insta 0.0.49 → 0.0.52

package/README.md

@@ -61,7 +61,7 @@ off with `insta autoupdate off`.
 ## Quickstart
 
 ```bash
-insta login --oauth github
+insta login
 insta project create my-app
 insta services add postgres db
 insta services add compute api
@@ -79,13 +79,19 @@ service; it needs a `Dockerfile`, but no local Docker.
 ## Authentication
 
 ```bash
+insta login                                  # sign in from the browser (any account type)
 insta login --email you@example.com          # password from $INSTA_PASSWORD or a prompt
 insta login --oauth github                   # or google, through the browser
-insta login --env staging --oauth github     # log in to a specific deployment
+insta login --env staging                    # log in to a specific deployment
 ```
 
 Tokens are stored in `~/.insta/config.json` and refresh automatically.
 
+Bare `insta login` opens the console's device-approval page in your browser: sign in there
+with whatever your account uses (email, GitHub, Google), check the code matches, and approve.
+On a machine that can't open a browser, `--device` prints the same link to open from any
+other device.
+
 `--oauth` starts a loopback listener on `127.0.0.1`, opens the browser at the control
 plane's `/auth/cli/authorize`, and receives the token back on that listener once the
 provider has authorized you. Nothing is pasted by hand.
@@ -189,7 +195,7 @@ build never reaches a production installer.
 
 | Command | What it covers |
 |---|---|
-| `insta login` · `logout` · `status` | Email/password or `--oauth github\|google`; `status` shows the environment, login and linked project/branch |
+| `insta login` · `logout` · `status` | Browser sign-in (default), `--email` + password, or `--oauth github\|google`; `status` shows the environment, login and linked project/branch |
 | `insta env` | `show` · `use <prod\|staging>` |
 | `insta setup` | `agent` — install the CLI (if missing), the skill, and MCP for every coding agent; targets prod, `--env staging` for staging |
 | `insta mcp` | `install` — register the remote MCP server only |

package/dist/api.js

@@ -130,7 +130,7 @@ export async function requireProject() {
     }
     catch (e) {
         if (e instanceof ApiError && e.status === 401) {
-            die('not logged in — run `insta login --oauth github` (cloud) or point INSTA_API_URL at your insta-oss daemon');
+            die('not logged in — run `insta login` (cloud) or point INSTA_API_URL at your insta-oss daemon');
         }
         die(e instanceof Error ? e.message : String(e));
     }

package/dist/commands/auth.js

@@ -16,7 +16,8 @@ function targetApiUrl(opts) {
         die(`unknown --env "${opts.env}" — expected one of: ${ENV_NAMES.join(', ')}`);
     return ENVS[want].api;
 }
-export async function login(opts) {
+// `device` is injectable so the dispatch itself is testable (repo pattern: DI fakes, no mocks).
+export async function login(opts, device = loginDevice) {
     // Login modes are exclusive — pick one. Check presence (not truthiness) so an explicit
     // empty --api-key= is rejected by validation rather than silently falling through.
     if (opts.apiKey !== undefined) {
@@ -25,15 +26,24 @@ export async function login(opts) {
         return loginApiKey(opts.apiKey, opts);
     }
     if (opts.device)
-        return loginDevice(opts);
+        return device(opts);
     if (opts.oauth)
         return loginOauth(opts.oauth, opts);
+    // An explicitly empty --email is a mistake, not a request for the bare browser flow.
+    if (opts.email === '')
+        die('--email must not be empty');
+    if (!opts.email) {
+        // Bare `insta login` = sign in from the browser. The device grant is the one flow that covers
+        // every account type (email, GitHub, Google): the console approval page owns the signin
+        // round-trip, so the CLI just opens it here instead of only printing the link.
+        if (opts.password !== undefined || process.env.INSTA_PASSWORD !== undefined)
+            die('a password (--password / $INSTA_PASSWORD) is only used with --email <email>');
+        return device(opts, openUrl);
+    }
     const api = await ApiClient.load();
     const target = targetApiUrl(opts);
     if (target)
         api.setApiUrl(target);
-    if (!opts.email)
-        die('--email is required (or use --oauth <github|google>; on a headless machine, --device)');
     const password = opts.password ?? process.env.INSTA_PASSWORD ?? (await promptPassword());
     const res = await api.request('POST', '/auth/login', { email: opts.email, password }, { auth: false });
     api.setSession(res, res.user);
@@ -56,16 +66,17 @@ export async function loginOauth(provider, opts) {
     await api.persist();
     info(`logged in as ${me.user.email ?? me.user.id} @ ${api.apiUrl}`);
 }
-// RFC 8628 device authorization — login from a machine with no usable browser (VM, SSH box, CI
-// container). The loopback --oauth flow can never work there: its callback targets 127.0.0.1 on
-// THIS machine. Here the roles invert — we mint a code, print a link the human opens on ANY
-// device, and poll the platform until they approve in the console.
-export async function loginDevice(opts) {
+// RFC 8628 device authorization — the default login (bare `insta login` passes `open` to also
+// launch the browser here), and as --device the flow for a machine with no usable browser (VM,
+// SSH box, CI container), where the loopback --oauth flow can never work: its callback targets
+// 127.0.0.1 on THIS machine. We mint a code, hand the human a link to the console approval page
+// (which owns the signin round-trip), and poll the platform until they approve.
+export async function loginDevice(opts, open) {
     const api = await ApiClient.load();
     const target = targetApiUrl(opts);
     if (target)
         api.setApiUrl(target);
-    const token = await deviceGrant((path, body) => api.request('POST', path, body, { auth: false }));
+    const token = await deviceGrant((path, body) => api.request('POST', path, body, { auth: false }), sleepSeconds, open);
     api.setSession({ accessToken: token, refreshToken: token });
     const me = await api.request('GET', '/me');
     api.setSession({ accessToken: token, refreshToken: token }, me.user);
@@ -106,7 +117,9 @@ const sleepSeconds = (s) => new Promise((r) => setTimeout(r, s * 1000));
 // Drives the device grant against the platform's Better Auth mount (/api/auth/device*) and
 // returns the approved session token. Injectable poster + wait keep this testable without a
 // network or real timers. Poll errors arrive as ApiError with the OAuth error code as message.
-export async function deviceGrant(post, wait = sleepSeconds) {
+// `open` (the default browser-login path) launches the verification link locally on top of
+// printing it; without it (--device) the link is print-only, for a browser on another machine.
+export async function deviceGrant(post, wait = sleepSeconds, open) {
     const start = (await post('/api/auth/device/code', { client_id: 'insta-cli' }));
     // A missing/garbage expires_in must fail loudly here — carried into the deadline arithmetic it
     // becomes NaN, every `Date.now() < deadline` is false, and login dies as a bogus instant expiry.
@@ -117,8 +130,18 @@ export async function deviceGrant(post, wait = sleepSeconds) {
         throw new Error('malformed device authorization response (missing expires_in) — is the platform up to date?');
     }
     const lifetime = Math.min(expiresIn, 3600); // no device code sensibly outlives an hour
-    info('to log in, open this link in a browser on any device:');
-    info(`  ${start.verification_uri_complete ?? start.verification_uri}`);
+    const url = start.verification_uri_complete ?? start.verification_uri;
+    if (open) {
+        info('opening your browser to sign in…');
+        // Always print the link too: a launcher that fails to start reports it on spawn's ASYNC
+        // error event, so open's return value cannot see it (same reasoning as browserOauth).
+        info(`if nothing opens, use this link in a browser on any device:\n  ${url}`);
+        open(url);
+    }
+    else {
+        info('to log in, open this link in a browser on any device:');
+        info(`  ${url}`);
+    }
     info(`and check it shows this code: ${start.user_code}`);
     info(`waiting for approval… (expires in ${Math.round(lifetime / 60)}m, ctrl-c to abort)`);
     // Absent OR non-finite interval = the RFC 8628 §3.2 default 5s: NaN would fire the timer
@@ -158,7 +181,7 @@ export async function deviceGrant(post, wait = sleepSeconds) {
             throw new Error('malformed token response (missing access_token)');
         return grant.access_token;
     }
-    throw new Error('device login expired before it was approved — run `insta login --device` again');
+    throw new Error(`device login expired before it was approved — run \`insta login${open ? '' : ' --device'}\` again`);
 }
 // Start a loopback server, open the browser at the platform bridge, and await the token.
 function browserOauth(apiUrl, provider) {

package/dist/commands/billing.js

@@ -8,7 +8,10 @@ async function resolveOrgId(opts) {
     return (await requireProject()).orgId;
 }
 // Format the billing overview into printable lines (pure, so it's unit-testable).
-export function billingLines(s) {
+// `org` is the caller's --org, echoed into the portal hint: `billing` and `billing portal` resolve
+// the target independently, so a hint that drops the flag sends someone reading org A's overview to
+// org B's portal.
+export function billingLines(s, org) {
     const t = s.totals;
     const lines = [
         `tier:      ${s.tier}`,
@@ -23,7 +26,37 @@ export function billingLines(s) {
     if (s.subscriptionStatus)
         lines.push(`subscription: ${s.subscriptionStatus}`);
     if (s.billingStatus === 'suspended') {
-        lines.push('⚠  org suspended — billing limit reached; resumes next cycle (or `insta billing upgrade pro`)');
+        // Four causes, five messages, and every one is a dead end for the others. Tier first: only a
+        // free org can spend a prepaid wallet, and waiting for the next cycle genuinely fixes that one.
+        // (Tier, not subscriptionStatus, because rows written before non-payment suspended carry
+        // `unpaid` beside tier 'free' and survive with no migration.) Then the status splits the paid
+        // branch three ways: an invoice to settle, a subscription to replace, or — when it reads
+        // healthy — a suspension that outlived its cause, which is what a recovery whose compute failed
+        // to restart looks like, and where telling them to pay means re-settling a paid invoice. The
+        // replace case is the one that splits again, because enterprise has no self-serve checkout.
+        //
+        // EVERY command here carries the caller's --org. `billing` and the command being suggested
+        // resolve the target independently, so a hint that drops the flag acts on a different org than
+        // the one being read — and two of them take payment.
+        const flag = org ? ` --org ${org}` : '';
+        const lapsed = s.subscriptionStatus === 'past_due' || s.subscriptionStatus === 'unpaid';
+        const ended = s.subscriptionStatus === 'canceled' || s.subscriptionStatus === 'incomplete_expired';
+        lines.push(s.tier === 'free'
+            ? `⚠  org suspended — billing limit reached; resumes next cycle (or \`insta billing upgrade pro${flag}\`)`
+            : lapsed
+                ? `⚠  org suspended — subscription payment did not go through; settle it in \`insta billing portal${flag}\``
+                : ended
+                    ? s.tier === 'enterprise'
+                        // Per-deal, and `billing upgrade` cannot create one: naming a self-serve tier here
+                        // would move them off the plan they negotiated.
+                        ? '⚠  org suspended — the subscription ended; contact support to restore this plan'
+                        // Their OWN tier, not a hardcoded one: suggesting `upgrade pro` to a Team org
+                        // resubscribes it onto the wrong plan.
+                        : `⚠  org suspended — the subscription ended; resubscribe with \`insta billing upgrade ${s.tier}${flag}\``
+                    // Deliberately claims nothing about the subscription: `incomplete` reaches here too,
+                    // and that one is neither current nor failed. All this branch knows is that the
+                    // suspension has no billing cause it can name.
+                    : '⚠  org suspended — no failed payment on file; contact support');
     }
     if (s.byDimension?.length) {
         lines.push('by dimension:');
@@ -44,13 +77,17 @@ export async function billing(opts) {
     const s = await api.request('GET', `/orgs/${orgId}/billing/overview`);
     if (opts.json)
         return printJson(s);
-    for (const l of billingLines(s))
+    for (const l of billingLines(s, opts.org))
         info(l);
 }
 // insta billing upgrade <tier> — start a Stripe Checkout to subscribe the org to a paid tier.
 export async function billingUpgrade(tier, opts) {
-    if (tier !== 'pro' && tier !== 'enterprise')
-        die('tier must be pro|enterprise');
+    // pro|team, matching what POST /orgs/:orgId/billing/checkout actually accepts. This said
+    // pro|enterprise, which was wrong both ways: `team` is a real self-serve tier and was refused
+    // here, and `enterprise` is per-deal and 400s at the server. The suspension hint above now names
+    // the org's own tier, so a Team org was being sent to a command that rejected it.
+    if (tier !== 'pro' && tier !== 'team')
+        die('tier must be pro|team');
     const api = await ApiClient.load();
     const orgId = await resolveOrgId(opts);
     const { url } = await api.request('POST', `/orgs/${orgId}/billing/checkout`, { tier });

package/dist/commands/compute.js

@@ -338,6 +338,18 @@ export function renderRemoveDomain(body, json, row) {
     const region = body.region ?? row?.region;
     info(`removed custom domain ${body.hostname} from ${body.service ?? row?.name ?? body.flyApp}${region ? ` (${region})` : ''}`);
 }
+// The line a lifecycle verb prints. restart gets its own wording: `running` is a PRECONDITION of a
+// restart (the platform refuses it in any other desired state), so echoing desired_state back says
+// nothing — what the operator needs is which image came back up and whether it is live. Pure,
+// exported for tests.
+export function lifecycleLine(verb, fallbackName, body) {
+    const name = body.service?.name ?? fallbackName;
+    if (verb === 'restart') {
+        const image = body.service?.image ? ` on ${body.service.image}` : '';
+        return `restarted compute ${name}${image} — env re-resolved from the current secrets (live: ${body.state})`;
+    }
+    return `compute ${name}: ${verb} → desired=${body.service?.desired_state} (live: ${body.state})`;
+}
 async function lifecycle(verb, serviceName, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
@@ -349,11 +361,12 @@ async function lifecycle(verb, serviceName, opts) {
         return;
     if (opts.json)
         return printJson(res.body);
-    info(`compute ${res.body.service?.name ?? id}: ${verb} → desired=${res.body.service?.desired_state} (live: ${res.body.state})`);
+    info(lifecycleLine(verb, id, res.body));
 }
 export const computeStart = (service, opts) => lifecycle('start', service, opts);
 export const computeStop = (service, opts) => lifecycle('stop', service, opts);
 export const computeSuspend = (service, opts) => lifecycle('suspend', service, opts);
+export const computeRestart = (service, opts) => lifecycle('restart', service, opts);
 export async function computeStatus(serviceName, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();

package/dist/commands/db-query.js

@@ -0,0 +1,102 @@
+// `insta db query <service> [args...]` — run a query/command against a MANAGED database
+// (mysql/redis/mongodb) through the platform's console exec API. Postgres is not a console target
+// (it has the SQL editor / DATABASE_URL, and `insta db url|connect`), so a postgres service is
+// rejected here. The shape logic — path, request body, result rendering — lives in pure,
+// unit-tested seams; the handler just resolves the service and wires them to the API, this repo's
+// pure-seam convention.
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson, die, handleApproval } from '../util.js';
+import { q } from './services.js';
+export const MANAGED_ENGINES = ['mysql', 'redis', 'mongodb'];
+// pure: the console exec route for a managed-DB service.
+export function consoleExecPath(projectId, serviceId) {
+    return `/projects/${projectId}/database/console/${serviceId}/exec`;
+}
+// pure: map the engine + trailing args to the exec request body. mysql/mongodb take a single
+// command string (args joined with a space — the user quotes the whole statement); redis takes a
+// pre-tokenized argv (each arg verbatim, so a value with spaces survives as one token). Only
+// mongodb carries an optional --database.
+export function execBody(engine, args, database) {
+    if (engine === 'redis')
+        return { argv: args };
+    const command = args.join(' ');
+    if (engine === 'mongodb')
+        return { command, ...(database ? { database } : {}) };
+    return { command };
+}
+// pure: render a mysql result set as a simple left-aligned table — the header from columns, then
+// the rows, every column but the last padded so cells line up. A null cell renders as an em-dash
+// (the repo norm for a missing value), never an empty string. A trailing count line closes it.
+export function renderMysqlRows(data) {
+    const headers = (data.columns ?? []).map((c) => c.name);
+    const rows = data.rows ?? [];
+    const cell = (v) => (v === null || v === undefined ? '—' : String(v));
+    const widths = headers.map((h, i) => {
+        let w = h.length;
+        for (const r of rows)
+            w = Math.max(w, cell(r[i]).length);
+        return w;
+    });
+    const fmtRow = (vals) => vals.map((v, i) => (i === vals.length - 1 ? v : v.padEnd(widths[i] ?? 0))).join('  ');
+    const lines = [fmtRow(headers)];
+    for (const r of rows)
+        lines.push(fmtRow(headers.map((_, i) => cell(r[i]))));
+    const rowCount = typeof data.rowCount === 'number' ? data.rowCount : rows.length;
+    lines.push(`(${rowCount} rows${data.truncated ? ', truncated' : ''})`);
+    return lines;
+}
+// pure: a redis reply — a scalar prints raw, anything structured pretty-prints as JSON.
+export function renderRedisReply(reply) {
+    if (typeof reply === 'string' || typeof reply === 'number')
+        return String(reply);
+    return JSON.stringify(reply, null, 2);
+}
+// pure: a mongodb result is arbitrary JSON — pretty-print it.
+export function renderMongoResult(result) {
+    return JSON.stringify(result, null, 2);
+}
+async function dbQueryDeps(deps) {
+    if (deps)
+        return deps;
+    const [api, project] = [await ApiClient.load(), await requireProject()];
+    return { api, project };
+}
+// Resolve <service> (a service NAME) to its id + engine, then dispatch to the console exec API.
+export async function dbQuery(service, args, opts = {}, deps) {
+    // An empty command is never valid — reject it before loading config or hitting the network,
+    // rather than posting an empty statement/argv to the console.
+    if (args.length === 0) {
+        die('usage: insta db query <service> <query…> (mysql/mongodb: one quoted statement; redis: e.g. GET mykey)');
+    }
+    const { api, project: p } = await dbQueryDeps(deps);
+    const branch = opts.branch ?? p.branch;
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
+    const svc = services.find((s) => s.name === service);
+    if (!svc)
+        die(`service not found: ${service}`);
+    if (!MANAGED_ENGINES.includes(svc.type)) {
+        die('db query is for managed databases (mysql/redis/mongodb); postgres uses the SQL editor / DATABASE_URL');
+    }
+    const engine = svc.type;
+    // --database is a mongodb-only selector (execBody drops it for the others). Rejecting it here,
+    // rather than silently ignoring it, keeps the documented mongodb-only contract honest.
+    if (opts.database !== undefined && engine !== 'mongodb') {
+        die('--database is only supported for mongodb services');
+    }
+    const res = await api.rawRequest('POST', consoleExecPath(p.projectId, svc.id), execBody(engine, args, opts.database));
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    if (engine === 'mysql') {
+        for (const line of renderMysqlRows(res.body ?? {}))
+            info(line);
+    }
+    else if (engine === 'redis') {
+        info(renderRedisReply(res.body?.reply));
+    }
+    else {
+        info(renderMongoResult(res.body?.result));
+    }
+}
+//# sourceMappingURL=db-query.js.map

package/dist/commands/env.js

@@ -70,7 +70,7 @@ export async function envUse(name, opts = {}) {
     info(`  api: ${nextApi}`);
     info(`  mcp: ${ENVS[target].mcp} (registers as \`${mcpServerName(target)}\`)`);
     if (hadSession)
-        info('  previous session dropped (separate deployment) — run `insta login --oauth github`');
+        info('  previous session dropped (separate deployment) — run `insta login`');
     // Switching the CLI does NOT re-point already-installed agents: their MCP registration and skill
     // files were written for the previous environment and are keyed by a different server name, so
     // they keep talking to it until setup is re-run. --env is REQUIRED in the hint: since 0.0.38 a

package/dist/commands/setup.js

@@ -13,10 +13,10 @@ import { createInterface } from 'node:readline';
 import { ApiClient } from '../api.js';
 import { readPersistedGlobal, resolveEnv } from '../config.js';
 import { DEFAULT_ENV, ENVS, ENV_NAMES, envForApiUrl, envFromEnvVar, isEnvName, mcpServerName } from '../env.js';
-import { info } from '../util.js';
+import { info, openUrl } from '../util.js';
 import { isRunnableFile, resolveSpawnable } from '../spawn.js';
-import { loginOauth } from './auth.js';
-import { projectLink } from './project.js';
+import { loginDevice } from './auth.js';
+import { projectCreate, projectLink, slugifyName } from './project.js';
 import { envUse } from './env.js';
 import { installAgentConfigs } from './mcp.js';
 import { detectChannel } from './upgrade.js';
@@ -276,6 +276,18 @@ export function planSetupEnv(flagEnv, persistedApiUrl, apiUrlOverride = process.
     const target = envVar ?? DEFAULT_ENV;
     return { target, switch: persisted !== target };
 }
+/** The project step. Only a contradictory flag pair throws: rejecting a nameless `--create` here
+ *  would abort the whole setup, and `projectCreate` already guides that case. */
+export function planProject(opts) {
+    if (opts.create !== undefined && opts.project !== undefined) {
+        throw new Error('--create and --project are mutually exclusive — create a new project, or link an existing one');
+    }
+    if (opts.project)
+        return { kind: 'link', id: opts.project };
+    if (opts.create === undefined)
+        return { kind: 'none' };
+    return { kind: 'create', name: typeof opts.create === 'string' ? opts.create : undefined };
+}
 /** Whether setup should flow straight into login: an interactive human terminal with no session.
  *  Pure. Non-TTY (agents, CI, pipes) and -y runs never prompt — a browser OAuth flow cannot work
  *  there anyway; they get the printed `next:` hint instead, and prompt.md walks agents through
@@ -347,13 +359,15 @@ const defaultAsk = async (question) => {
 };
 export async function setupAgent(opts, run = defaultRunner, mint, installConfigs = installAgentConfigs, ensure = (r) => ensureCliInstalled(r), readStored = readPersistedGlobal, switchEnv = (n) => envUse(n), loginFlow = {
     ask: defaultAsk,
-    login: () => loginOauth('github', {}),
+    login: () => loginDevice({}, openUrl),
     stdinTty: canPromptViaTty(),
     stdoutTty: !!process.stdout.isTTY,
-}, link = projectLink) {
+}, link = projectLink, create = (n) => projectCreate(n, {})) {
     if (!opts.yes && !process.stdout.isTTY) {
         info('non-interactive shell — assuming -y');
     }
+    // Reject an impossible --project/--create request here, while the machine is still untouched.
+    const project = planProject(opts);
     // Pin the environment BEFORE anything is installed (see planSetupEnv). A required switch goes
     // through `env use` — the one path that persists the choice and drops the now-foreign session —
     // and announces itself, so the machine can never end up with its CLI on one deployment and its
@@ -398,7 +412,7 @@ export async function setupAgent(opts, run = defaultRunner, mint, installConfigs
     const stored = await readStored();
     let loggedIn = !!(stored.accessToken || stored.user);
     if (shouldOfferLogin(!!opts.yes, loggedIn, loginFlow.stdinTty, loginFlow.stdoutTty)) {
-        if (await loginFlow.ask('log in now with GitHub? (Y/n) ')) {
+        if (await loginFlow.ask('log in now in the browser? (Y/n) ')) {
             try {
                 await loginFlow.login();
                 loggedIn = true;
@@ -407,30 +421,37 @@ export async function setupAgent(opts, run = defaultRunner, mint, installConfigs
             }
             catch (e) {
                 info(`  login did not complete (${e instanceof Error ? e.message : String(e)}) — no problem, setup itself is done.`);
-                info('  on a remote/SSH machine the browser flow cannot call back here — use `insta login --device` instead.');
+                info('  run `insta login` to try again — the sign-in link it prints works from a browser on any device.');
             }
         }
     }
-    // --project: link this directory inside the SAME process. The console's connect panel used to
-    // print `setup agent && insta project link <id>` as one paste — but no shell joiner survives
-    // every Windows shell, and in shells without bracketed paste the queued link line is eaten as
-    // the answer to the login prompt above (console PR #290). Carrying the id as a flag is the one
-    // form where "one line" is safe. Linking needs the session: without one the manual command is
-    // the hint, never a hang; a failed link (bad id, no access) is a REAL error — the link is the
-    // entire point of the flag — so it sets the exit code instead of pretending setup succeeded.
-    if (opts.project) {
+    // --project / --create: bind this directory to a project inside the SAME process. Never split
+    // this back into `setup agent && insta project <cmd>` as one paste: no shell joiner survives
+    // every Windows shell, and in shells without bracketed paste the queued second line is eaten
+    // as the answer to the login prompt above (console PR #290). Both need the session: without
+    // one the manual command is the hint, never a hang; a failure (bad id, no access, name taken)
+    // is a REAL error — binding a project is the entire point of the flag — so it sets the exit
+    // code instead of pretending setup succeeded.
+    if (project.kind !== 'none') {
+        const linking = project.kind === 'link';
+        const retry = linking
+            ? `insta project link ${project.id}`
+            : `insta project create${project.name ? ` ${slugifyName(project.name)}` : ''}`;
         if (!loggedIn) {
-            info(`  not logged in — project not linked; run \`insta login\`, then \`insta project link ${opts.project}\``);
+            info(`  not logged in — project not ${linking ? 'linked' : 'created'}; run \`insta login\`, then \`${retry}\``);
         }
         else {
             try {
-                await link(opts.project);
+                if (project.kind === 'link')
+                    await link(project.id);
+                else
+                    await create(project.name);
             }
             catch (e) {
                 // Stop here — like the skill-install failure above, finishing with the success summary
                 // and a cheerful `next:` after an error is mixed messaging. Setup itself did succeed,
                 // so say exactly that alongside the retry command.
-                info(`  project link failed (${e instanceof Error ? e.message : String(e)}) — agent setup itself is done; run \`insta project link ${opts.project}\` to retry the link`);
+                info(`  project ${linking ? 'link' : 'create'} failed (${e instanceof Error ? e.message : String(e)}) — agent setup itself is done; run \`${retry}\` to retry the ${linking ? 'link' : 'create'}`);
                 process.exitCode = 1;
                 return;
             }

package/dist/index.js

@@ -20,6 +20,7 @@ import { deploy } from './commands/deploy.js';
 import { build } from './commands/build.js';
 import * as computeCmd from './commands/compute.js';
 import * as dbCmd from './commands/db.js';
+import * as dbQueryCmd from './commands/db-query.js';
 import * as storageCmd from './commands/storage.js';
 import { manifest } from './commands/manifest.js';
 import * as template from './commands/template.js';
@@ -61,11 +62,11 @@ function resolveVersion() {
 }
 program.name('insta').description('InstaCloud CLI — manage projects, branches, secrets, deploys').version(resolveVersion());
 // ---- auth ----
-program.command('login').description('Log in with email + password, --oauth <github|google> (browser), --device (headless), or --api-key <insta_…> (headless, durable token)')
-    .option('--email <email>', 'account email')
-    .option('--password <password>', 'account password (else $INSTA_PASSWORD or prompt)')
+program.command('login').description('Log in — bare: sign in from your browser (any account type); or --email <email> + password, --oauth <github|google>, --device (headless), --api-key <insta_…> (headless, durable token)')
+    .option('--email <email>', 'account email (email + password login)')
+    .option('--password <password>', 'account password (else $INSTA_PASSWORD or prompt; needs --email)')
     .option('--oauth <provider>', 'browser OAuth login: github | google')
-    .option('--device', 'device-code login: approve from a browser on any other machine (VMs, SSH, CI)')
+    .option('--device', 'device-code login: like bare login but never opens a browser here — approve from any other machine (VMs, SSH, CI)')
     .option('--api-key <key>', 'non-interactive login with a durable insta_ API token (headless agents / CI)')
     .option('--api-url <url>', 'control-plane API base URL')
     .option('--env <name>', `deployment environment: ${ENV_NAMES.join(' | ')}`)
@@ -90,6 +91,7 @@ setupCmd.command('agent').description('Install the insta CLI (if missing), the i
     .option('--env <prod|staging>', 'deployment to set this machine up for (default: prod — switches and persists, like `insta env use`)')
     .option('--mcp-token', 'register the MCP server with a minted insta_ API token instead of OAuth (headless machines / CI)')
     .option('--project <id>', 'also link this directory to an existing project after setup (flows through login first if needed)')
+    .option('--create [name]', 'also create a new project and link this directory after setup (default name: this directory; mutually exclusive with --project)')
     .action(guard((o) => setup.setupAgent(o)));
 // ---- MCP server integration ----
 const mcpCmd = program.command('mcp').description('insta-cloud remote MCP server integration');
@@ -198,7 +200,7 @@ program.command('deploy [dir]').description('Deploy a source directory (built re
 // optional makes commander unable to hold that boundary itself).
 const { argv: computeArgv, command: execCommand, windowsFallback: execWindowsFallback, } = computeCmd.splitExecArgs(process.argv);
 // ---- compute (lifecycle control + custom domains) ----
-const compute = program.command('compute').description('Control compute lifecycle (start/stop/suspend/status) + custom domains');
+const compute = program.command('compute').description('Control compute lifecycle (start/stop/suspend/restart/status) + custom domains');
 compute.command('set-domain <host>').description('Attach a custom domain to a branch compute service (gated: deploy)')
     .option('--branch <b>').option('--group <g>').option('--json').action(guard((host, o) => computeCmd.setDomain(host, o)));
 compute.command('check-domain <host>').description("Show a custom domain's cert status + required DNS records")
@@ -211,6 +213,8 @@ compute.command('stop [service]').description('Take a compute service offline; t
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStop(service, o)));
 compute.command('suspend [service]').description('Suspend a compute service (RAM snapshot); stays down until `start`')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeSuspend(service, o)));
+compute.command('restart [service]').description("Restart a compute service by re-running the image it already runs against a freshly resolved env bundle — this is how a changed secret or binding reaches a running machine (env is baked into the machine at deploy time), and how a machine that is up but wedged gets cycled (`start` no-ops on one that is already started). No new image, no new spec. The service must be running: a stopped or suspended one comes back with `insta compute start`. All plans; gated: deploy — it lands configuration the same way a deploy does, so a policy denying deploys denies this too (`start`/`stop` stay ungated, and cycle a wedged machine without one). A service whose app fails to answer on its port coming back up reports that failure, and the machines are rolled back, best-effort, to the config they were serving")
+    .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeRestart(service, o)));
 compute.command('status [service]').description("Show a compute service's desired vs. live state")
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStatus(service, o)));
 compute.command('limits [service]').description("Show or set a compute service's resource ceiling (paid plans). --memory is the dial; cpu derives from it unless --cpu is given. Billing is actual usage — the ceiling caps what the app may burn, it is not a price")
@@ -228,8 +232,8 @@ compute.command('volume [service]').description("Show, attach, grow, or delete a
     .option('--size <gi>', 'new size in whole Gi, e.g. 10 (must be ≥ the current size)')
     .option('--delete', 'destroy the volume and ALL its data (irreversible; download anything you need first)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeVolume(service, o)));
-// ---- db (postgres service controls) ----
-const db = program.command('db').description('Postgres service controls (url / connect / limits / volume / always-on / scale-to-zero)');
+// ---- db (postgres service controls + managed-DB query) ----
+const db = program.command('db').description('Postgres service controls (url / connect / limits / volume / always-on / scale-to-zero) + managed-DB query (mysql/redis/mongodb)');
 db.command('url').description('Print the postgres connection string (DSN) — bare on stdout for piping, e.g. `psql "$(insta db url)"` (gated: secrets.read). Provider credentials are not in `insta secrets` — this is the command that yields the DSN')
     .option('--json').option('--branch <branch>', 'branch (default: current)').option('--group <g>', 'postgres service name (default: the sole/default one)')
     .action(guard((o) => dbCmd.dbUrl(o)));
@@ -250,6 +254,11 @@ db.command('volume').description("Show or grow a postgres service's provisioned
     .option('--size <gi>', 'new size in whole Gi, e.g. 10 (must be ≥ the current size)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').option('--group <g>', 'postgres service name (default: the sole/default one)')
     .action(guard((o) => dbCmd.dbVolume(o)));
+db.command('query <service> [args...]').description('Run a query/command against a managed database (mysql/redis/mongodb) via the console exec API. mysql/mongodb take one quoted statement; redis takes a pre-tokenized argv (e.g. `GET mykey`). Not for postgres — use `insta db url|connect` / the SQL editor')
+    .option('--database <db>', 'mongodb only — the database to run against (default admin)')
+    .option('--branch <branch>', 'branch (default: current)')
+    .option('--json')
+    .action(guard((service, args, o) => dbQueryCmd.dbQuery(service, args, o)));
 // ---- storage (bucket objects) ----
 const storage = program.command('storage').description("Browse, download, and delete a storage service's bucket objects");
 storage.command('list').description("List the bucket's objects. S3 filters by prefix only — there is no substring search")
@@ -300,7 +309,7 @@ program.command('usage').description('Usage for the current billing cycle by bil
 const bill = program.command('billing').description('Current billing cycle overview (tier / used / included / overage / credits / forecast + per-dimension & per-project breakdown)')
     .option('--org <id>', 'target org (default: linked project\'s org)').option('--json')
     .action(guard((o) => billing(o)));
-bill.command('upgrade <tier>').description('Subscribe the org to a paid tier (pro|enterprise) via Stripe Checkout')
+bill.command('upgrade <tier>').description('Subscribe the org to a paid tier (pro|team) via Stripe Checkout')
     .option('--org <id>').option('--no-open', 'print the URL instead of opening a browser').option('--json')
     .action(guard((tier, o) => billingUpgrade(tier, o)));
 bill.command('portal').description('Open the Stripe Customer Portal (change plan / card / cancel)')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.49",
+  "version": "0.0.52",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [