insta 0.0.65 → 0.0.67

package/README.md

@@ -220,6 +220,7 @@ build never reaches a production installer.
 | `insta run <cmd>` | Run a command with the branch bundle injected, nothing written to disk |
 | `insta deploy [dir]` | Deploy a source directory (built remotely) or `--image <url>` |
 | `insta compute` | `start` · `stop` · `suspend` · `status` · `set-domain` · `check-domain` · `remove-domain` |
+| `insta domain` | Buy a domain through InstaCloud: `search` · `buy` · `attach` · `list` · `status` · `contact` |
 | `insta db` | `url` (print the postgres DSN) · `connect` (psql session) · `limits` · `stats` · `always-on` · `volume` |
 | `insta regions` | Regions available for postgres and compute |
 | `insta manifest` | Agent-legible view of every branch and its URLs |

package/dist/agent.js

@@ -61,7 +61,13 @@ export async function loadAgentSession(apiUrl, projectId, cwd = process.cwd()) {
         throw new Error(guidance);
     }
 }
-export async function agentHeaders(api, method, path, rawBody) {
+// Routes the CLI may call on an account-level (bootstrap) session, by first path segment. Every
+// other route is project-owned: either its path names the project or the caller passes
+// scope.projectId. A miss fails HERE, naming the route, instead of on the platform as a
+// "for a different project" 403 whose setup hint cannot help — keep this list in step with the
+// account-level paths in src/commands/.
+export const ACCOUNT_ROUTES = new Set(['agent', 'auth', 'me', 'orgs', 'regions', 'templates', 'tokens', 'github']);
+export async function agentHeaders(api, method, path, rawBody, scope = {}) {
     if (!mode)
         return {};
     if (canonicalTarget(path) === '/agent/sessions' && method === 'POST')
@@ -70,9 +76,13 @@ export async function agentHeaders(api, method, path, rawBody) {
         };
     const target = canonicalTarget(path);
     const match = target.match(/^\/projects\/([^/?]+)/);
+    const projectId = scope.projectId ?? (match ? decodeURIComponent(match[1]) : undefined);
+    if (!projectId && !ACCOUNT_ROUTES.has(target.split('/')[1]?.split('?')[0] ?? '')) {
+        throw new Error(`${method.toUpperCase()} ${target} is a project route but no project was given — this is an insta CLI bug; please report it with \`insta feedback\``);
+    }
     // Account reads/project creation have no project policy yet. Mint a short-lived bootstrap
     // assertion in memory. It cannot access project routes; never downgrade to a human request.
-    const session = match ? await loadAgentSession(api.apiUrl, decodeURIComponent(match[1])) : await issueAgentSession(api);
+    const session = projectId ? await loadAgentSession(api.apiUrl, projectId) : await issueAgentSession(api);
     const timestamp = String(Math.floor(Date.now() / 1000));
     const nonce = randomUUID();
     const proof = [method.toUpperCase(), target, hash(rawBody), session.agentSessionId, timestamp, nonce, mode.source, session.client].join('\n');

package/dist/api.js

@@ -60,7 +60,7 @@ export class ApiClient {
     }
     // Returns parsed body for status < 400 (incl. 202); throws ApiError otherwise.
     async request(method, path, body, opts = {}) {
-        const res = await this.raw(method, path, body, opts.auth ?? true);
+        const res = await this.raw(method, path, body, opts.auth ?? true, opts);
         if (agentMode() && res.status === 202 && res.body?.status === 'approval_required')
             throw new AgentApprovalRequired(res.body);
         if (res.status >= 400)
@@ -69,25 +69,25 @@ export class ApiClient {
     }
     // Like request but returns {status, body} so callers can branch on 202 (approval_required).
     async rawRequest(method, path, body, opts = {}) {
-        const res = await this.raw(method, path, body, opts.auth ?? true);
+        const res = await this.raw(method, path, body, opts.auth ?? true, opts);
         if (res.status >= 400)
             throw new ApiError(res.status, res.body?.error ?? `HTTP ${res.status}`, res.body);
         return res;
     }
-    async raw(method, path, body, auth) {
-        let r = await this.fetch(method, path, body, auth);
+    async raw(method, path, body, auth, scope = {}) {
+        let r = await this.fetch(method, path, body, auth, scope);
         if (r.status === 401 && auth && this.cfg.refreshToken) {
             if (await this.refresh())
-                r = await this.fetch(method, path, body, auth);
+                r = await this.fetch(method, path, body, auth, scope);
         }
         return r;
     }
-    async fetch(method, path, body, auth) {
+    async fetch(method, path, body, auth, scope = {}) {
         const headers = { 'Content-Type': 'application/json', 'Insta-Hints': '1', 'User-Agent': USER_AGENT };
         if (auth && this.cfg.accessToken)
             headers.Authorization = `Bearer ${this.cfg.accessToken}`;
         if (auth)
-            Object.assign(headers, await agentHeaders(this, method, path, body === undefined ? '' : JSON.stringify(body)));
+            Object.assign(headers, await agentHeaders(this, method, path, body === undefined ? '' : JSON.stringify(body), scope));
         const res = await this.fetchImpl(this.apiUrl + path, {
             method,
             headers,

package/dist/commands/auth.js

@@ -116,7 +116,8 @@ export async function applyApiKeyLogin(client, key) {
 const sleepSeconds = (s) => new Promise((r) => setTimeout(r, s * 1000));
 // Drives the device grant against the platform's Better Auth mount (/api/auth/device*) and
 // returns the approved session token. Injectable poster + wait keep this testable without a
-// network or real timers. Poll errors arrive as ApiError with the OAuth error code as message.
+// network or real timers. Poll errors arrive as ApiError with the OAuth error code as message
+// (or a bare `HTTP 429` from the platform's rate limiter, treated as slow_down).
 // `open` (the default browser-login path) launches the verification link locally on top of
 // printing it; without it (--device) the link is print-only, for a browser on another machine.
 export async function deviceGrant(post, wait = sleepSeconds, open) {
@@ -169,6 +170,14 @@ export async function deviceGrant(post, wait = sleepSeconds, open) {
                 interval += 5;
                 continue;
             } // RFC 8628 §3.5: back off by 5s
+            // The platform's per-IP limiter answers a bare HTTP 429 (no OAuth error code) when a poll
+            // trips it — seen on prod 2026-09-10 after ~8 min of steady 5s polling. That is the same
+            // instruction as slow_down: the code is still pending, so back off and keep waiting rather
+            // than abort a login the human may be one click away from approving.
+            if (e.status === 429) {
+                interval += 5;
+                continue;
+            }
             if (code === 'expired_token')
                 break;
             if (code === 'access_denied')

package/dist/commands/billing.js

@@ -2,7 +2,7 @@ import { ApiClient, requireProject } from '../api.js';
 import { die, info, openUrl, printJson } from '../util.js';
 import { cycleLine, dimensionLines } from './metrics.js';
 // Resolve the target org: explicit --org, else the linked project's org.
-async function resolveOrgId(opts) {
+export async function resolveOrgId(opts) {
     if (opts.org)
         return opts.org;
     return (await requireProject()).orgId;
@@ -108,7 +108,7 @@ export async function billingPortal(opts) {
 // "opening", not "opened": a launcher that starts and then fails reports it asynchronously,
 // so openUrl's true return is an attempt, not a confirmation (see util.ts) — and the URL is
 // already printed above for exactly that case.
-function presentUrl(url, label, open) {
+export function presentUrl(url, label, open) {
     info(label);
     info(`  ${url}`);
     if (open !== false && openUrl(url))

package/dist/commands/compute.js

@@ -262,11 +262,11 @@ export function domainConflictMessage(host, e, services, ctx = {}) {
 // Resolve branch + target service, so every domain verb names the service AND its region, and an
 // ambiguous project is refused with the list instead of the platform's `default` fallback picking
 // one silently.
-async function domainTarget(api, projectId, branch, host, group) {
+export async function domainTarget(api, projectId, branch, host, group) {
     const { services } = await api.request('GET', `/projects/${projectId}/services${q(branch)}`);
     return { target: resolveDomainTarget(services, host, group), services };
 }
-async function domainDeps(deps) {
+export async function domainDeps(deps) {
     if (deps)
         return deps;
     const [api, project] = [await ApiClient.load(), await requireProject()];

package/dist/commands/domain.js

@@ -0,0 +1,164 @@
+import { readFile } from 'node:fs/promises';
+import { ApiClient } from '../api.js';
+import { info, printJson, handleApproval, die } from '../util.js';
+import { presentUrl, resolveOrgId } from './billing.js';
+import { domainDeps, domainTarget } from './compute.js';
+const usd = (cents) => `$${(cents / 100).toFixed(2)}`;
+// --org wins; otherwise the linked project's org — the org verbs must not force a project link.
+async function orgDeps(opts, deps) {
+    if (deps)
+        return { api: deps.api, orgId: opts.org ?? deps.project.orgId };
+    return { api: await ApiClient.load(), orgId: await resolveOrgId(opts) };
+}
+export function searchLines(results) {
+    if (!results.length)
+        return ['no results'];
+    const w = Math.max(...results.map((r) => r.domainName.length));
+    return results.map((r) => r.purchasable
+        ? `  ${r.domainName.padEnd(w)}  ${usd(r.priceCents)}${r.renewalPriceCents !== undefined ? `  (renews ${usd(r.renewalPriceCents)}/yr)` : ''}`
+        : `  ${r.domainName.padEnd(w)}  unavailable${r.reason ? ` — ${r.reason}` : ''}`);
+}
+export async function domainSearch(keyword, opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const qs = new URLSearchParams({ q: keyword });
+    if (opts.tlds)
+        qs.set('tlds', opts.tlds);
+    const r = await api.request('GET', `/orgs/${orgId}/domains/search?${qs}`);
+    if (opts.json)
+        return printJson(r);
+    for (const line of searchLines(r.results))
+        info(line);
+    const buyable = r.results.find((x) => x.purchasable);
+    if (buyable)
+        info(`buy one: insta domain buy ${buyable.domainName}`);
+}
+const CONTACT_KEYS = ['firstName', 'lastName', 'companyName', 'address1', 'address2', 'city', 'state', 'zip', 'country', 'email', 'phone'];
+export function contactFromOpts(opts, file) {
+    if (file !== undefined)
+        return file;
+    const out = {};
+    for (const k of CONTACT_KEYS)
+        if (opts[k] !== undefined)
+            out[k] = opts[k];
+    return Object.keys(out).length ? out : undefined;
+}
+async function readContactFile(path) {
+    if (!path)
+        return undefined;
+    try {
+        return JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch (e) {
+        throw new Error(`cannot read ${path} as JSON: ${e.message}`);
+    }
+}
+function contactLines(c) {
+    if (!c)
+        return ['no registrant contact set — set one with: insta domain contact set --first-name … (or --contact-file contact.json)'];
+    return [
+        `${c.firstName} ${c.lastName}${c.companyName ? ` (${c.companyName} — the organization is the legal registrant)` : ''}`,
+        `${c.address1}${c.address2 ? `, ${c.address2}` : ''}, ${c.city}, ${c.state} ${c.zip}, ${c.country}`,
+        `${c.email}  ${c.phone}`,
+    ];
+}
+export async function domainContactShow(opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('GET', `/orgs/${orgId}/domains/contact`);
+    if (opts.json)
+        return printJson(r);
+    for (const line of contactLines(r.contact))
+        info(line);
+}
+export async function domainContactSet(opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const contact = contactFromOpts(opts, await readContactFile(opts.contactFile));
+    if (!contact)
+        die('pass the contact as flags (--first-name … --phone) or as --contact-file <contact.json>');
+    const r = await api.request('PUT', `/orgs/${orgId}/domains/contact`, contact);
+    if (opts.json)
+        return printJson(r);
+    info('registrant contact saved:');
+    for (const line of contactLines(r.contact))
+        info(`  ${line}`);
+}
+export async function domainBuy(name, opts, deps) {
+    const { api, project: p } = await domainDeps(deps);
+    const branch = opts.branch ?? p.branch;
+    const { target } = await domainTarget(api, p.projectId, branch, name, opts.group);
+    const contact = await readContactFile(opts.contactFile);
+    // JSON.stringify drops undefined but keeps NaN as null, which the platform rejects as a type
+    // error rather than a bad term — so a malformed --years is refused here, with the reason.
+    let years;
+    if (opts.years !== undefined) {
+        years = Number(opts.years);
+        if (!Number.isInteger(years))
+            die(`--years must be a whole number of years, not ${opts.years}`);
+    }
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/domains/orders`, { domainName: name, years, branch, group: target.name, contact });
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    const { order } = res.body;
+    info(`${order.domainName} — ${usd(order.priceCents)} for ${order.years} year${order.years === 1 ? '' : 's'}${order.renewalPriceCents !== null ? `, then ${usd(order.renewalPriceCents)}/yr` : ''}`);
+    info(`attaches to ${target.name}${order.branch ? ` (branch ${order.branch})` : ''} as ${order.domainName} and www.${order.domainName} once paid`);
+    presentUrl(order.checkoutUrl, 'Complete the payment in your browser:', opts.open);
+    info(`then: insta domain status ${order.domainName}`);
+}
+export async function domainAttach(name, opts, deps) {
+    const { api, project: p } = await domainDeps(deps);
+    const branch = opts.branch ?? p.branch;
+    const { target } = await domainTarget(api, p.projectId, branch, name, opts.group);
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/domains/${encodeURIComponent(name)}/attach`, { branch, group: target.name });
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    const d = res.body;
+    info(`${d.domainName} will attach to ${target.name} as ${d.hostnames.map((h) => h.hostname).join(' and ')}`);
+    info(`then: insta domain status ${d.domainName}`);
+}
+// ---- list / status ----
+function domainLines(d) {
+    const out = [`${d.domainName}  ${d.status}${d.service ? `  → ${d.service}` : ''}${d.expiresAt ? `  (expires ${d.expiresAt.slice(0, 10)}${d.autorenew ? ', auto-renews' : ''})` : ''}`];
+    if (d.status === 'detached' || d.status === 'attach_failed')
+        out.push(`  attach it again: insta domain attach ${d.domainName}`);
+    const w = Math.max(0, ...d.hostnames.map((x) => x.hostname.length));
+    for (const h of d.hostnames)
+        out.push(`  ${h.hostname.padEnd(w)}  ${h.state}${h.reason ? ` — ${h.reason}` : ''}`);
+    return out;
+}
+function orderStatusLines(o) {
+    const out = [`order ${o.id}: ${o.domainName} — ${o.status}${o.failedReason ? ` — ${o.failedReason}` : ''}`];
+    if (o.status === 'canceled')
+        out.push(`  the checkout closed without payment — order again: insta domain buy ${o.domainName}`);
+    return out;
+}
+export async function domainList(opts, deps) {
+    const { api, project: p } = await domainDeps(deps);
+    const r = await api.request('GET', `/projects/${p.projectId}/domains`);
+    if (opts.json)
+        return printJson(r);
+    if (!r.items.length)
+        return info('no domains bought through InstaCloud in this project (search: insta domain search <keyword>)');
+    for (const d of r.items)
+        for (const line of domainLines(d))
+            info(line);
+}
+export async function domainStatus(name, opts, deps) {
+    const { api, project: p } = await domainDeps(deps);
+    const host = name.trim().toLowerCase();
+    const [{ items: domains }, { items: orders }] = await Promise.all([
+        api.request('GET', `/projects/${p.projectId}/domains`),
+        api.request('GET', `/projects/${p.projectId}/domains/orders`),
+    ]);
+    const domain = domains.find((d) => d.domainName === host) ?? null;
+    const order = orders.find((o) => o.domainName === host) ?? null;
+    if (!domain && !order)
+        die(`${host} was not bought through this project`);
+    if (opts.json)
+        return printJson({ domain, order });
+    for (const line of domain ? domainLines(domain) : orderStatusLines(order))
+        info(line);
+}
+//# sourceMappingURL=domain.js.map

package/dist/commands/github.js

@@ -32,6 +32,14 @@ export function pickCandidate(candidates, rootDir) {
         ...candidates.map((c) => `  ${(c.rootDir ?? '(repo root)').padEnd(24)} ${c.builder}${c.startCommand ? `  start: ${c.startCommand}` : ''}`),
     ].join('\n'));
 }
+// A comma-separated list, because a shell would glob an unquoted `apps/web/**` into filenames — which
+// also means a pattern containing a comma cannot be expressed. The server does the validation.
+export function parseWatchPaths(raw) {
+    const out = raw.split(',').map((p) => p.trim()).filter(Boolean);
+    if (!out.length)
+        throw new Error("watch paths need at least one pattern, e.g. 'apps/web/**,packages/ui/**' (quote them, or the shell expands the *)");
+    return out;
+}
 // Build/start come from detection only: the platform's nixpacks lane fails a build whose commands differ from it.
 // autoDeploy rides along only when switched off: a public repo 400s on autoDeploy: true.
 export function sourceBody(src, c, o) {
@@ -46,8 +54,14 @@ export function sourceBody(src, c, o) {
         port: o.port !== undefined ? parsePort(o.port) : c.port,
         ...(o.repoBranch ? { branch: o.repoBranch } : {}),
         ...(o.autoDeploy === false ? { autoDeploy: false } : {}),
+        ...(o.watchPaths !== undefined ? { watchPaths: parseWatchPaths(o.watchPaths) } : {}),
     };
 }
+// Named as repo-root paths wherever it is printed: every line that carries this also carries root_dir,
+// which the patterns are NOT relative to.
+export function watchPathsClause(paths) {
+    return `, but only when a push changes these repo-root paths: ${paths.join(', ')}`;
+}
 export function repoLine(serviceName, s) {
     if (s.type !== 'github')
         return `compute ${serviceName}: no repository connected${s.image ? ` (runs image ${s.image})` : ''} — connect one with \`insta compute connect-repo <owner/repo> ${serviceName}\``;
@@ -55,7 +69,10 @@ export function repoLine(serviceName, s) {
         ? 'public repo, deploys are manual (pushes do not redeploy)'
         : s.auto_deploy ? `every push to ${s.branch} redeploys it` : 'auto-deploy off (pushes do not redeploy)';
     const where = s.root_dir ? ` (${s.root_dir}/)` : '';
-    return `compute ${serviceName}: deploys from ${s.owner}/${s.repo}@${s.branch}${where} — ${how}`;
+    const only = !s.watch_paths?.length ? ''
+        : s.auto_deploy ? watchPathsClause(s.watch_paths)
+            : `; watch paths ${s.watch_paths.join(', ')} are stored but cannot apply`;
+    return `compute ${serviceName}: deploys from ${s.owner}/${s.repo}@${s.branch}${where} — ${how}${only}`;
 }
 export async function findInstalledRepo(api, orgId, ref) {
     if (!orgId)
@@ -105,11 +122,31 @@ export async function computeConnectRepo(rawRef, serviceName, opts) {
     const branch = res.source.branch;
     const where = candidate.rootDir ? `${candidate.rootDir}/, ${candidate.builder}` : candidate.builder;
     const now = res.build.queued ? `building ${branch} now` : `${branch} is already live at this commit`;
+    // From the server's answer, not from the flag: what it stored is what a push is matched against.
+    const filtered = res.source.watch_paths?.length ? watchPathsClause(res.source.watch_paths) : '';
     const how = src.source === 'public' ? 'deploys are manual from here: pushes will not redeploy (public repo)'
         : opts.autoDeploy === false ? 'auto-deploy is off: redeploy with `insta compute connect-repo` again or from the console'
-            : `every push to ${branch} redeploys it`;
+            : `every push to ${branch} redeploys it${filtered}`;
     info(`connected ${ref.owner}/${ref.repo} → compute ${svc.name} (${where}): ${now} — ${how}`);
 }
+// Do not reconnect to change these: watch paths do not change what a build produces, and `connect-repo`
+// would rebuild the service.
+export async function computeWatchPaths(serviceName, opts) {
+    if (opts.set !== undefined && opts.clear)
+        throw new Error('pass --set or --clear, not both');
+    const patch = opts.clear ? { watchPaths: null } : opts.set !== undefined ? { watchPaths: parseWatchPaths(opts.set) } : null;
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const svc = await targetService(api, p.projectId, branch, serviceName);
+    const url = `/projects/${p.projectId}/services/${svc.id}/source${q(branch)}`;
+    const { source } = patch
+        ? await api.request('PATCH', url, patch)
+        : await api.request('GET', url);
+    if (opts.json)
+        return printJson({ service: { id: svc.id, name: svc.name }, source });
+    info(patch ? `updated — ${repoLine(svc.name, source)}` : repoLine(svc.name, source));
+}
 export async function computeDisconnectRepo(serviceName, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();

package/dist/commands/mcp.js

@@ -8,7 +8,7 @@ import { existsSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { info } from '../util.js';
-import { MCP_SERVER_NAME, registerMcp, resolveMcpTarget } from './setup.js';
+import { MCP_SERVER_NAME, registerMcp, requireMcpRegistration, resolveMcpTarget } from './setup.js';
 export const MCP_AGENT_TARGETS = ['cursor', 'codex', 'opencode', 'copilot', 'factory-droid'];
 export function configPath(slug, home) {
     switch (slug) {
@@ -120,13 +120,20 @@ export async function installAgentConfigs(agent, home = os.homedir()) {
 }
 // `insta mcp install [--agent <slug>] [--mcp-token]` — claude-code goes through its registry CLI
 // (registerMcp); everything else is a config-file write. No --agent = claude-code + all detected.
-export async function mcpInstall(opts) {
+export async function mcpInstall(opts, register = registerMcp, installConfigs = installAgentConfigs) {
+    if (opts.mcpToken && opts.agent && opts.agent !== 'claude-code') {
+        throw new Error('--mcp-token supports Claude Code only; other clients use OAuth');
+    }
     if (!opts.agent || opts.agent === 'claude-code') {
-        await registerMcp(undefined, undefined, !!opts.mcpToken);
+        const status = await register(undefined, undefined, !!opts.mcpToken);
+        // Missing Claude is an optional discovery miss only for the default OAuth install. A
+        // targeted install, token request, or attempted-but-failed add must not report success.
+        if ((opts.agent || opts.mcpToken || status === 'failed') && !requireMcpRegistration(status))
+            return;
         if (opts.agent)
             return;
     }
-    const done = await installAgentConfigs(opts.agent);
+    const done = await installConfigs(opts.agent);
     if (done.length)
         info(`✓ MCP — configured for ${done.join(', ')} (restart those tools to pick it up)`);
     else if (opts.agent) { /* messages already printed */ }

package/dist/commands/setup.js

@@ -14,7 +14,7 @@ import { ApiClient } from '../api.js';
 import { setupProjectAgentSession } from '../agent.js';
 import { readPersistedGlobal, resolveEnv } from '../config.js';
 import { DEFAULT_ENV, ENVS, ENV_NAMES, envForApiUrl, envFromEnvVar, isEnvName, mcpServerName } from '../env.js';
-import { info, openUrl } from '../util.js';
+import { fail, info, openUrl } from '../util.js';
 import { isRunnableFile, resolveSpawnable } from '../spawn.js';
 import { loginDevice } from './auth.js';
 import { projectCreate, projectLink, slugifyName } from './project.js';
@@ -203,18 +203,16 @@ export async function resolveMcpTarget() {
     const { env, mcpUrl } = await resolveEnv();
     return { name: mcpServerName(env ?? DEFAULT_ENV), url: mcpUrl };
 }
-const defaultMinter = async () => {
-    try {
-        const api = await ApiClient.load();
-        if (!api.config.accessToken)
-            return null;
-        const { token } = await api.request('POST', '/tokens', { name: `mcp-${os.hostname()}` });
-        return token ?? null;
-    }
-    catch {
+export async function mintMcpToken(api) {
+    if (!api.config.accessToken)
         return null;
+    const result = await api.request('POST', '/tokens', { name: `mcp-${os.hostname()}` });
+    if (typeof result?.token !== 'string' || !result.token.trim()) {
+        throw new Error('MCP token creation did not return a token; registration was not written');
     }
-};
+    return result.token;
+}
+const defaultMinter = async () => mintMcpToken(await ApiClient.load());
 export async function registerMcp(run = defaultRunner, mint = defaultMinter, useToken = false, announce = true) {
     const { name, url } = await resolveMcpTarget();
     if (!(await run('claude', ['--version'])).ok)
@@ -241,10 +239,20 @@ export async function registerMcp(run = defaultRunner, mint = defaultMinter, use
     if (announce) {
         info(`✓ MCP — ${name} registered with Claude Code (\`claude mcp list\` to verify)`);
         if (!useToken)
-            info('  first use: run `/mcp` in Claude Code and authorize in the browser (headless machines: `insta setup agent --mcp-token`)');
+            info('  first use: run `/mcp` in Claude Code and authorize in the browser (--mcp-token requires token-creation permission)');
     }
     return 'new';
 }
+/** Callers decide when an optional probe becomes a required registration (after the interactive
+ *  login retry in setup). An OAuth registration for another client cannot satisfy --mcp-token. */
+export function requireMcpRegistration(status) {
+    if (status === 'new' || status === 'existing')
+        return true;
+    fail(status === 'no-claude'
+        ? 'Claude Code MCP registration incomplete: Claude Code is not available on PATH'
+        : 'Claude Code MCP registration incomplete; see the error above');
+    return false;
+}
 /** The environment `setup agent` should target, and whether the machine must be switched to it
  *  first. Pure — decides only; the caller performs the switch.
  *
@@ -409,7 +417,8 @@ export async function setupAgent(opts, run = defaultRunner, mint, installConfigs
     // Default into login on an interactive terminal (see shouldOfferLogin) BEFORE the MCP summary:
     // a --mcp-token registration needs the session to mint, so a post-login retry must land in the
     // same combined line instead of announcing Claude Code separately. Best-effort: a declined
-    // prompt or a failed browser flow leaves a completed setup plus the manual hint, never an error.
+    // prompt or a failed browser flow leaves the manual hint. Explicit --mcp-token still requires
+    // registration to finish; without that flag, login remains optional.
     const stored = await readStored();
     let loggedIn = !!(stored.accessToken || stored.user);
     if (shouldOfferLogin(!!opts.yes, loggedIn, loginFlow.stdinTty, loginFlow.stdoutTty)) {
@@ -417,15 +426,19 @@ export async function setupAgent(opts, run = defaultRunner, mint, installConfigs
             try {
                 await loginFlow.login();
                 loggedIn = true;
-                if (opts.mcpToken)
-                    claude = await registerMcp(run, mint, true, false);
             }
             catch (e) {
-                info(`  login did not complete (${e instanceof Error ? e.message : String(e)}) — no problem, setup itself is done.`);
+                info(`  login did not complete (${e instanceof Error ? e.message : String(e)})`);
                 info('  run `insta login` to try again — the sign-in link it prints works from a browser on any device.');
             }
+            // Keep token-creation errors outside the browser-login catch. A signed-in caller can be
+            // forbidden from minting; relabeling that as a login failure hides the real platform error.
+            if (opts.mcpToken && loggedIn)
+                claude = await registerMcp(run, mint, true, false);
         }
     }
+    if (opts.mcpToken && !requireMcpRegistration(claude))
+        return;
     // --project / --create: bind this directory to a project inside the SAME process. Never split
     // this back into `setup agent && insta project <cmd>` as one paste: no shell joiner survives
     // every Windows shell, and in shells without bracketed paste the queued second line is eaten
@@ -470,7 +483,7 @@ export async function setupAgent(opts, run = defaultRunner, mint, installConfigs
     const mcpOk = claude === 'new' || claude === 'existing' || others.length > 0;
     info(`${summarizeInstall(res.output ?? '')} — ready to use InstaCloud${mcpOk ? ' (CLI + skill + MCP; restart any open tools)' : ''}`);
     if (claude === 'new' && !opts.mcpToken) {
-        info('  Claude Code first use: run `/mcp` and authorize in the browser (headless machines: `insta setup agent --mcp-token`)');
+        info('  Claude Code first use: run `/mcp` and authorize in the browser (--mcp-token requires token-creation permission)');
     }
     // The user's next move: one concrete action, not a concept. The agents drive `insta` themselves
     // (project create/link, deploys, login via the device flow), so the human just asks for the

package/dist/commands/template.js

@@ -374,7 +374,9 @@ export async function templateDeploy(target, opts = {}, deps = {}) {
     const codeLabel = manifest?.code ?? target;
     if (!quiet)
         info(`deploying template ${codeLabel} to branch ${branchName} (${deploymentId})`);
-    const dep = await watchDeployment((id) => api.request('GET', `/template-deployments/${id}`), deploymentId, quiet ? () => { } : info, deps.wait);
+    // The poll route is keyed by deployment id, not project: name the project so agent mode signs
+    // with the project-bound session (a bootstrap session is rejected as "for a different project").
+    const dep = await watchDeployment((id) => api.request('GET', `/template-deployments/${id}`, undefined, { projectId: p.projectId }), deploymentId, quiet ? () => { } : info, deps.wait);
     if (opts.json)
         return printJson(source ? { source, ...dep } : dep);
     info(`template ${codeLabel} deployed to branch ${branchName}`);

package/dist/index.js

@@ -32,6 +32,7 @@ import * as govern from './commands/govern.js';
 import * as observe from './commands/observe.js';
 import * as obs from './commands/metrics.js';
 import { billing, billingUpgrade, billingPortal } from './commands/billing.js';
+import * as domainCmd from './commands/domain.js';
 import * as selfUpdate from './commands/upgrade.js';
 import * as feedbackCmd from './commands/feedback.js';
 function onError(e) {
@@ -107,7 +108,7 @@ const setupCmd = program.command('setup').description('Set up this machine for I
 setupCmd.command('agent').description('Install the insta CLI (if missing), the insta skill for all coding agents, and the MCP server — targets production; pass --env staging for the staging deployment')
     .option('-y, --yes', 'non-interactive')
     .option('--env <prod|staging>', 'deployment to set this machine up for (default: prod — switches and persists, like `insta env use`)')
-    .option('--mcp-token', 'register the MCP server with a minted insta_ API token instead of OAuth (headless machines / CI)')
+    .option('--mcp-token', 'register Claude Code with a minted insta_ API token instead of OAuth (requires login and token-creation permission)')
     .option('--project <id>', 'also link this directory to an existing project after setup (flows through login first if needed)')
     .option('--create [name]', 'also create a new project and link this directory after setup (default name: this directory; mutually exclusive with --project)')
     .action(guard((o) => setup.setupAgent(o)));
@@ -115,7 +116,7 @@ setupCmd.command('agent').description('Install the insta CLI (if missing), the i
 const mcpCmd = program.command('mcp').description('insta-cloud remote MCP server integration');
 mcpCmd.command('install').description('Register the remote MCP server with coding agents (default: Claude Code + all detected)')
     .option('--agent <slug>', 'one agent: claude-code, cursor, codex, opencode, copilot, factory-droid')
-    .option('--mcp-token', 'claude-code only: minted insta_ API token instead of OAuth (headless machines / CI)')
+    .option('--mcp-token', 'claude-code only: minted insta_ API token instead of OAuth (requires login and token-creation permission)')
     .action(guard((o) => mcp.mcpInstall(o)));
 // ---- org ----
 const orgCmd = program.command('org').description('Manage organizations');
@@ -252,16 +253,21 @@ const execCmd = compute.command('exec [service]').description("Run a one-shot co
 // new option cannot reach the CLI surface while the split still reads it as part of the command.
 for (const [flags, description] of computeCmd.EXEC_OPTIONS)
     execCmd.option(flags, description);
-compute.command('repo [service]').description('Show what a compute service deploys from: the image it runs, or the GitHub repository — owner/repo, the branch it builds, root directory, and whether pushes redeploy it')
+compute.command('repo [service]').description('Show what a compute service deploys from: the image it runs, or the GitHub repository — owner/repo, the branch it builds, root directory, which paths a push must change to redeploy it, and whether pushes redeploy it at all')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => githubCmd.computeRepo(service, o)));
 compute.command('connect-repo <owner/repo> [service]').description("Connect a GitHub repository to an EXISTING compute service: the repo is built (its Dockerfile, or nixpacks when there is none) and deployed into that service, and every later push to the tracked repository branch redeploys it. The repo must be reachable through the org's GitHub App installation — connect GitHub in the console first (Add Service → GitHub Repo) — or be public. Build and start commands come from detection and cannot be set. Connecting again replaces the service's current source")
     .option('--public', 'the repo is public and no GitHub App installation is needed (deploys are manual; pushes cannot redeploy)')
     .option('--root-dir <dir>', 'the directory of the repo to build (a monorepo with several deployable directories lists them and exits 1 without it)')
     .option('--repo-branch <name>', "the repository branch to build (default: the repo's default branch)")
     .option('--no-auto-deploy', 'do not rebuild on pushes; redeploy by connecting again or from the console')
+    .option('--watch-paths <patterns>', "only redeploy when a push changes a matching path — a comma-separated list of gitignore patterns relative to the REPOSITORY ROOT, not to --root-dir, e.g. 'apps/web/**,packages/ui/**' (quote them, or the shell expands the *)")
     .option('--port <n>', 'port the app listens on (default: detected)')
     .option('--branch <branch>', 'branch (default: current) — the environment the service is on')
     .option('--json').action(guard((ref, service, o) => githubCmd.computeConnectRepo(ref, service, o)));
+compute.command('watch-paths [service]').description("Show or change which paths make a push redeploy a compute service. No flag prints them. --set narrows to a comma-separated list of gitignore patterns matched against paths relative to the REPOSITORY ROOT (not to the service's root directory), so a monorepo push that touched nothing on the list leaves this service alone — unless GitHub cannot report what a push changed (a force-push, or a comparison of 300 or more files, where its list stops being complete), in which case it deploys rather than risk skipping a real change. --clear removes the filter: every push that deploys this service deploys it again. Neither rebuilds the service — this changes which pushes deploy, not what a deploy builds")
+    .option('--set <patterns>', "the patterns, comma-separated, e.g. 'apps/web/**,packages/ui/**' — quote them, or the shell expands the *; a leading ! excludes, under git's rule that a path cannot be re-included once an earlier pattern took its directory")
+    .option('--clear', 'remove the filter: every push that deploys this service deploys it again')
+    .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => githubCmd.computeWatchPaths(service, o)));
 compute.command('disconnect-repo [service]').description('Disconnect the GitHub repository from a compute service. The service keeps running its current image; pushes no longer deploy it, and its build history stays')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => githubCmd.computeDisconnectRepo(service, o)));
 compute.command('volume [service]').description("Show, attach, grow, or delete a compute service's persistent /data volume. No flag: print size, mount path, and the plan cap (any plan). --size on a volumeless service ATTACHES one (any plan at the default 10Gi, the free cap; larger is paid and plan-capped; the disk mounts at /data on the next deploy); on a volume-bearing one it grows (paid plans; grow-only — a provisioned disk cannot shrink). --delete DESTROYS the disk and ALL its data immediately (no detach, no undo; billing stops now, and suspend fast-wake + scale-out return). Billing is actual data stored — the size is a cap, not a price")
@@ -342,6 +348,32 @@ program.command('logs <target> [group]').description('Service logs (runtime by d
 program.command('usage').description('Usage for the current billing cycle by billing dimension (org by default; --proj for one project)')
     .option('--from <unix>').option('--to <unix>').option('--proj [id]', 'show one project (the linked one, or a given id) instead of the whole org').option('--json')
     .action(guard((o) => obs.usage(o)));
+// ---- domains bought through InstaCloud (BYO domains: `insta compute set-domain`) ----
+const dom = program.command('domain').description('Buy a domain through InstaCloud and attach it to a compute service (your own domain: `insta compute set-domain`)');
+dom.command('search <keyword>').description('Search purchasable names with prices (a label like "myapp" or a full name like "myapp.com")')
+    .option('--tlds <list>', 'comma-separated TLDs to include').option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((keyword, o) => domainCmd.domainSearch(keyword, o)));
+dom.command('buy <name>').description('Buy a domain and attach it to a branch compute service — pay at the printed Stripe Checkout link (gated: domain.purchase)')
+    .option('--years <n>', 'registration term in years (default 1)').option('--branch <b>').option('--group <g>', "compute service (default: the branch's sole compute service)")
+    .option('--contact-file <path>', 'registrant contact as JSON (default: the org contact from `insta domain contact set`)')
+    .option('--no-open', 'print the checkout URL instead of opening a browser').option('--json')
+    .action(guard((name, o) => domainCmd.domainBuy(name, o)));
+dom.command('attach <name>').description('Attach a bought domain whose service was deleted (or whose attach failed) to a compute service (gated: deploy)')
+    .option('--branch <b>').option('--group <g>', "compute service (default: the branch's sole compute service)").option('--json')
+    .action(guard((name, o) => domainCmd.domainAttach(name, o)));
+dom.command('list').description('Domains bought through InstaCloud in this project, with attach state per hostname').option('--json')
+    .action(guard((o) => domainCmd.domainList(o)));
+dom.command('status <name>').description("A bought domain's order and attach state").option('--json')
+    .action(guard((name, o) => domainCmd.domainStatus(name, o)));
+const domContact = dom.command('contact').description("Show the org's default registrant contact (the legal registrant of every domain bought with it)")
+    .option('--org <id>').option('--json').action(guard((o) => domainCmd.domainContactShow(o)));
+domContact.command('set').description('Set the org default registrant contact (admin) from flags or --contact-file <path>; --company-name makes that organization the legal registrant')
+    .option('--first-name <s>').option('--last-name <s>').option('--company-name <s>').option('--address1 <s>').option('--address2 <s>').option('--city <s>').option('--state <s>').option('--zip <s>')
+    .option('--country <cc>', 'ISO 3166-1 alpha-2, e.g. US').option('--email <s>').option('--phone <e164>', 'E.164, e.g. +14155550100')
+    .option('--contact-file <path>', 'JSON file with the contact fields').option('--org <id>').option('--json')
+    // `contact --org X set` parks --org on the GROUP (enablePositionalOptions); without this merge the
+    // wrong org's registrant contact is written, and that field is legal ownership.
+    .action(guard((o) => domainCmd.domainContactSet({ ...domContact.opts(), ...o })));
 const bill = program.command('billing').description('Current billing cycle overview (tier / used / included / overage / credits / forecast + per-dimension & per-project breakdown)')
     .option('--org <id>', 'target org (default: linked project\'s org)').option('--json')
     .action(guard((o) => billing(o)));

package/dist/telemetry.js

@@ -46,7 +46,7 @@ const SAFE_OPTIONS = {
     agent: oneOf(['claude-code', 'cursor', 'codex', 'opencode', 'copilot', 'factory-droid']),
     type: oneOf(TYPES), component: oneOf(COMPONENTS), severity: oneOf(SEVERITIES),
     status: oneOf(['pending', 'granted', 'denied', 'consumed']),
-    limit: NUMBER, step: NUMBER, since: NUMBER, port: NUMBER, memory: NUMBER, cpu: NUMBER, size: NUMBER, volume: NUMBER,
+    limit: NUMBER, step: NUMBER, since: NUMBER, port: NUMBER, memory: NUMBER, cpu: NUMBER, size: NUMBER, volume: NUMBER, years: NUMBER,
 };
 export function telemetryDisabled(env = process.env) {
     return !!(env.DO_NOT_TRACK || env.INSTA_NO_TELEMETRY);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.65",
+  "version": "0.0.67",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [