insta 0.0.66 → 0.0.68

package/README.md

@@ -220,6 +220,7 @@ build never reaches a production installer.
 | `insta run <cmd>` | Run a command with the branch bundle injected, nothing written to disk |
 | `insta deploy [dir]` | Deploy a source directory (built remotely) or `--image <url>` |
 | `insta compute` | `start` · `stop` · `suspend` · `status` · `set-domain` · `check-domain` · `remove-domain` |
+| `insta domain` | Buy a domain through InstaCloud: `search` · `buy` · `attach` · `list` · `status` · `contact` |
 | `insta db` | `url` (print the postgres DSN) · `connect` (psql session) · `limits` · `stats` · `always-on` · `volume` |
 | `insta regions` | Regions available for postgres and compute |
 | `insta manifest` | Agent-legible view of every branch and its URLs |

package/dist/commands/billing.js

@@ -2,7 +2,7 @@ import { ApiClient, requireProject } from '../api.js';
 import { die, info, openUrl, printJson } from '../util.js';
 import { cycleLine, dimensionLines } from './metrics.js';
 // Resolve the target org: explicit --org, else the linked project's org.
-async function resolveOrgId(opts) {
+export async function resolveOrgId(opts) {
     if (opts.org)
         return opts.org;
     return (await requireProject()).orgId;
@@ -108,7 +108,7 @@ export async function billingPortal(opts) {
 // "opening", not "opened": a launcher that starts and then fails reports it asynchronously,
 // so openUrl's true return is an attempt, not a confirmation (see util.ts) — and the URL is
 // already printed above for exactly that case.
-function presentUrl(url, label, open) {
+export function presentUrl(url, label, open) {
     info(label);
     info(`  ${url}`);
     if (open !== false && openUrl(url))

package/dist/commands/compute.js

@@ -262,11 +262,11 @@ export function domainConflictMessage(host, e, services, ctx = {}) {
 // Resolve branch + target service, so every domain verb names the service AND its region, and an
 // ambiguous project is refused with the list instead of the platform's `default` fallback picking
 // one silently.
-async function domainTarget(api, projectId, branch, host, group) {
+export async function domainTarget(api, projectId, branch, host, group) {
     const { services } = await api.request('GET', `/projects/${projectId}/services${q(branch)}`);
     return { target: resolveDomainTarget(services, host, group), services };
 }
-async function domainDeps(deps) {
+export async function domainDeps(deps) {
     if (deps)
         return deps;
     const [api, project] = [await ApiClient.load(), await requireProject()];

package/dist/commands/domain.js

@@ -0,0 +1,164 @@
+import { readFile } from 'node:fs/promises';
+import { ApiClient } from '../api.js';
+import { info, printJson, handleApproval, die } from '../util.js';
+import { presentUrl, resolveOrgId } from './billing.js';
+import { domainDeps, domainTarget } from './compute.js';
+const usd = (cents) => `$${(cents / 100).toFixed(2)}`;
+// --org wins; otherwise the linked project's org — the org verbs must not force a project link.
+async function orgDeps(opts, deps) {
+    if (deps)
+        return { api: deps.api, orgId: opts.org ?? deps.project.orgId };
+    return { api: await ApiClient.load(), orgId: await resolveOrgId(opts) };
+}
+export function searchLines(results) {
+    if (!results.length)
+        return ['no results'];
+    const w = Math.max(...results.map((r) => r.domainName.length));
+    return results.map((r) => r.purchasable
+        ? `  ${r.domainName.padEnd(w)}  ${usd(r.priceCents)}${r.renewalPriceCents !== undefined ? `  (renews ${usd(r.renewalPriceCents)}/yr)` : ''}`
+        : `  ${r.domainName.padEnd(w)}  unavailable${r.reason ? ` — ${r.reason}` : ''}`);
+}
+export async function domainSearch(keyword, opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const qs = new URLSearchParams({ q: keyword });
+    if (opts.tlds)
+        qs.set('tlds', opts.tlds);
+    const r = await api.request('GET', `/orgs/${orgId}/domains/search?${qs}`);
+    if (opts.json)
+        return printJson(r);
+    for (const line of searchLines(r.results))
+        info(line);
+    const buyable = r.results.find((x) => x.purchasable);
+    if (buyable)
+        info(`buy one: insta domain buy ${buyable.domainName}`);
+}
+const CONTACT_KEYS = ['firstName', 'lastName', 'companyName', 'address1', 'address2', 'city', 'state', 'zip', 'country', 'email', 'phone'];
+export function contactFromOpts(opts, file) {
+    if (file !== undefined)
+        return file;
+    const out = {};
+    for (const k of CONTACT_KEYS)
+        if (opts[k] !== undefined)
+            out[k] = opts[k];
+    return Object.keys(out).length ? out : undefined;
+}
+async function readContactFile(path) {
+    if (!path)
+        return undefined;
+    try {
+        return JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch (e) {
+        throw new Error(`cannot read ${path} as JSON: ${e.message}`);
+    }
+}
+function contactLines(c) {
+    if (!c)
+        return ['no registrant contact set — set one with: insta domain contact set --first-name … (or --contact-file contact.json)'];
+    return [
+        `${c.firstName} ${c.lastName}${c.companyName ? ` (${c.companyName} — the organization is the legal registrant)` : ''}`,
+        `${c.address1}${c.address2 ? `, ${c.address2}` : ''}, ${c.city}, ${c.state} ${c.zip}, ${c.country}`,
+        `${c.email}  ${c.phone}`,
+    ];
+}
+export async function domainContactShow(opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('GET', `/orgs/${orgId}/domains/contact`);
+    if (opts.json)
+        return printJson(r);
+    for (const line of contactLines(r.contact))
+        info(line);
+}
+export async function domainContactSet(opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const contact = contactFromOpts(opts, await readContactFile(opts.contactFile));
+    if (!contact)
+        die('pass the contact as flags (--first-name … --phone) or as --contact-file <contact.json>');
+    const r = await api.request('PUT', `/orgs/${orgId}/domains/contact`, contact);
+    if (opts.json)
+        return printJson(r);
+    info('registrant contact saved:');
+    for (const line of contactLines(r.contact))
+        info(`  ${line}`);
+}
+export async function domainBuy(name, opts, deps) {
+    const { api, project: p } = await domainDeps(deps);
+    const branch = opts.branch ?? p.branch;
+    const { target } = await domainTarget(api, p.projectId, branch, name, opts.group);
+    const contact = await readContactFile(opts.contactFile);
+    // JSON.stringify drops undefined but keeps NaN as null, which the platform rejects as a type
+    // error rather than a bad term — so a malformed --years is refused here, with the reason.
+    let years;
+    if (opts.years !== undefined) {
+        years = Number(opts.years);
+        if (!Number.isInteger(years))
+            die(`--years must be a whole number of years, not ${opts.years}`);
+    }
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/domains/orders`, { domainName: name, years, branch, group: target.name, contact });
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    const { order } = res.body;
+    info(`${order.domainName} — ${usd(order.priceCents)} for ${order.years} year${order.years === 1 ? '' : 's'}${order.renewalPriceCents !== null ? `, then ${usd(order.renewalPriceCents)}/yr` : ''}`);
+    info(`attaches to ${target.name}${order.branch ? ` (branch ${order.branch})` : ''} as ${order.domainName} and www.${order.domainName} once paid`);
+    presentUrl(order.checkoutUrl, 'Complete the payment in your browser:', opts.open);
+    info(`then: insta domain status ${order.domainName}`);
+}
+export async function domainAttach(name, opts, deps) {
+    const { api, project: p } = await domainDeps(deps);
+    const branch = opts.branch ?? p.branch;
+    const { target } = await domainTarget(api, p.projectId, branch, name, opts.group);
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/domains/${encodeURIComponent(name)}/attach`, { branch, group: target.name });
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    const d = res.body;
+    info(`${d.domainName} will attach to ${target.name} as ${d.hostnames.map((h) => h.hostname).join(' and ')}`);
+    info(`then: insta domain status ${d.domainName}`);
+}
+// ---- list / status ----
+function domainLines(d) {
+    const out = [`${d.domainName}  ${d.status}${d.service ? `  → ${d.service}` : ''}${d.expiresAt ? `  (expires ${d.expiresAt.slice(0, 10)}${d.autorenew ? ', auto-renews' : ''})` : ''}`];
+    if (d.status === 'detached' || d.status === 'attach_failed')
+        out.push(`  attach it again: insta domain attach ${d.domainName}`);
+    const w = Math.max(0, ...d.hostnames.map((x) => x.hostname.length));
+    for (const h of d.hostnames)
+        out.push(`  ${h.hostname.padEnd(w)}  ${h.state}${h.reason ? ` — ${h.reason}` : ''}`);
+    return out;
+}
+function orderStatusLines(o) {
+    const out = [`order ${o.id}: ${o.domainName} — ${o.status}${o.failedReason ? ` — ${o.failedReason}` : ''}`];
+    if (o.status === 'canceled')
+        out.push(`  the checkout closed without payment — order again: insta domain buy ${o.domainName}`);
+    return out;
+}
+export async function domainList(opts, deps) {
+    const { api, project: p } = await domainDeps(deps);
+    const r = await api.request('GET', `/projects/${p.projectId}/domains`);
+    if (opts.json)
+        return printJson(r);
+    if (!r.items.length)
+        return info('no domains bought through InstaCloud in this project (search: insta domain search <keyword>)');
+    for (const d of r.items)
+        for (const line of domainLines(d))
+            info(line);
+}
+export async function domainStatus(name, opts, deps) {
+    const { api, project: p } = await domainDeps(deps);
+    const host = name.trim().toLowerCase();
+    const [{ items: domains }, { items: orders }] = await Promise.all([
+        api.request('GET', `/projects/${p.projectId}/domains`),
+        api.request('GET', `/projects/${p.projectId}/domains/orders`),
+    ]);
+    const domain = domains.find((d) => d.domainName === host) ?? null;
+    const order = orders.find((o) => o.domainName === host) ?? null;
+    if (!domain && !order)
+        die(`${host} was not bought through this project`);
+    if (opts.json)
+        return printJson({ domain, order });
+    for (const line of domain ? domainLines(domain) : orderStatusLines(order))
+        info(line);
+}
+//# sourceMappingURL=domain.js.map

package/dist/commands/github.js

@@ -1,4 +1,5 @@
-import { ApiClient, requireProject } from '../api.js';
+import { ApiClient, ApiError, requireProject } from '../api.js';
+import { agentMode } from '../agent.js';
 import { info, printJson } from '../util.js';
 import { resolveSoleService, parsePort, q } from './services.js';
 export function parseRepoRef(raw) {
@@ -74,21 +75,95 @@ export function repoLine(serviceName, s) {
             : `; watch paths ${s.watch_paths.join(', ')} are stored but cannot apply`;
     return `compute ${serviceName}: deploys from ${s.owner}/${s.repo}@${s.branch}${where} — ${how}${only}`;
 }
-export async function findInstalledRepo(api, orgId, ref) {
+const sleepSeconds = (s) => new Promise((r) => setTimeout(r, s * 1000));
+// Node fires a timer of ~1ms for anything it cannot represent — a huge delay overflows, a negative one
+// is clamped — so both ends are pinned or the wait becomes a hot poll of GitHub through us.
+const pollDelay = (s) => Math.min(Math.max(s, 1), 60);
+// GitHub shows the person a code to type; the platform holds the device code and finishes the exchange,
+// so nothing secret passes through the CLI.
+export async function authorizeTerminal(api, orgId, wait = sleepSeconds) {
+    const start = await api.request('POST', `/orgs/${encodeURIComponent(orgId)}/github/device`, {});
+    const deadline = Date.parse(start.expiresAt);
+    // A NaN deadline makes every comparison false, which reads as an instant expiry — or, inverted, as a
+    // loop with no way out. Fail on it rather than guess which.
+    if (!Number.isFinite(deadline))
+        throw new Error('malformed device authorization response (missing expiresAt) — is the platform up to date?');
+    // stderr, not stdout: --json must stay one parseable document.
+    const say = (line) => process.stderr.write(line + '\n');
+    say('this terminal is not authorized with GitHub yet — authorize it once:');
+    say(`  open ${start.verificationUri} and enter the code ${start.userCode}`);
+    say('waiting for you to confirm… (ctrl-c to abort)');
+    const stopAt = Math.min(deadline, Date.now() + 3600_000); // no device code sensibly outlives an hour
+    const asked = Number(start.interval);
+    let interval = pollDelay(Number.isFinite(asked) && asked > 0 ? asked : 5);
+    while (Date.now() < stopAt) {
+        await wait(interval);
+        let answer;
+        try {
+            answer = await api.request('POST', `/orgs/${encodeURIComponent(orgId)}/github/device/poll`, { state: start.state });
+        }
+        catch (e) {
+            // A dropped link, or the per-IP limiter this cadence already tripped on the login flow, must not
+            // end an authorization the person may be one click from finishing.
+            if (e instanceof ApiError && e.status !== 429)
+                throw e;
+            interval = pollDelay(interval + 5);
+            continue;
+        }
+        if (!answer.pending) {
+            if (!answer.repos)
+                throw new Error('the GitHub authorization completed but returned no repositories — is the platform up to date?');
+            return answer.repos;
+        }
+        // GitHub asking for more room between polls, relayed by the platform; ignoring it gets us limited.
+        interval = pollDelay(interval + Math.max(Number(answer.slowDownBy) || 0, 0));
+    }
+    throw new Error('the GitHub authorization expired before it was confirmed — run the command again');
+}
+// Only the platform's own "you have no usable authorization" may send the person to GitHub: any other
+// failure is real, and a device flow cannot fix it.
+const needsAuthorization = (e) => e instanceof ApiError && e.status === 400 && /not linked|no longer accepted/i.test(e.message);
+// The repositories THIS caller's GitHub account can reach — the same question the platform asks again
+// when the connect lands, so a repo missing here would be refused there anyway.
+// Someone has to read the code and type it at GitHub. A terminal qualifies, and so does agent mode —
+// an agent relays the URL to the person driving it — but --json and a bare pipe have no reader, and a
+// ten-minute wait there is a stall where the old code failed with something to act on.
+export function canAuthorizeHere(opts = {}) {
+    if (opts.json)
+        return false;
+    return !!agentMode() || !!process.stderr.isTTY;
+}
+export async function findCallerRepo(api, orgId, ref, authorize = authorizeTerminal, canAuthorize = canAuthorizeHere()) {
     if (!orgId)
         throw new Error('this directory is linked without an org — set INSTA_ORG_ID alongside INSTA_PROJECT_ID, or link it with `insta project link`');
-    const { installations = [] } = await api.request('GET', `/github/installations?orgId=${encodeURIComponent(orgId)}`);
-    if (installations.length === 0) {
-        throw new Error('no GitHub App installation for this org — connect GitHub in the console first (Add Service → GitHub Repo → Connect GitHub), or pass --public for a public repository');
+    let repos;
+    try {
+        repos = (await api.request('POST', `/orgs/${encodeURIComponent(orgId)}/github/repos`, {})).repos ?? [];
     }
-    for (const inst of installations) {
-        const { repos = [] } = await api.request('GET', `/github/installations/${encodeURIComponent(inst.installation_id)}/repos?orgId=${encodeURIComponent(orgId)}`);
-        const hit = repos.find((r) => r.owner.toLowerCase() === ref.owner.toLowerCase() && r.repo.toLowerCase() === ref.repo.toLowerCase());
-        if (hit)
-            return { installationId: Number(inst.installation_id), repoId: hit.id };
+    catch (e) {
+        // Two 403s carry an action; a third kind would be guessed at, so it is rethrown as the platform put it.
+        if (e instanceof ApiError && e.status === 403 && /unclassified_agent_action/.test(e.message)) {
+            throw new Error('this backend does not let an agent authorize GitHub yet — connect the repository from the console, or pass --public for a public repository');
+        }
+        if (e instanceof ApiError && e.status === 403 && /requires admin/i.test(e.message)) {
+            throw new Error('connecting a repository needs the org admin role — ask an admin to connect it, or pass --public for a public repository');
+        }
+        if (!needsAuthorization(e))
+            throw e;
+        if (!canAuthorize) {
+            throw new Error('this GitHub account is not authorized for InstaCloud yet, and nothing here can read the code GitHub shows — run `insta compute connect-repo` from a terminal, connect the repository from the console, or pass --public for a public repository');
+        }
+        repos = await authorize(api, orgId);
     }
-    const accounts = installations.map((i) => i.account_login ?? i.installation_id).join(', ');
-    throw new Error(`${ref.owner}/${ref.repo} is not visible to the org's GitHub App installation (installed on: ${accounts}) — grant the App access to it in the console (Configure GitHub app), or pass --public for a public repository`);
+    const whole = (n) => n !== null && n !== '' && Number.isInteger(Number(n)) && Number(n) > 0;
+    const hit = repos.find((r) => r.owner.toLowerCase() === ref.owner.toLowerCase() && r.repo.toLowerCase() === ref.repo.toLowerCase());
+    if (hit && whole(hit.installationId) && whole(hit.id))
+        return { installationId: Number(hit.installationId), repoId: Number(hit.id) };
+    if (hit)
+        throw new Error(`${ref.owner}/${ref.repo} came back without an installation to build it through — reconnect GitHub in the console, or pass --public for a public repository`);
+    if (repos.length === 0)
+        throw new Error('the InstaCloud GitHub App reaches none of your repositories — install it on the account that owns this one (console → Add Service → GitHub Repo → Connect GitHub), or pass --public for a public repository');
+    throw new Error(`${ref.owner}/${ref.repo} is not one your GitHub account can reach through the App — grant the App access to it on GitHub, or pass --public for a public repository`);
 }
 async function targetService(api, projectId, branch, serviceName) {
     const { services } = await api.request('GET', `/projects/${projectId}/services${q(branch)}`);
@@ -112,7 +187,7 @@ export async function computeConnectRepo(rawRef, serviceName, opts) {
     const svc = await targetService(api, p.projectId, opts.branch ?? p.branch, serviceName);
     const src = opts.public
         ? { source: 'public', ...ref }
-        : { source: 'app', ...(await findInstalledRepo(api, p.orgId, ref)), ...ref };
+        : { source: 'app', ...(await findCallerRepo(api, p.orgId, ref, authorizeTerminal, canAuthorizeHere(opts))), ...ref };
     // Detection must scan the branch that will be built: the build refuses commands that differ from what it detects there.
     const detected = await api.request('POST', `/projects/${p.projectId}/github/detect`, { ...src, ...(opts.repoBranch ? { ref: opts.repoBranch } : {}) });
     const candidate = pickCandidate(detected.services, opts.rootDir);

package/dist/commands/mcp.js

@@ -8,7 +8,7 @@ import { existsSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { info } from '../util.js';
-import { MCP_SERVER_NAME, registerMcp, resolveMcpTarget } from './setup.js';
+import { MCP_SERVER_NAME, registerMcp, requireMcpRegistration, resolveMcpTarget } from './setup.js';
 export const MCP_AGENT_TARGETS = ['cursor', 'codex', 'opencode', 'copilot', 'factory-droid'];
 export function configPath(slug, home) {
     switch (slug) {
@@ -120,13 +120,20 @@ export async function installAgentConfigs(agent, home = os.homedir()) {
 }
 // `insta mcp install [--agent <slug>] [--mcp-token]` — claude-code goes through its registry CLI
 // (registerMcp); everything else is a config-file write. No --agent = claude-code + all detected.
-export async function mcpInstall(opts) {
+export async function mcpInstall(opts, register = registerMcp, installConfigs = installAgentConfigs) {
+    if (opts.mcpToken && opts.agent && opts.agent !== 'claude-code') {
+        throw new Error('--mcp-token supports Claude Code only; other clients use OAuth');
+    }
     if (!opts.agent || opts.agent === 'claude-code') {
-        await registerMcp(undefined, undefined, !!opts.mcpToken);
+        const status = await register(undefined, undefined, !!opts.mcpToken);
+        // Missing Claude is an optional discovery miss only for the default OAuth install. A
+        // targeted install, token request, or attempted-but-failed add must not report success.
+        if ((opts.agent || opts.mcpToken || status === 'failed') && !requireMcpRegistration(status))
+            return;
         if (opts.agent)
             return;
     }
-    const done = await installAgentConfigs(opts.agent);
+    const done = await installConfigs(opts.agent);
     if (done.length)
         info(`✓ MCP — configured for ${done.join(', ')} (restart those tools to pick it up)`);
     else if (opts.agent) { /* messages already printed */ }

package/dist/commands/setup.js

@@ -14,7 +14,7 @@ import { ApiClient } from '../api.js';
 import { setupProjectAgentSession } from '../agent.js';
 import { readPersistedGlobal, resolveEnv } from '../config.js';
 import { DEFAULT_ENV, ENVS, ENV_NAMES, envForApiUrl, envFromEnvVar, isEnvName, mcpServerName } from '../env.js';
-import { info, openUrl } from '../util.js';
+import { fail, info, openUrl } from '../util.js';
 import { isRunnableFile, resolveSpawnable } from '../spawn.js';
 import { loginDevice } from './auth.js';
 import { projectCreate, projectLink, slugifyName } from './project.js';
@@ -203,18 +203,16 @@ export async function resolveMcpTarget() {
     const { env, mcpUrl } = await resolveEnv();
     return { name: mcpServerName(env ?? DEFAULT_ENV), url: mcpUrl };
 }
-const defaultMinter = async () => {
-    try {
-        const api = await ApiClient.load();
-        if (!api.config.accessToken)
-            return null;
-        const { token } = await api.request('POST', '/tokens', { name: `mcp-${os.hostname()}` });
-        return token ?? null;
-    }
-    catch {
+export async function mintMcpToken(api) {
+    if (!api.config.accessToken)
         return null;
+    const result = await api.request('POST', '/tokens', { name: `mcp-${os.hostname()}` });
+    if (typeof result?.token !== 'string' || !result.token.trim()) {
+        throw new Error('MCP token creation did not return a token; registration was not written');
     }
-};
+    return result.token;
+}
+const defaultMinter = async () => mintMcpToken(await ApiClient.load());
 export async function registerMcp(run = defaultRunner, mint = defaultMinter, useToken = false, announce = true) {
     const { name, url } = await resolveMcpTarget();
     if (!(await run('claude', ['--version'])).ok)
@@ -241,10 +239,20 @@ export async function registerMcp(run = defaultRunner, mint = defaultMinter, use
     if (announce) {
         info(`✓ MCP — ${name} registered with Claude Code (\`claude mcp list\` to verify)`);
         if (!useToken)
-            info('  first use: run `/mcp` in Claude Code and authorize in the browser (headless machines: `insta setup agent --mcp-token`)');
+            info('  first use: run `/mcp` in Claude Code and authorize in the browser (--mcp-token requires token-creation permission)');
     }
     return 'new';
 }
+/** Callers decide when an optional probe becomes a required registration (after the interactive
+ *  login retry in setup). An OAuth registration for another client cannot satisfy --mcp-token. */
+export function requireMcpRegistration(status) {
+    if (status === 'new' || status === 'existing')
+        return true;
+    fail(status === 'no-claude'
+        ? 'Claude Code MCP registration incomplete: Claude Code is not available on PATH'
+        : 'Claude Code MCP registration incomplete; see the error above');
+    return false;
+}
 /** The environment `setup agent` should target, and whether the machine must be switched to it
  *  first. Pure — decides only; the caller performs the switch.
  *
@@ -409,7 +417,8 @@ export async function setupAgent(opts, run = defaultRunner, mint, installConfigs
     // Default into login on an interactive terminal (see shouldOfferLogin) BEFORE the MCP summary:
     // a --mcp-token registration needs the session to mint, so a post-login retry must land in the
     // same combined line instead of announcing Claude Code separately. Best-effort: a declined
-    // prompt or a failed browser flow leaves a completed setup plus the manual hint, never an error.
+    // prompt or a failed browser flow leaves the manual hint. Explicit --mcp-token still requires
+    // registration to finish; without that flag, login remains optional.
     const stored = await readStored();
     let loggedIn = !!(stored.accessToken || stored.user);
     if (shouldOfferLogin(!!opts.yes, loggedIn, loginFlow.stdinTty, loginFlow.stdoutTty)) {
@@ -417,15 +426,19 @@ export async function setupAgent(opts, run = defaultRunner, mint, installConfigs
             try {
                 await loginFlow.login();
                 loggedIn = true;
-                if (opts.mcpToken)
-                    claude = await registerMcp(run, mint, true, false);
             }
             catch (e) {
-                info(`  login did not complete (${e instanceof Error ? e.message : String(e)}) — no problem, setup itself is done.`);
+                info(`  login did not complete (${e instanceof Error ? e.message : String(e)})`);
                 info('  run `insta login` to try again — the sign-in link it prints works from a browser on any device.');
             }
+            // Keep token-creation errors outside the browser-login catch. A signed-in caller can be
+            // forbidden from minting; relabeling that as a login failure hides the real platform error.
+            if (opts.mcpToken && loggedIn)
+                claude = await registerMcp(run, mint, true, false);
         }
     }
+    if (opts.mcpToken && !requireMcpRegistration(claude))
+        return;
     // --project / --create: bind this directory to a project inside the SAME process. Never split
     // this back into `setup agent && insta project <cmd>` as one paste: no shell joiner survives
     // every Windows shell, and in shells without bracketed paste the queued second line is eaten
@@ -470,7 +483,7 @@ export async function setupAgent(opts, run = defaultRunner, mint, installConfigs
     const mcpOk = claude === 'new' || claude === 'existing' || others.length > 0;
     info(`${summarizeInstall(res.output ?? '')} — ready to use InstaCloud${mcpOk ? ' (CLI + skill + MCP; restart any open tools)' : ''}`);
     if (claude === 'new' && !opts.mcpToken) {
-        info('  Claude Code first use: run `/mcp` and authorize in the browser (headless machines: `insta setup agent --mcp-token`)');
+        info('  Claude Code first use: run `/mcp` and authorize in the browser (--mcp-token requires token-creation permission)');
     }
     // The user's next move: one concrete action, not a concept. The agents drive `insta` themselves
     // (project create/link, deploys, login via the device flow), so the human just asks for the

package/dist/index.js

@@ -32,6 +32,7 @@ import * as govern from './commands/govern.js';
 import * as observe from './commands/observe.js';
 import * as obs from './commands/metrics.js';
 import { billing, billingUpgrade, billingPortal } from './commands/billing.js';
+import * as domainCmd from './commands/domain.js';
 import * as selfUpdate from './commands/upgrade.js';
 import * as feedbackCmd from './commands/feedback.js';
 function onError(e) {
@@ -107,7 +108,7 @@ const setupCmd = program.command('setup').description('Set up this machine for I
 setupCmd.command('agent').description('Install the insta CLI (if missing), the insta skill for all coding agents, and the MCP server — targets production; pass --env staging for the staging deployment')
     .option('-y, --yes', 'non-interactive')
     .option('--env <prod|staging>', 'deployment to set this machine up for (default: prod — switches and persists, like `insta env use`)')
-    .option('--mcp-token', 'register the MCP server with a minted insta_ API token instead of OAuth (headless machines / CI)')
+    .option('--mcp-token', 'register Claude Code with a minted insta_ API token instead of OAuth (requires login and token-creation permission)')
     .option('--project <id>', 'also link this directory to an existing project after setup (flows through login first if needed)')
     .option('--create [name]', 'also create a new project and link this directory after setup (default name: this directory; mutually exclusive with --project)')
     .action(guard((o) => setup.setupAgent(o)));
@@ -115,7 +116,7 @@ setupCmd.command('agent').description('Install the insta CLI (if missing), the i
 const mcpCmd = program.command('mcp').description('insta-cloud remote MCP server integration');
 mcpCmd.command('install').description('Register the remote MCP server with coding agents (default: Claude Code + all detected)')
     .option('--agent <slug>', 'one agent: claude-code, cursor, codex, opencode, copilot, factory-droid')
-    .option('--mcp-token', 'claude-code only: minted insta_ API token instead of OAuth (headless machines / CI)')
+    .option('--mcp-token', 'claude-code only: minted insta_ API token instead of OAuth (requires login and token-creation permission)')
     .action(guard((o) => mcp.mcpInstall(o)));
 // ---- org ----
 const orgCmd = program.command('org').description('Manage organizations');
@@ -254,7 +255,7 @@ for (const [flags, description] of computeCmd.EXEC_OPTIONS)
     execCmd.option(flags, description);
 compute.command('repo [service]').description('Show what a compute service deploys from: the image it runs, or the GitHub repository — owner/repo, the branch it builds, root directory, which paths a push must change to redeploy it, and whether pushes redeploy it at all')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => githubCmd.computeRepo(service, o)));
-compute.command('connect-repo <owner/repo> [service]').description("Connect a GitHub repository to an EXISTING compute service: the repo is built (its Dockerfile, or nixpacks when there is none) and deployed into that service, and every later push to the tracked repository branch redeploys it. The repo must be reachable through the org's GitHub App installation — connect GitHub in the console first (Add Service → GitHub Repo) — or be public. Build and start commands come from detection and cannot be set. Connecting again replaces the service's current source")
+compute.command('connect-repo <owner/repo> [service]').description("Connect a GitHub repository to an EXISTING compute service: the repo is built (its Dockerfile, or nixpacks when there is none) and deployed into that service, and every later push to the tracked repository branch redeploys it. The repo must be one your own GitHub account can reach through the InstaCloud App, or be public; the first connect from a terminal prints a GitHub URL and a code to authorize it once. Build and start commands come from detection and cannot be set. Connecting again replaces the service's current source")
     .option('--public', 'the repo is public and no GitHub App installation is needed (deploys are manual; pushes cannot redeploy)')
     .option('--root-dir <dir>', 'the directory of the repo to build (a monorepo with several deployable directories lists them and exits 1 without it)')
     .option('--repo-branch <name>', "the repository branch to build (default: the repo's default branch)")
@@ -347,6 +348,32 @@ program.command('logs <target> [group]').description('Service logs (runtime by d
 program.command('usage').description('Usage for the current billing cycle by billing dimension (org by default; --proj for one project)')
     .option('--from <unix>').option('--to <unix>').option('--proj [id]', 'show one project (the linked one, or a given id) instead of the whole org').option('--json')
     .action(guard((o) => obs.usage(o)));
+// ---- domains bought through InstaCloud (BYO domains: `insta compute set-domain`) ----
+const dom = program.command('domain').description('Buy a domain through InstaCloud and attach it to a compute service (your own domain: `insta compute set-domain`)');
+dom.command('search <keyword>').description('Search purchasable names with prices (a label like "myapp" or a full name like "myapp.com")')
+    .option('--tlds <list>', 'comma-separated TLDs to include').option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((keyword, o) => domainCmd.domainSearch(keyword, o)));
+dom.command('buy <name>').description('Buy a domain and attach it to a branch compute service — pay at the printed Stripe Checkout link (gated: domain.purchase)')
+    .option('--years <n>', 'registration term in years (default 1)').option('--branch <b>').option('--group <g>', "compute service (default: the branch's sole compute service)")
+    .option('--contact-file <path>', 'registrant contact as JSON (default: the org contact from `insta domain contact set`)')
+    .option('--no-open', 'print the checkout URL instead of opening a browser').option('--json')
+    .action(guard((name, o) => domainCmd.domainBuy(name, o)));
+dom.command('attach <name>').description('Attach a bought domain whose service was deleted (or whose attach failed) to a compute service (gated: deploy)')
+    .option('--branch <b>').option('--group <g>', "compute service (default: the branch's sole compute service)").option('--json')
+    .action(guard((name, o) => domainCmd.domainAttach(name, o)));
+dom.command('list').description('Domains bought through InstaCloud in this project, with attach state per hostname').option('--json')
+    .action(guard((o) => domainCmd.domainList(o)));
+dom.command('status <name>').description("A bought domain's order and attach state").option('--json')
+    .action(guard((name, o) => domainCmd.domainStatus(name, o)));
+const domContact = dom.command('contact').description("Show the org's default registrant contact (the legal registrant of every domain bought with it)")
+    .option('--org <id>').option('--json').action(guard((o) => domainCmd.domainContactShow(o)));
+domContact.command('set').description('Set the org default registrant contact (admin) from flags or --contact-file <path>; --company-name makes that organization the legal registrant')
+    .option('--first-name <s>').option('--last-name <s>').option('--company-name <s>').option('--address1 <s>').option('--address2 <s>').option('--city <s>').option('--state <s>').option('--zip <s>')
+    .option('--country <cc>', 'ISO 3166-1 alpha-2, e.g. US').option('--email <s>').option('--phone <e164>', 'E.164, e.g. +14155550100')
+    .option('--contact-file <path>', 'JSON file with the contact fields').option('--org <id>').option('--json')
+    // `contact --org X set` parks --org on the GROUP (enablePositionalOptions); without this merge the
+    // wrong org's registrant contact is written, and that field is legal ownership.
+    .action(guard((o) => domainCmd.domainContactSet({ ...domContact.opts(), ...o })));
 const bill = program.command('billing').description('Current billing cycle overview (tier / used / included / overage / credits / forecast + per-dimension & per-project breakdown)')
     .option('--org <id>', 'target org (default: linked project\'s org)').option('--json')
     .action(guard((o) => billing(o)));

package/dist/telemetry.js

@@ -46,7 +46,7 @@ const SAFE_OPTIONS = {
     agent: oneOf(['claude-code', 'cursor', 'codex', 'opencode', 'copilot', 'factory-droid']),
     type: oneOf(TYPES), component: oneOf(COMPONENTS), severity: oneOf(SEVERITIES),
     status: oneOf(['pending', 'granted', 'denied', 'consumed']),
-    limit: NUMBER, step: NUMBER, since: NUMBER, port: NUMBER, memory: NUMBER, cpu: NUMBER, size: NUMBER, volume: NUMBER,
+    limit: NUMBER, step: NUMBER, since: NUMBER, port: NUMBER, memory: NUMBER, cpu: NUMBER, size: NUMBER, volume: NUMBER, years: NUMBER,
 };
 export function telemetryDisabled(env = process.env) {
     return !!(env.DO_NOT_TRACK || env.INSTA_NO_TELEMETRY);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.66",
+  "version": "0.0.68",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [