insta 0.0.59 → 0.0.60

package/dist/commands/observe.js

@@ -11,24 +11,36 @@ import { renderReport } from '../observe/report.js';
 import { ApiClient, requireProject } from '../api.js';
 import { info, printJson } from '../util.js';
 // Where the audit lives: the hook records at the directory it is materialized in
-// (<root>/.insta/observe/hook.js — see projectRootFor), so report/sync must anchor on the same
-// thing. The link file is the usual root, but a standalone `insta observe install` in an
-// unlinked directory has no project.json — climb for the hook itself then, so both halves agree
-// from any subdirectory. Falls back to cwd when neither exists (→ "audit log is empty").
+// (<root>/.insta/observe/hook.js — see projectRootFor), so report/sync must anchor on exactly
+// that: the NEAREST materialized hook above cwd, which is what the Codex wrapper and the Claude
+// entry run. The link file is only a fallback for a directory where no hook exists yet (it is
+// where the next install will land), then cwd (→ "audit log is empty"). Preferring the link file
+// would break the moment the two diverge — e.g. a hook materialized below a linked parent —
+// because the reader would look where the writer never writes.
 export async function auditRoot(cwd = process.cwd()) {
-    const linked = await findProjectRoot(cwd);
-    if (linked)
-        return linked;
+    const hook = nearestHookRoot(cwd);
+    if (hook)
+        return hook;
+    return (await findProjectRoot(cwd)) ?? cwd;
+}
+/** Nearest ancestor (or cwd) holding a materialized hook, or null. */
+export function nearestHookRoot(cwd) {
     let dir = resolve(cwd);
     for (;;) {
         if (existsSync(join(dir, '.insta', 'observe', 'hook.js')))
             return dir;
         const parent = dirname(dir);
         if (parent === dir)
-            return cwd;
+            return null;
         dir = parent;
     }
 }
+/** Where `install` materializes: the linked project root when inside one (so a re-link or
+ *  `observe install` from a subdirectory refreshes the project's hook instead of minting a second
+ *  one the readers never look at — same rule as writeProject), else cwd. */
+export async function installRoot(cwd = process.cwd()) {
+    return (await findProjectRoot(cwd)) ?? cwd;
+}
 async function readAudit() {
     try {
         const txt = await readFile(join(await auditRoot(), '.insta', 'audit.jsonl'), 'utf8');
@@ -46,8 +58,9 @@ function* chunk(a, n) {
         yield a.slice(i, i + n);
 }
 export async function observeInstall() {
-    const res = installObserve({ cwd: process.cwd() });
-    info(`installed observe hook (claude: ${res.claude}, codex: ${res.codex}) → ./.insta/observe`);
+    const root = await installRoot();
+    const res = installObserve({ cwd: root });
+    info(`installed observe hook (claude: ${res.claude}, codex: ${res.codex}) → ${join(root, '.insta', 'observe')}`);
     if (res.ignored.length)
         info(`  .gitignore += ${res.ignored.join(', ')}`);
     const hint = untrackHint(res.tracked);
@@ -57,7 +70,7 @@ export async function observeInstall() {
     info('run `insta observe report` to review, `insta observe sync` to upload to the project timeline');
 }
 export async function observeUninstall() {
-    uninstallObserve(process.cwd());
+    uninstallObserve(await installRoot());
     info('uninstalled observe hook');
 }
 export async function observeReport(opts) {

package/dist/commands/project.js

@@ -3,6 +3,7 @@ import { ApiClient, requireProject } from '../api.js';
 import { writeProject } from '../config.js';
 import { info, die, printJson, handleApproval, renderNextActions } from '../util.js';
 import { installObserve } from '../observe/install.js';
+import { installRoot } from './observe.js';
 import { untrackHint } from '../gitignore.js';
 import { installSkills } from '../ensure-skills.js';
 // Generic directory names that make a useless project name ("projects", "~", "tmp", …). When the
@@ -14,10 +15,12 @@ const GENERIC_DIRS = new Set([
     'app', 'apps', 'users', 'user', 'bin', 'new', 'test', 'tests',
 ]);
 // Best-effort: wire the credential-audit hook into the project (no-op if assets aren't built).
+// Anchored at the linked project root (writeProject just updated it), not cwd: a re-link from a
+// subdirectory must refresh the project's hook, not mint a second one the readers never see.
 // quiet: with --json the install still runs, but its note moves to stderr (stdout is JSON-only).
-function tryInstallObserve(quiet = false) {
+async function tryInstallObserve(quiet = false) {
     try {
-        const r = installObserve({ cwd: process.cwd() });
+        const r = installObserve({ cwd: await installRoot() });
         const say = (line) => (quiet ? process.stderr.write(line + '\n') : info(line));
         if (r.claude || r.codex)
             say('  installed observe hook (credential audit) → ./.insta/observe');
@@ -82,7 +85,7 @@ export async function projectCreate(name, opts) {
         info(`  linked ./.insta/project.json (branch ${out.defaultBranch.name})`);
         renderNextActions(out.nextActions);
     }
-    tryInstallObserve(opts.json);
+    await tryInstallObserve(opts.json);
     await installSkills({ cwd: process.cwd(), print: skillsPrint(opts.json) });
 }
 export async function projectList(opts) {
@@ -104,7 +107,7 @@ export async function projectLink(id, opts = {}) {
         printJson({ project, linked: { projectId: project.id, orgId: project.org_id, branch: 'main' } });
     else
         info(`linked project ${project.id} (${project.name})`);
-    tryInstallObserve(opts.json);
+    await tryInstallObserve(opts.json);
     await installSkills({ cwd: process.cwd(), print: skillsPrint(opts.json) });
 }
 export async function projectDelete(opts) {

package/dist/ensure-skills.js

@@ -91,16 +91,18 @@ export async function installSkills(deps) {
                 installed++;
             print(r.ok ? `  ${s.label} ✓` : `  ${s.label} failed — add manually: npx ${s.args.join(' ')}`);
         }
-        // Only when something was actually written: an offline run that failed every add has no
-        // skill dirs or lock to ignore, and a `.gitignore +=` line there would claim otherwise.
+        // The already-tracked hint is independent of this run: a repo that committed the skill dirs
+        // or the lock months ago needs the `git rm --cached` line whether or not today's adds worked.
+        const hint = untrackHint(alreadyTracked(deps.cwd, SKILL_DIRS));
+        if (hint)
+            print(hint);
+        // The ignore entries only when something was actually written: an offline run that failed
+        // every add has no new skill dirs or lock, and a `.gitignore +=` line would claim otherwise.
         if (installed === 0)
             return;
         const added = ensureGitignore(deps.cwd, SKILL_DIRS, GITIGNORE_COMMENT);
         if (added.length)
             print(`  .gitignore += ${added.join(', ')}`);
-        const hint = untrackHint(alreadyTracked(deps.cwd, SKILL_DIRS));
-        if (hint)
-            print(hint);
     }
     catch {
         /* best-effort convenience — never block the host command */

package/dist/observe/install.js

@@ -84,12 +84,15 @@ function claudeEntry() {
 // a fresh clone with no ./.insta anywhere above is a silent no-op. The script must stay free of
 // characters either shell rewrites inside double quotes: `$` and backticks (sh), `%` and `!`
 // (cmd.exe), and `"` (both). Codex has each user trust the entry before it runs, so shareable is safe.
+// Exit code: the hook's own status when it ran; 0 when it could not be started or was killed
+// (status null) — every other arm of this install is silent best-effort, and Codex reports any
+// non-zero exit as a failed hook after EVERY tool call, which is worse than a missed audit line.
 const CODEX_HOOK_SCRIPT = [
     "const f=require('fs'),p=require('path'),c=require('child_process');",
     'let d=process.cwd();',
     'for(;;){',
     "const h=p.join(d,'.insta/observe/hook.js');",
-    "if(f.existsSync(h)){const r=c.spawnSync(process.execPath,[h],{stdio:'inherit'});process.exitCode=r.status===null?1:r.status;break}",
+    "if(f.existsSync(h)){const r=c.spawnSync(process.execPath,[h],{stdio:'inherit'});process.exitCode=r.status===null?0:r.status;break}",
     'const u=p.dirname(d);if(u===d)break;d=u}',
 ].join('');
 function codexEntry() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.59",
+  "version": "0.0.60",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [