — it COPYs `.nixpacks/nixpkgs-<hash>.nix` support files nixpacks writes beside it,
+// which the source dir does not have. Pointing at it would swap one false promise for another. The
+// detected install/start commands ARE reusable, so the message points at those.
+// Pure, so it's unit-tested.
+export function noDockerfileMessage(absDir) {
+    return [
+        `no Dockerfile at ${join(absDir, 'Dockerfile')} — a directory deploy builds the Dockerfile in the directory.`,
+        'Options:',
+        `  - add a Dockerfile to ${absDir} (\`insta build ${absDir}\` prints the install/start commands nixpacks detected, as a starting point)`,
+        '  - deploy a prebuilt image instead: `insta deploy --image <url>`',
+        "  - connect the app's GitHub repo in the console — that lane builds Dockerfile-less repos with nixpacks server-side",
+    ].join('\n');
+}
 // Deploy either a prebuilt image (`--image`) or a source directory (positional `<dir>`, built
 // remotely on Fly and pushed with a short-lived platform-minted token). Exactly one mode.
 export async function deploy(dir, opts) {
@@ -80,7 +99,7 @@ export async function dockerBuildLocal(absDir, tag, run = defaultBuildRunner) {
 export async function buildFromSource(api, projectId, dir, branch, opts, run = opts.json ? stderrBuildRunner : defaultBuildRunner) {
     const absDir = resolve(process.cwd(), dir);
     if (!existsSync(join(absDir, 'Dockerfile')))
-        die(`no Dockerfile at ${join(absDir, 'Dockerfile')} — add one, or use --image <url>`);
+        die(noDockerfileMessage(absDir));
     const log = note(opts);
     let tok;
     try {

package/dist/commands/env.js

@@ -70,7 +70,7 @@ export async function envUse(name, opts = {}) {
     info(`  api: ${nextApi}`);
     info(`  mcp: ${ENVS[target].mcp} (registers as \`${mcpServerName(target)}\`)`);
     if (hadSession)
-        info('  previous session dropped (separate deployment) — run `insta login --oauth github`');
+        info('  previous session dropped (separate deployment) — run `insta login`');
     // Switching the CLI does NOT re-point already-installed agents: their MCP registration and skill
     // files were written for the previous environment and are keyed by a different server name, so
     // they keep talking to it until setup is re-run. --env is REQUIRED in the hint: since 0.0.38 a

package/dist/commands/setup.js

@@ -6,19 +6,21 @@
 // Stack skills (tigris/better-auth) intentionally stay per-project: their presence in a
 // project doubles as its stack manifest — that install happens on `project create|link`.
 import { spawn } from 'node:child_process';
-import { closeSync, createReadStream, existsSync, openSync, readFileSync, statSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { closeSync, createReadStream, openSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import os from 'node:os';
 import { createInterface } from 'node:readline';
 import { ApiClient } from '../api.js';
 import { readPersistedGlobal, resolveEnv } from '../config.js';
 import { DEFAULT_ENV, ENVS, ENV_NAMES, envForApiUrl, envFromEnvVar, isEnvName, mcpServerName } from '../env.js';
-import { info } from '../util.js';
-import { loginOauth } from './auth.js';
+import { info, openUrl } from '../util.js';
+import { isRunnableFile, resolveSpawnable } from '../spawn.js';
+import { loginDevice } from './auth.js';
 import { projectLink } from './project.js';
 import { envUse } from './env.js';
 import { installAgentConfigs } from './mcp.js';
 import { detectChannel } from './upgrade.js';
+export { resolveSpawnable, whichOnPath } from '../spawn.js';
 // The `skills` tool we shell out to prints a clack UI: a frame-by-frame clone spinner, an
 // "Installing to all N agents" banner, a full N-line install-path box, and a third-party
 // "Security Risk Assessment" that flags our OWN first-party skill as "Critical Risk". Streamed
@@ -99,35 +101,6 @@ export function summarizeInstall(output) {
 // access() answers "can THIS process exec it", which for root is always yes, so a root-run
 // setup would wrongly treat a non-executable file as a durable install. On Windows execute
 // permission is extension-driven, so existence of a regular file is the right check.
-const isRunnableFile = (p, win) => {
-    try {
-        const st = statSync(p);
-        if (!st.isFile())
-            return false;
-        return win || (st.mode & 0o111) !== 0;
-    }
-    catch {
-        return false;
-    }
-};
-/** Resolve a bare command name to its absolute PATH location (PATHEXT-aware on Windows).
- *  cmd.exe searches the CURRENT DIRECTORY before PATH for bare names, so handing it a bare
- *  `claude` would let a claude.cmd planted in the project directory shadow the real CLI —
- *  the cmd.exe wrapper below only ever passes absolute paths. */
-export function whichOnPath(bin, env = process.env, platform = process.platform) {
-    const win = platform === 'win32';
-    const exts = win ? [...(env.PATHEXT ?? '.COM;.EXE;.BAT;.CMD').split(';'), ''] : [''];
-    for (const dir of (env.PATH ?? '').split(win ? ';' : ':')) {
-        if (!dir)
-            continue;
-        for (const ext of exts) {
-            const p = join(dir, bin + ext);
-            if (isRunnableFile(p, win))
-                return p;
-        }
-    }
-    return null;
-}
 export function findDurableOnPath(bin, env = process.env, platform = process.platform) {
     const win = platform === 'win32';
     const dirs = (env.PATH ?? '').split(win ? ';' : ':');
@@ -182,54 +155,6 @@ export async function ensureCliInstalled(run, channel = detectChannel(), onPath
         info('    (permission error: the npm prefix is system-owned — use a Node version manager, or elevate that one command)');
     }
 }
-// ---- Windows-safe spawning for npm/npx ----
-// On Windows `npm`/`npx` are .cmd shims, which spawn() without a shell refuses (Node docs:
-// spawning .bat/.cmd needs a shell or cmd.exe). Rather than a shell (argument-quoting hazards),
-// re-enter them as node scripts: the CLI script named by npm_execpath (swapped between
-// npm-cli.js and npx-cli.js as needed), else the one shipped beside the running node, else the
-// bare name (POSIX, where PATH shims resolve fine). Applied ONCE, inside the default runner,
-// so every `run('npm'|'npx', …)` call site benefits and nothing is ever resolved twice.
-export function resolveSpawnable(cmd, args, npmExecpath = process.env.npm_execpath, execPath = process.execPath, platform = process.platform, env = process.env) {
-    // Node re-entry is only valid when THIS process runs on node. On the native-binary channel
-    // execPath is the compiled `insta` executable — and npm scripts export npm_execpath to their
-    // children — so re-entering blindly would spawn `insta npx-cli.js …`. A non-node execPath
-    // sends npm/npx down the generic shim path below instead.
-    const execIsNode = /(^|[\\/])node(\.exe)?$/i.test(execPath);
-    if ((cmd === 'npm' || cmd === 'npx') && execIsNode) {
-        if (npmExecpath && /(^|[\\/])np[mx](-cli)?\.[cm]?js$/.test(npmExecpath)) {
-            const cli = npmExecpath.replace(/np[mx](-cli)?(\.[cm]?js)$/, `${cmd}$1$2`);
-            if (existsSync(cli))
-                return { cmd: execPath, args: [cli, ...args] };
-        }
-        const nodeDir = dirname(execPath);
-        const besideNode = platform === 'win32'
-            ? join(nodeDir, 'node_modules', 'npm', 'bin', `${cmd}-cli.js`)
-            : join(nodeDir, '..', 'lib', 'node_modules', 'npm', 'bin', `${cmd}-cli.js`);
-        if (existsSync(besideNode))
-            return { cmd: execPath, args: [besideNode, ...args] };
-    }
-    // Generic shim path — every non-npm CLI we shell out to (claude), plus npm/npx themselves
-    // when node isn't resolvable (native binary channel). On Windows these are .cmd shims, which
-    // spawn() refuses without a shell, so route them through cmd.exe. Guards, in order:
-    // - BARE names only: an absolute path or anything .exe (node.exe from a resolved npm/npx
-    //   invocation passing back through here) is directly spawnable and must NOT see cmd.exe.
-    // - The name is resolved to its ABSOLUTE PATH location first: cmd.exe searches the current
-    //   directory before PATH, so a bare name would let a shim planted in the project dir
-    //   shadow the real CLI. No PATH hit → pass through (spawn fails; callers degrade).
-    // - No manual quoting: libuv already wraps spaced args when building the child command
-    //   line — pre-quoting would be quoted AGAIN and arrive as literal quote characters.
-    // - That leaves cmd.exe metacharacters unprotectable, so an arg carrying one (e.g. a
-    //   custom INSTA_MCP_URL with `&`) skips the wrapper: the bare-shim spawn fails and every
-    //   caller degrades gracefully (probe → not-installed; registration → manual-add
-    //   fallback). Never hand metacharacters to a shell.
-    const bareShim = !/[\\/]/.test(cmd) && !/\.exe$/i.test(cmd);
-    if (platform === 'win32' && bareShim && !args.some((a) => /[&|<>^%"]/.test(a))) {
-        const abs = whichOnPath(cmd, env, platform);
-        if (abs)
-            return { cmd: 'cmd.exe', args: ['/d', '/s', '/c', abs, ...args] };
-    }
-    return { cmd, args };
-}
 // Capture stdout+stderr silently (don't stream) so we can print our own clean summary.
 // stdin is 'ignore', NOT 'inherit': under the canonical `curl … | sh` install, stdin is the
 // piped install script itself — a child that inherits it (npx/skills reads for keypresses even
@@ -422,7 +347,7 @@ const defaultAsk = async (question) => {
 };
 export async function setupAgent(opts, run = defaultRunner, mint, installConfigs = installAgentConfigs, ensure = (r) => ensureCliInstalled(r), readStored = readPersistedGlobal, switchEnv = (n) => envUse(n), loginFlow = {
     ask: defaultAsk,
-    login: () => loginOauth('github', {}),
+    login: () => loginDevice({}, openUrl),
     stdinTty: canPromptViaTty(),
     stdoutTty: !!process.stdout.isTTY,
 }, link = projectLink) {
@@ -473,7 +398,7 @@ export async function setupAgent(opts, run = defaultRunner, mint, installConfigs
     const stored = await readStored();
     let loggedIn = !!(stored.accessToken || stored.user);
     if (shouldOfferLogin(!!opts.yes, loggedIn, loginFlow.stdinTty, loginFlow.stdoutTty)) {
-        if (await loginFlow.ask('log in now with GitHub? (Y/n) ')) {
+        if (await loginFlow.ask('log in now in the browser? (Y/n) ')) {
             try {
                 await loginFlow.login();
                 loggedIn = true;
@@ -482,7 +407,7 @@ export async function setupAgent(opts, run = defaultRunner, mint, installConfigs
             }
             catch (e) {
                 info(`  login did not complete (${e instanceof Error ? e.message : String(e)}) — no problem, setup itself is done.`);
-                info('  on a remote/SSH machine the browser flow cannot call back here — use `insta login --device` instead.');
+                info('  run `insta login` to try again — the sign-in link it prints works from a browser on any device.');
             }
         }
     }