insta 0.0.48 → 0.0.51

package/dist/commands/upgrade.js

@@ -1,19 +1,43 @@
 // Self-update: `insta upgrade` updates the CLI in place, channel-aware (native binary via the
-// release installer; npm via `npm i -g`). A background version check (detached, cached 24h in
+// release installer; npm via `npm i -g`). A background version check (detached, cached in
 // ~/.insta/update-check.json) powers an update nudge — and, since the CLI is young and moves
-// fast, AUTO-UPDATE IS ON BY DEFAULT: when a newer version is known, the next invocation spawns
-// a quiet detached upgrade. `insta autoupdate off` (or INSTA_NO_AUTOUPDATE=1) disables that,
-// leaving just the stderr nudge.
+// fast, AUTO-UPDATE IS ON BY DEFAULT: when a newer version is known, a quiet upgrade runs in the
+// background. `insta autoupdate off` (or INSTA_NO_AUTOUPDATE=1) disables that, leaving just the
+// stderr nudge.
+//
+// ONE SOURCE OF TRUTH. "What is the latest insta?" is answered in exactly one place —
+// `resolveLatest()`, reading npm's `latest` dist-tag, the same thing `npx insta@latest` and
+// `npm i -g insta` resolve. Both the background check and `insta upgrade` go through it, and the
+// binary channel then installs THAT version by tag (INSTA_VERSION=v<latest>) rather than asking
+// GitHub independently for /releases/latest. Two independent resolvers is how the two paths came
+// to disagree; they have drifted before (v0.0.46 was merged but never tagged, so it exists on
+// neither npm nor GitHub).
+//
+// A CACHE MUST NOT LIE. ~/.insta/update-check.json is a cache of that one answer, never a second
+// source. Every path that learns the real latest rewrites it (including a successful upgrade),
+// and any entry that is old, malformed, or behind the running build is refused rather than used
+// — a sticky wrong `latest` is what silently pinned existing installs to an old version.
 import { spawn } from 'node:child_process';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { readGlobal, writeGlobal } from '../config.js';
+import { resolveSpawnable } from '../spawn.js';
 import { info } from '../util.js';
 const INSTALL_SH = 'https://raw.githubusercontent.com/InsForge/insta-cli/main/install.sh';
+// The dist-tag document is the authoritative, tiny (~50 byte) answer for `latest`. The full
+// `latest` manifest is the fallback if that route is ever unavailable.
+const REGISTRY_DIST_TAGS = 'https://registry.npmjs.org/-/package/insta/dist-tags';
 const REGISTRY_LATEST = 'https://registry.npmjs.org/insta/latest';
-const CHECK_TTL_MS = 24 * 60 * 60 * 1000; // re-check the registry at most once a day
-const AUTO_THROTTLE_MS = 60 * 60 * 1000; //  don't respawn a failed auto-upgrade more than hourly
+// Re-check at most this often. Deliberately short: releases ship every day or two, so a TTL
+// measured in days strands every existing install whenever a release lands just after a check.
+export const CHECK_TTL_MS = 3 * 60 * 60 * 1000;
+const AUTO_THROTTLE_MS = 60 * 60 * 1000; //  don't retry a failed auto-upgrade more than hourly
+const FETCH_TIMEOUT_MS = 5000;
+export function resolveRunSpec(spec, npmExecpath = spec.env.npm_execpath, execPath = process.execPath, platform = process.platform) {
+    const resolved = resolveSpawnable(spec.cmd, spec.args, npmExecpath, execPath, platform, spec.env);
+    return { ...spec, ...resolved };
+}
 const cachePath = () => process.env.INSTA_UPDATE_CACHE ?? join(homedir(), '.insta', 'update-check.json');
 // How is this CLI running? Bun standalone → execPath IS the insta binary (not node);
 // npm global → the module lives under node_modules; anything else is a source checkout.
@@ -24,17 +48,110 @@ export function detectChannel(execPath = process.execPath, moduleUrl = import.me
         return 'npm';
     return 'source';
 }
-// -1 / 0 / 1 for a<b / a==b / a>b on dotted numeric versions ("0.0.4" style).
+// A publishable, non-prerelease version. Anything carrying a `-suffix` (0.0.23-rc.1 — the `next`
+// dist-tag today) is not a stable release and must never be offered as "latest".
+const STABLE_VERSION_RE = /^\d+\.\d+\.\d+(?:\+[0-9A-Za-z.-]+)?$/;
+export function isStableVersion(v) {
+    return typeof v === 'string' && STABLE_VERSION_RE.test(v.trim().replace(/^v/, ''));
+}
+function parseVersion(v) {
+    const noBuild = String(v ?? '')
+        .trim()
+        .replace(/^v/, '')
+        .split('+')[0] ?? '';
+    const dash = noBuild.indexOf('-');
+    const coreStr = dash === -1 ? noBuild : noBuild.slice(0, dash);
+    const preStr = dash === -1 ? '' : noBuild.slice(dash + 1);
+    return {
+        core: coreStr.split('.').map((n) => {
+            const p = parseInt(n, 10);
+            return Number.isFinite(p) ? p : 0;
+        }),
+        pre: preStr ? preStr.split('.') : [],
+    };
+}
+// -1 / 0 / 1 for a<b / a==b / a>b, by semver precedence: numeric core compare (so 0.0.9 < 0.0.10,
+// which a string compare gets backwards), then a release outranks any prerelease of the same core
+// (1.0.0 > 1.0.0-rc.1), then identifier by identifier.
 export function cmpSemver(a, b) {
-    const pa = a.split('.').map((n) => parseInt(n, 10) || 0);
-    const pb = b.split('.').map((n) => parseInt(n, 10) || 0);
-    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
-        const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    const A = parseVersion(a);
+    const B = parseVersion(b);
+    for (let i = 0; i < Math.max(A.core.length, B.core.length); i++) {
+        const d = (A.core[i] ?? 0) - (B.core[i] ?? 0);
         if (d !== 0)
             return d < 0 ? -1 : 1;
     }
+    if (!A.pre.length && !B.pre.length)
+        return 0;
+    if (!A.pre.length)
+        return 1;
+    if (!B.pre.length)
+        return -1;
+    for (let i = 0; i < Math.max(A.pre.length, B.pre.length); i++) {
+        const x = A.pre[i];
+        const y = B.pre[i];
+        if (x === undefined)
+            return -1; // a shorter prerelease series ranks lower
+        if (y === undefined)
+            return 1;
+        const nx = /^\d+$/.test(x);
+        const ny = /^\d+$/.test(y);
+        if (nx && ny) {
+            const d = parseInt(x, 10) - parseInt(y, 10);
+            if (d !== 0)
+                return d < 0 ? -1 : 1;
+            continue;
+        }
+        if (nx !== ny)
+            return nx ? -1 : 1; // numeric identifiers rank lower than alphanumeric
+        if (x !== y)
+            return x < y ? -1 : 1;
+    }
     return 0;
 }
+// Pick `latest` — and only `latest` — out of npm's dist-tag document. `next` (a prerelease
+// channel: 0.0.23-rc.1 today) must never win, and a `latest` that is itself a prerelease or
+// malformed is refused rather than guessed at.
+export function pickLatestDistTag(tags) {
+    const v = tags?.latest;
+    if (!isStableVersion(v))
+        return null;
+    return v.trim().replace(/^v/, '');
+}
+async function getJson(url, fetchImpl, timeoutMs) {
+    try {
+        const ctl = new AbortController();
+        const t = setTimeout(() => ctl.abort(), timeoutMs);
+        try {
+            // no-cache: an intermediary serving a stale dist-tag would re-create the very bug this
+            // resolver exists to kill.
+            const res = await fetchImpl(url, {
+                signal: ctl.signal,
+                headers: { accept: 'application/json', 'cache-control': 'no-cache' },
+            });
+            if (!res.ok)
+                return null;
+            return (await res.json());
+        }
+        finally {
+            clearTimeout(t);
+        }
+    }
+    catch {
+        return null;
+    }
+}
+// THE resolver: the live latest published version, or null when the registry can't be reached.
+// Never consults the cache — callers decide whether a cached answer may stand in for this.
+export async function resolveLatest(fetchImpl = fetch, timeoutMs = FETCH_TIMEOUT_MS) {
+    const tags = await getJson(REGISTRY_DIST_TAGS, fetchImpl, timeoutMs);
+    const fromTags = pickLatestDistTag(tags);
+    if (fromTags)
+        return fromTags;
+    const manifest = await getJson(REGISTRY_LATEST, fetchImpl, timeoutMs);
+    const v = manifest?.version;
+    return isStableVersion(v) ? v.trim().replace(/^v/, '') : null;
+}
 export function readCache() {
     try {
         return JSON.parse(readFileSync(cachePath(), 'utf8'));
@@ -47,9 +164,25 @@ export function writeCache(c) {
     mkdirSync(dirname(cachePath()), { recursive: true });
     writeFileSync(cachePath(), JSON.stringify(c));
 }
+// May this cached answer stand in for a live registry call? An entry that is old, malformed, or
+// provably behind the build we are running must not suppress the check — that is exactly how a
+// wrong `latest` pins an install to an old version indefinitely. Note the deliberate `>= 0`:
+// `latest === current` is the ordinary up-to-date state and stays cacheable for the TTL, while a
+// `latest` BELOW the running build (an out-of-band upgrade happened) is refused outright.
+export function cacheIsFresh(cache, current, now = Date.now()) {
+    if (!cache || !isStableVersion(cache.latest))
+        return false;
+    if (!Number.isFinite(cache.checkedAt))
+        return false;
+    if (now < cache.checkedAt)
+        return false; // clock went backwards — don't trust the stamp
+    if (now - cache.checkedAt > CHECK_TTL_MS)
+        return false;
+    return cmpSemver(cache.latest, current) >= 0;
+}
 // Pure decision for what start-up should do given the cache. Exported for tests.
 export function decideAction(cache, current, autoUpdate, channel, now = Date.now()) {
-    if (!cache || cmpSemver(cache.latest, current) <= 0)
+    if (!cache || !isStableVersion(cache.latest) || cmpSemver(cache.latest, current) <= 0)
         return 'none';
     if (!autoUpdate || channel === 'source')
         return 'nudge';
@@ -57,46 +190,145 @@ export function decideAction(cache, current, autoUpdate, channel, now = Date.now
         return 'nudge';
     return 'auto';
 }
+// Is auto-update on? (env kill-switch wins, then the persisted preference, default on.)
+export function autoEnabled(home = homedir()) {
+    if (process.env.INSTA_NO_AUTOUPDATE)
+        return false;
+    try {
+        // config read is async elsewhere; a tiny sync read keeps start-up non-blocking
+        const raw = JSON.parse(readFileSync(join(home, '.insta', 'config.json'), 'utf8'));
+        return raw.autoUpdate !== false;
+    }
+    catch {
+        return true; // no config yet
+    }
+}
+const spawnRun = ({ cmd, args, env }) => new Promise((resolve, reject) => {
+    const resolved = resolveRunSpec({ cmd, args, env });
+    const p = spawn(resolved.cmd, resolved.args, { stdio: 'inherit', env });
+    p.on('error', reject);
+    p.on('close', (code) => (code === 0 ? resolve() : reject(new Error(`upgrade failed (exit ${code})`))));
+});
+const observeInstalled = (channel, installDir) => new Promise((resolve) => {
+    const cmd = channel === 'binary' ? join(installDir, 'insta') : 'insta';
+    let out = '';
+    try {
+        // INSTA_NO_AUTOUPDATE: the child must not kick off yet another upgrade while we are reading it.
+        const env = { ...process.env, INSTA_NO_AUTOUPDATE: '1' };
+        const resolved = resolveRunSpec({ cmd, args: ['--version'], env });
+        const p = spawn(resolved.cmd, resolved.args, { stdio: ['ignore', 'pipe', 'ignore'], env });
+        p.stdout.on('data', (d) => (out += String(d)));
+        p.on('error', () => resolve(null));
+        p.on('close', () => {
+            const last = out.trim().split('\n').pop()?.trim().replace(/^v/, '');
+            resolve(isStableVersion(last) ? last : null);
+        });
+    }
+    catch {
+        resolve(null);
+    }
+});
 // `insta upgrade` — synchronous, visible self-update on the detected channel.
-export async function upgrade() {
-    const channel = detectChannel();
+//
+// ALWAYS resolves the target live: an explicitly requested upgrade must never be answered out of
+// ~/.insta/update-check.json, or the documented remedy for a stale cache would itself be stale.
+//
+// NEVER REPORTS A VERSION IT DID NOT OBSERVE. After any install path it reads the installed
+// binary's actual `--version` and prints the transition from THAT. In the drift case (npm's tag
+// ahead of GitHub Releases) the pinned install 404s and the unpinned retry legitimately exits 0
+// having installed nothing — the honest line is "still 0.0.45", not "upgraded → 0.0.47". The
+// cache is rewritten from the observed version too: it then says the newest version THIS channel
+// can actually install, and the start-up nudge stops advertising a build the user cannot get.
+export async function upgrade(current, deps = {}) {
+    const say = deps.report ?? info;
+    const channel = deps.channel ?? detectChannel();
     if (channel === 'source') {
-        info('running from a source checkout — `git pull` to update');
+        say('running from a source checkout — `git pull` to update');
+        return;
+    }
+    const latest = deps.latest !== undefined ? deps.latest : await resolveLatest(deps.fetchImpl ?? fetch);
+    const now = deps.now ?? Date.now();
+    if (latest) {
+        // Record what we just learned so the start-up nudge can't keep quoting a stale answer.
+        writeCache({ ...(readCache() ?? { checkedAt: 0, latest }), checkedAt: now, latest });
+        if (cmpSemver(latest, current) <= 0) {
+            say(`✓ insta ${current} is already the latest release — nothing to upgrade`);
+            return;
+        }
+    }
+    else {
+        say('could not reach the npm registry — installing the newest release available');
+    }
+    say(`upgrading insta ${current} → ${latest ?? 'latest'} via ${channel} …`);
+    const run = deps.run ?? spawnRun;
+    const installDir = deps.installDir ?? dirname(process.execPath);
+    if (channel === 'npm') {
+        await run({ cmd: 'npm', args: ['install', '-g', `insta@${latest ?? 'latest'}`], env: process.env });
+    }
+    else {
+        const shellEnv = { ...process.env, INSTA_INSTALL_DIR: installDir };
+        const sh = { cmd: 'sh', args: ['-c', `curl -fsSL ${INSTALL_SH} | sh`] };
+        if (!latest) {
+            await run({ ...sh, env: shellEnv });
+        }
+        else {
+            try {
+                // Pin the binary install to the EXACT version npm's `latest` dist-tag names, so the two
+                // channels cannot land on different builds.
+                await run({ ...sh, env: { ...shellEnv, INSTA_VERSION: `v${latest}` } });
+            }
+            catch (e) {
+                // Release assets can lag the npm tag. Retry unpinned so the user at least gets the newest
+                // binary that IS published — and let the observation below say what that turned out to be.
+                say(`pinned install of v${latest} failed (${e.message}) — retrying with the newest published release`);
+                await run({ ...sh, env: shellEnv });
+            }
+        }
+    }
+    // Report only what is actually on disk now. The installer prints its own generic onboarding
+    // banner and can exit 0 without changing anything, so its exit code proves nothing.
+    const observed = await (deps.observe ?? observeInstalled)(channel, installDir);
+    if (!observed) {
+        say(`insta install finished, but the installed version could not be read — run \`insta --version\` to confirm`);
         return;
     }
-    info(`upgrading insta via ${channel} …`);
-    let cmd;
-    let args;
-    let env = process.env;
+    writeCache({ ...(readCache() ?? { checkedAt: 0, latest: observed }), checkedAt: now, latest: observed });
+    if (cmpSemver(observed, current) > 0) {
+        say(`✓ insta upgraded ${current} → ${observed}`);
+        return;
+    }
+    const target = latest ?? 'the newest release';
     if (channel === 'binary') {
-        cmd = 'sh';
-        args = ['-c', `curl -fsSL ${INSTALL_SH} | sh`];
-        env = { ...process.env, INSTA_INSTALL_DIR: dirname(process.execPath) };
+        say(`insta is still ${observed} — the newest release (${target}) is published on npm but its binary assets are not on GitHub Releases yet; ` +
+            `try again later or install via npm (npm i -g insta@latest)`);
     }
     else {
-        cmd = 'npm';
-        args = ['install', '-g', 'insta@latest'];
+        say(`insta is still ${observed} — npm reports ${target} as latest but the install did not change the version; try again later`);
     }
-    await new Promise((resolve, reject) => {
-        const p = spawn(cmd, args, { stdio: 'inherit', env });
-        p.on('error', reject);
-        p.on('close', (code) => (code === 0 ? resolve() : reject(new Error(`upgrade failed (exit ${code})`))));
-    });
 }
-// Hidden `insta __update-check` — runs detached in the background: fetch latest, refresh cache.
-export async function backgroundCheck() {
+// Hidden `insta __update-check` — runs detached in the background: resolve latest, refresh the
+// cache, and ACT on what it just learned. Acting here (rather than only priming the cache for
+// some later invocation) is what stops a release that lands just after a check from stranding the
+// install for a whole TTL plus one more run.
+export async function backgroundCheck(current, deps = {}) {
+    const latest = await resolveLatest(deps.fetchImpl ?? fetch);
+    if (!latest)
+        return 'none'; // offline / registry down — try again next TTL
+    const now = deps.now ?? Date.now();
+    const cache = { ...(readCache() ?? { checkedAt: 0, latest }), checkedAt: now, latest };
+    writeCache(cache);
+    const channel = deps.channel ?? detectChannel();
+    const action = decideAction(cache, current, deps.auto ?? autoEnabled(), channel, now);
+    if (action !== 'auto')
+        return action;
+    writeCache({ ...cache, lastAutoAt: now });
     try {
-        const ctl = new AbortController();
-        const t = setTimeout(() => ctl.abort(), 5000);
-        const res = await fetch(REGISTRY_LATEST, { signal: ctl.signal });
-        clearTimeout(t);
-        if (!res.ok)
-            return;
-        const { version } = (await res.json());
-        if (version)
-            writeCache({ ...(readCache() ?? { checkedAt: 0, latest: '0.0.0' }), checkedAt: Date.now(), latest: version });
+        await (deps.runUpgrade ?? ((c, l) => upgrade(c, { latest: l, channel })))(current, latest);
+    }
+    catch {
+        /* best-effort; the hourly throttle retries */
     }
-    catch { /* offline / registry down — try again next TTL */ }
+    return 'auto';
 }
 // `insta autoupdate [on|off]` — toggle / show the auto-update preference (default: on).
 export async function autoupdate(mode) {
@@ -117,23 +349,17 @@ export function maybeUpdate(current, argv) {
         return;
     const channel = detectChannel();
     const cache = readCache();
-    // keep the cache fresh (detached; survives this process exiting)
-    if (!cache || Date.now() - cache.checkedAt > CHECK_TTL_MS) {
+    const now = Date.now();
+    // Re-resolve unless the cached answer is genuinely usable (fresh, well-formed, not behind us).
+    // The child refreshes the cache AND performs the upgrade if one is due.
+    if (!cacheIsFresh(cache, current, now))
         respawnDetached(['__update-check']);
-    }
-    let auto = !process.env.INSTA_NO_AUTOUPDATE;
-    try { // config read is async elsewhere; a tiny sync read keeps start-up non-blocking
-        const raw = JSON.parse(readFileSync(join(homedir(), '.insta', 'config.json'), 'utf8'));
-        if (raw.autoUpdate === false)
-            auto = false;
-    }
-    catch { /* no config yet */ }
-    const action = decideAction(cache, current, auto, channel);
+    const action = decideAction(cache, current, autoEnabled(), channel, now);
     if (action === 'nudge') {
         console.error(`↑ insta ${cache.latest} is available (you have ${current}) — run \`insta upgrade\``);
     }
     else if (action === 'auto') {
-        writeCache({ ...cache, lastAutoAt: Date.now() });
+        writeCache({ ...cache, lastAutoAt: now });
         respawnDetached(['upgrade']);
         console.error(`↑ auto-updating insta ${current} → ${cache.latest} in the background (\`insta autoupdate off\` to disable)`);
     }
@@ -146,6 +372,8 @@ function respawnDetached(args) {
         const p = spawn(process.execPath, argv, { detached: true, stdio: 'ignore' });
         p.unref();
     }
-    catch { /* best-effort */ }
+    catch {
+        /* best-effort */
+    }
 }
 //# sourceMappingURL=upgrade.js.map

package/dist/index.js

@@ -2,7 +2,7 @@
 import { readFileSync } from 'node:fs';
 import { Command } from 'commander';
 import { ApiError } from './api.js';
-import { die } from './util.js';
+import { CliExit, fail } from './util.js';
 import * as auth from './commands/auth.js';
 import * as envCmd_ from './commands/env.js';
 import { ENV_NAMES } from './env.js';
@@ -20,6 +20,7 @@ import { deploy } from './commands/deploy.js';
 import { build } from './commands/build.js';
 import * as computeCmd from './commands/compute.js';
 import * as dbCmd from './commands/db.js';
+import * as dbQueryCmd from './commands/db-query.js';
 import * as storageCmd from './commands/storage.js';
 import { manifest } from './commands/manifest.js';
 import * as template from './commands/template.js';
@@ -30,9 +31,11 @@ import { billing, billingUpgrade, billingPortal } from './commands/billing.js';
 import * as selfUpdate from './commands/upgrade.js';
 import * as feedbackCmd from './commands/feedback.js';
 function onError(e) {
+    if (e instanceof CliExit)
+        return;
     if (e instanceof ApiError)
-        die(`${e.message} (HTTP ${e.status})`);
-    die(e instanceof Error ? e.message : String(e));
+        return fail(`${e.message} (HTTP ${e.status})`);
+    fail(e instanceof Error ? e.message : String(e));
 }
 // Wrap an async action so rejections surface as clean CLI errors.
 const guard = (fn) => (...a) => fn(...a).then(() => undefined).catch(onError);
@@ -59,11 +62,11 @@ function resolveVersion() {
 }
 program.name('insta').description('InstaCloud CLI — manage projects, branches, secrets, deploys').version(resolveVersion());
 // ---- auth ----
-program.command('login').description('Log in with email + password, --oauth <github|google> (browser), --device (headless), or --api-key <insta_…> (headless, durable token)')
-    .option('--email <email>', 'account email')
-    .option('--password <password>', 'account password (else $INSTA_PASSWORD or prompt)')
+program.command('login').description('Log in — bare: sign in from your browser (any account type); or --email <email> + password, --oauth <github|google>, --device (headless), --api-key <insta_…> (headless, durable token)')
+    .option('--email <email>', 'account email (email + password login)')
+    .option('--password <password>', 'account password (else $INSTA_PASSWORD or prompt; needs --email)')
     .option('--oauth <provider>', 'browser OAuth login: github | google')
-    .option('--device', 'device-code login: approve from a browser on any other machine (VMs, SSH, CI)')
+    .option('--device', 'device-code login: like bare login but never opens a browser here — approve from any other machine (VMs, SSH, CI)')
     .option('--api-key <key>', 'non-interactive login with a durable insta_ API token (headless agents / CI)')
     .option('--api-url <url>', 'control-plane API base URL')
     .option('--env <name>', `deployment environment: ${ENV_NAMES.join(' | ')}`)
@@ -180,7 +183,7 @@ sec.command('sources').description('List service credential sources available fo
 sec.command('tree').description('Show secrets as project → branch → service → secrets').option('--json')
     .action(guard((o) => secretsCmd.secretsTree(o)));
 // ---- build (pre-push verification — local, offline, deploys nothing) ----
-program.command('build [dir]').description('Verify a source directory would build before deploying: detection plan + the Dockerfile that would be used (yours, or nixpacks-generated) + static checks. Local and offline — no login needed, nothing pushed. Exit 1 when the verdict is failed')
+program.command('build [dir]').description('Verify a source directory would build before deploying: detection plan + the Dockerfile (yours, or the one nixpacks would generate for the GitHub lane — `insta deploy <dir>` needs your own) + static checks. Local and offline — no login needed, nothing pushed. Exit 1 when the verdict is failed')
     .option('--explain', 'include the Dockerfile content in the output')
     .option('--port <p>', 'port the app listens on (else the Dockerfile EXPOSE)')
     .option('--json')
@@ -194,9 +197,9 @@ program.command('deploy [dir]').description('Deploy a source directory (built re
 // `insta compute exec` needs the command verbatim after a literal `--`; split it out of argv here,
 // before commander parses anything (see splitExecArgs's own comment for why `service` being
 // optional makes commander unable to hold that boundary itself).
-const { argv: computeArgv, command: execCommand } = computeCmd.splitExecArgs(process.argv);
+const { argv: computeArgv, command: execCommand, windowsFallback: execWindowsFallback, } = computeCmd.splitExecArgs(process.argv);
 // ---- compute (lifecycle control + custom domains) ----
-const compute = program.command('compute').description('Control compute lifecycle (start/stop/suspend/status) + custom domains');
+const compute = program.command('compute').description('Control compute lifecycle (start/stop/suspend/restart/status) + custom domains');
 compute.command('set-domain <host>').description('Attach a custom domain to a branch compute service (gated: deploy)')
     .option('--branch <b>').option('--group <g>').option('--json').action(guard((host, o) => computeCmd.setDomain(host, o)));
 compute.command('check-domain <host>').description("Show a custom domain's cert status + required DNS records")
@@ -209,6 +212,8 @@ compute.command('stop [service]').description('Take a compute service offline; t
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStop(service, o)));
 compute.command('suspend [service]').description('Suspend a compute service (RAM snapshot); stays down until `start`')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeSuspend(service, o)));
+compute.command('restart [service]').description("Restart a compute service by re-running the image it already runs against a freshly resolved env bundle — this is how a changed secret or binding reaches a running machine (env is baked into the machine at deploy time), and how a machine that is up but wedged gets cycled (`start` no-ops on one that is already started). No new image, no new spec. The service must be running: a stopped or suspended one comes back with `insta compute start`. All plans; gated: deploy — it lands configuration the same way a deploy does, so a policy denying deploys denies this too (`start`/`stop` stay ungated, and cycle a wedged machine without one). A service whose app fails to answer on its port coming back up reports that failure, and the machines are rolled back, best-effort, to the config they were serving")
+    .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeRestart(service, o)));
 compute.command('status [service]').description("Show a compute service's desired vs. live state")
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStatus(service, o)));
 compute.command('limits [service]').description("Show or set a compute service's resource ceiling (paid plans). --memory is the dial; cpu derives from it unless --cpu is given. Billing is actual usage — the ceiling caps what the app may burn, it is not a price")
@@ -216,15 +221,18 @@ compute.command('limits [service]').description("Show or set a compute service's
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeLimits(service, o)));
 compute.command('always-on <mode> [service]').description('Set a compute service always-on (mode: on|off). on = machines never scale to zero; off = default scale-to-zero. All plans; billing is actual usage either way')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((mode, service, o) => computeCmd.computeAlwaysOn(mode, service, o)));
-compute.command('exec [service]').description("Run a one-shot command inside a compute service's machine (`insta compute exec [service] -- <command> [args…]`) — no interactive shell/PTY: `command` is argv, no shell is invoked (use [\"sh\", \"-c\", \"...\"] for shell features). Wakes the machine first if it's scaled to zero — expect a few seconds of latency, billed as uptime, not an error. Exits with the remote command's own exit code (agents rely on this)")
-    .option('--branch <b>').option('--timeout <sec>', 'command timeout in seconds, 1-180 (platform default: 30)').option('--json')
-    .action(guard((service, o) => computeCmd.computeExec(service, execCommand, o)));
+const execCmd = compute.command('exec [service]').description("Run a one-shot command inside a compute service's machine (`insta compute exec [service] -- <command> [args…]`) — no interactive shell/PTY: `command` is argv, no shell is invoked (use [\"sh\", \"-c\", \"...\"] for shell features). Wakes the machine first if it's scaled to zero — expect a few seconds of latency, billed as uptime, not an error. Exits with the remote command's own exit code (agents rely on this)")
+    .action(guard((service, o) => computeCmd.computeExec(service, execCommand, o, { windowsFallback: execWindowsFallback })));
+// Declared from the same list splitExecArgs uses to find where the CLI's own arguments stop, so a
+// new option cannot reach the CLI surface while the split still reads it as part of the command.
+for (const [flags, description] of computeCmd.EXEC_OPTIONS)
+    execCmd.option(flags, description);
 compute.command('volume [service]').description("Show, attach, grow, or delete a compute service's persistent /data volume. No flag: print size, mount path, and the plan cap (any plan). --size on a volumeless service ATTACHES one (any plan at the default 1Gi; larger is paid and plan-capped; the disk mounts at /data on the next deploy); on a volume-bearing one it grows (paid plans; grow-only — a provisioned disk cannot shrink). --delete DESTROYS the disk and ALL its data immediately (no detach, no undo; billing stops now, and suspend fast-wake + scale-out return). Billing is actual data stored — the size is a cap, not a price")
     .option('--size <gi>', 'new size in whole Gi, e.g. 10 (must be ≥ the current size)')
     .option('--delete', 'destroy the volume and ALL its data (irreversible; download anything you need first)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeVolume(service, o)));
-// ---- db (postgres service controls) ----
-const db = program.command('db').description('Postgres service controls (url / connect / limits / volume / always-on / scale-to-zero)');
+// ---- db (postgres service controls + managed-DB query) ----
+const db = program.command('db').description('Postgres service controls (url / connect / limits / volume / always-on / scale-to-zero) + managed-DB query (mysql/redis/mongodb)');
 db.command('url').description('Print the postgres connection string (DSN) — bare on stdout for piping, e.g. `psql "$(insta db url)"` (gated: secrets.read). Provider credentials are not in `insta secrets` — this is the command that yields the DSN')
     .option('--json').option('--branch <branch>', 'branch (default: current)').option('--group <g>', 'postgres service name (default: the sole/default one)')
     .action(guard((o) => dbCmd.dbUrl(o)));
@@ -245,6 +253,11 @@ db.command('volume').description("Show or grow a postgres service's provisioned
     .option('--size <gi>', 'new size in whole Gi, e.g. 10 (must be ≥ the current size)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').option('--group <g>', 'postgres service name (default: the sole/default one)')
     .action(guard((o) => dbCmd.dbVolume(o)));
+db.command('query <service> [args...]').description('Run a query/command against a managed database (mysql/redis/mongodb) via the console exec API. mysql/mongodb take one quoted statement; redis takes a pre-tokenized argv (e.g. `GET mykey`). Not for postgres — use `insta db url|connect` / the SQL editor')
+    .option('--database <db>', 'mongodb only — the database to run against (default admin)')
+    .option('--branch <branch>', 'branch (default: current)')
+    .option('--json')
+    .action(guard((service, args, o) => dbQueryCmd.dbQuery(service, args, o)));
 // ---- storage (bucket objects) ----
 const storage = program.command('storage').description("Browse, download, and delete a storage service's bucket objects");
 storage.command('list').description("List the bucket's objects. S3 filters by prefix only — there is no substring search")
@@ -295,7 +308,7 @@ program.command('usage').description('Usage for the current billing cycle by bil
 const bill = program.command('billing').description('Current billing cycle overview (tier / used / included / overage / credits / forecast + per-dimension & per-project breakdown)')
     .option('--org <id>', 'target org (default: linked project\'s org)').option('--json')
     .action(guard((o) => billing(o)));
-bill.command('upgrade <tier>').description('Subscribe the org to a paid tier (pro|enterprise) via Stripe Checkout')
+bill.command('upgrade <tier>').description('Subscribe the org to a paid tier (pro|team) via Stripe Checkout')
     .option('--org <id>').option('--no-open', 'print the URL instead of opening a browser').option('--json')
     .action(guard((tier, o) => billingUpgrade(tier, o)));
 bill.command('portal').description('Open the Stripe Customer Portal (change plan / card / cancel)')
@@ -337,10 +350,10 @@ program.command('feedback')
     .action(guard((o) => feedbackCmd.feedback(o)));
 // ---- self-update ----
 program.command('upgrade').description('Update the insta CLI to the latest release (binary or npm install)')
-    .action(guard(() => selfUpdate.upgrade()));
+    .action(guard(() => selfUpdate.upgrade(resolveVersion())));
 program.command('autoupdate [mode]').description('Show or set auto-update: on | off (default: on while pre-1.0)')
     .action(guard((mode) => selfUpdate.autoupdate(mode)));
-program.command('__update-check', { hidden: true }).action(guard(() => selfUpdate.backgroundCheck()));
+program.command('__update-check', { hidden: true }).action(guard(() => selfUpdate.backgroundCheck(resolveVersion())));
 selfUpdate.maybeUpdate(resolveVersion(), process.argv);
 program.parseAsync(computeArgv);
 //# sourceMappingURL=index.js.map

package/dist/spawn.js

@@ -0,0 +1,77 @@
+import { existsSync, statSync } from 'node:fs';
+import { dirname, join, win32 } from 'node:path';
+export const isRunnableFile = (path, win) => {
+    try {
+        const stat = statSync(path);
+        if (!stat.isFile())
+            return false;
+        return win || (stat.mode & 0o111) !== 0;
+    }
+    catch {
+        return false;
+    }
+};
+/** Read an environment variable the way Windows itself does: case-insensitively.
+ *  `process.env` is already case-insensitive on win32, but a COPY of it (`{ ...process.env }`,
+ *  which every caller that adds a variable makes) is an ordinary object that keeps whatever
+ *  casing Windows used — and Windows overwhelmingly spells it `Path`, not `PATH`. Reading
+ *  `env.PATH` off such a copy yields undefined, nothing resolves, and the caller falls back to
+ *  spawning the bare `.cmd` shim this module exists to avoid. */
+export function envVar(env, name, win) {
+    const direct = env[name];
+    if (direct !== undefined || !win)
+        return direct;
+    const wanted = name.toLowerCase();
+    for (const [key, value] of Object.entries(env))
+        if (key.toLowerCase() === wanted)
+            return value;
+    return undefined;
+}
+/** Resolve a bare command name to its absolute PATH location (PATHEXT-aware on Windows).
+ *  cmd.exe searches the CURRENT DIRECTORY before PATH for bare names, so callers must pass
+ *  the absolute shim path to the cmd.exe wrapper below. */
+export function whichOnPath(bin, env = process.env, platform = process.platform) {
+    const win = platform === 'win32';
+    const exts = win ? [...(envVar(env, 'PATHEXT', win) ?? '.COM;.EXE;.BAT;.CMD').split(';'), ''] : [''];
+    for (const dir of (envVar(env, 'PATH', win) ?? '').split(win ? ';' : ':')) {
+        if (!dir)
+            continue;
+        for (const ext of exts) {
+            const path = join(dir, bin + ext);
+            if (isRunnableFile(path, win))
+                return path;
+        }
+    }
+    return null;
+}
+// On Windows `npm`/`npx` and most npm-installed CLIs are .cmd shims, which spawn() without a
+// shell refuses. Prefer re-entering npm/npx through node; otherwise resolve a safe absolute shim
+// path and invoke it through cmd.exe. Kept shared so every child-process call uses the same rules.
+export function resolveSpawnable(cmd, args, npmExecpath = process.env.npm_execpath, execPath = process.execPath, platform = process.platform, env = process.env, systemRoot = process.env.SYSTEMROOT ?? process.env.windir ?? 'C:\\Windows') {
+    const execIsNode = /(^|[\\/])node(\.exe)?$/i.test(execPath);
+    if ((cmd === 'npm' || cmd === 'npx') && execIsNode) {
+        if (npmExecpath && /(^|[\\/])np[mx](-cli)?\.[cm]?js$/.test(npmExecpath)) {
+            const cli = npmExecpath.replace(/np[mx](-cli)?(\.[cm]?js)$/, `${cmd}$1$2`);
+            if (existsSync(cli))
+                return { cmd: execPath, args: [cli, ...args] };
+        }
+        const nodeDir = dirname(execPath);
+        const besideNode = platform === 'win32'
+            ? join(nodeDir, 'node_modules', 'npm', 'bin', `${cmd}-cli.js`)
+            : join(nodeDir, '..', 'lib', 'node_modules', 'npm', 'bin', `${cmd}-cli.js`);
+        if (existsSync(besideNode))
+            return { cmd: execPath, args: [besideNode, ...args] };
+    }
+    const bareShim = !/[\\/]/.test(cmd) && !/\.exe$/i.test(cmd);
+    if (platform === 'win32' && bareShim && !args.some((arg) => /[&|<>^%"]/.test(arg))) {
+        const absolute = whichOnPath(cmd, env, platform);
+        // The resolved path itself also becomes cmd.exe input. If a PATH directory contains a shell
+        // metacharacter, fail via the caller's normal bare-spawn fallback rather than interpret it.
+        // Pin cmd.exe to System32 too: CreateProcess-style lookup checks cwd before PATH.
+        if (absolute && !/[&|<>^%"]/.test(absolute)) {
+            return { cmd: win32.join(systemRoot, 'System32', 'cmd.exe'), args: ['/d', '/s', '/c', absolute, ...args] };
+        }
+    }
+    return { cmd, args };
+}
+//# sourceMappingURL=spawn.js.map