insta 0.0.67 → 0.0.68

package/dist/commands/github.js

@@ -1,4 +1,5 @@
-import { ApiClient, requireProject } from '../api.js';
+import { ApiClient, ApiError, requireProject } from '../api.js';
+import { agentMode } from '../agent.js';
 import { info, printJson } from '../util.js';
 import { resolveSoleService, parsePort, q } from './services.js';
 export function parseRepoRef(raw) {
@@ -74,21 +75,95 @@ export function repoLine(serviceName, s) {
             : `; watch paths ${s.watch_paths.join(', ')} are stored but cannot apply`;
     return `compute ${serviceName}: deploys from ${s.owner}/${s.repo}@${s.branch}${where} — ${how}${only}`;
 }
-export async function findInstalledRepo(api, orgId, ref) {
+const sleepSeconds = (s) => new Promise((r) => setTimeout(r, s * 1000));
+// Node fires a timer of ~1ms for anything it cannot represent — a huge delay overflows, a negative one
+// is clamped — so both ends are pinned or the wait becomes a hot poll of GitHub through us.
+const pollDelay = (s) => Math.min(Math.max(s, 1), 60);
+// GitHub shows the person a code to type; the platform holds the device code and finishes the exchange,
+// so nothing secret passes through the CLI.
+export async function authorizeTerminal(api, orgId, wait = sleepSeconds) {
+    const start = await api.request('POST', `/orgs/${encodeURIComponent(orgId)}/github/device`, {});
+    const deadline = Date.parse(start.expiresAt);
+    // A NaN deadline makes every comparison false, which reads as an instant expiry — or, inverted, as a
+    // loop with no way out. Fail on it rather than guess which.
+    if (!Number.isFinite(deadline))
+        throw new Error('malformed device authorization response (missing expiresAt) — is the platform up to date?');
+    // stderr, not stdout: --json must stay one parseable document.
+    const say = (line) => process.stderr.write(line + '\n');
+    say('this terminal is not authorized with GitHub yet — authorize it once:');
+    say(`  open ${start.verificationUri} and enter the code ${start.userCode}`);
+    say('waiting for you to confirm… (ctrl-c to abort)');
+    const stopAt = Math.min(deadline, Date.now() + 3600_000); // no device code sensibly outlives an hour
+    const asked = Number(start.interval);
+    let interval = pollDelay(Number.isFinite(asked) && asked > 0 ? asked : 5);
+    while (Date.now() < stopAt) {
+        await wait(interval);
+        let answer;
+        try {
+            answer = await api.request('POST', `/orgs/${encodeURIComponent(orgId)}/github/device/poll`, { state: start.state });
+        }
+        catch (e) {
+            // A dropped link, or the per-IP limiter this cadence already tripped on the login flow, must not
+            // end an authorization the person may be one click from finishing.
+            if (e instanceof ApiError && e.status !== 429)
+                throw e;
+            interval = pollDelay(interval + 5);
+            continue;
+        }
+        if (!answer.pending) {
+            if (!answer.repos)
+                throw new Error('the GitHub authorization completed but returned no repositories — is the platform up to date?');
+            return answer.repos;
+        }
+        // GitHub asking for more room between polls, relayed by the platform; ignoring it gets us limited.
+        interval = pollDelay(interval + Math.max(Number(answer.slowDownBy) || 0, 0));
+    }
+    throw new Error('the GitHub authorization expired before it was confirmed — run the command again');
+}
+// Only the platform's own "you have no usable authorization" may send the person to GitHub: any other
+// failure is real, and a device flow cannot fix it.
+const needsAuthorization = (e) => e instanceof ApiError && e.status === 400 && /not linked|no longer accepted/i.test(e.message);
+// The repositories THIS caller's GitHub account can reach — the same question the platform asks again
+// when the connect lands, so a repo missing here would be refused there anyway.
+// Someone has to read the code and type it at GitHub. A terminal qualifies, and so does agent mode —
+// an agent relays the URL to the person driving it — but --json and a bare pipe have no reader, and a
+// ten-minute wait there is a stall where the old code failed with something to act on.
+export function canAuthorizeHere(opts = {}) {
+    if (opts.json)
+        return false;
+    return !!agentMode() || !!process.stderr.isTTY;
+}
+export async function findCallerRepo(api, orgId, ref, authorize = authorizeTerminal, canAuthorize = canAuthorizeHere()) {
     if (!orgId)
         throw new Error('this directory is linked without an org — set INSTA_ORG_ID alongside INSTA_PROJECT_ID, or link it with `insta project link`');
-    const { installations = [] } = await api.request('GET', `/github/installations?orgId=${encodeURIComponent(orgId)}`);
-    if (installations.length === 0) {
-        throw new Error('no GitHub App installation for this org — connect GitHub in the console first (Add Service → GitHub Repo → Connect GitHub), or pass --public for a public repository');
+    let repos;
+    try {
+        repos = (await api.request('POST', `/orgs/${encodeURIComponent(orgId)}/github/repos`, {})).repos ?? [];
     }
-    for (const inst of installations) {
-        const { repos = [] } = await api.request('GET', `/github/installations/${encodeURIComponent(inst.installation_id)}/repos?orgId=${encodeURIComponent(orgId)}`);
-        const hit = repos.find((r) => r.owner.toLowerCase() === ref.owner.toLowerCase() && r.repo.toLowerCase() === ref.repo.toLowerCase());
-        if (hit)
-            return { installationId: Number(inst.installation_id), repoId: hit.id };
+    catch (e) {
+        // Two 403s carry an action; a third kind would be guessed at, so it is rethrown as the platform put it.
+        if (e instanceof ApiError && e.status === 403 && /unclassified_agent_action/.test(e.message)) {
+            throw new Error('this backend does not let an agent authorize GitHub yet — connect the repository from the console, or pass --public for a public repository');
+        }
+        if (e instanceof ApiError && e.status === 403 && /requires admin/i.test(e.message)) {
+            throw new Error('connecting a repository needs the org admin role — ask an admin to connect it, or pass --public for a public repository');
+        }
+        if (!needsAuthorization(e))
+            throw e;
+        if (!canAuthorize) {
+            throw new Error('this GitHub account is not authorized for InstaCloud yet, and nothing here can read the code GitHub shows — run `insta compute connect-repo` from a terminal, connect the repository from the console, or pass --public for a public repository');
+        }
+        repos = await authorize(api, orgId);
     }
-    const accounts = installations.map((i) => i.account_login ?? i.installation_id).join(', ');
-    throw new Error(`${ref.owner}/${ref.repo} is not visible to the org's GitHub App installation (installed on: ${accounts}) — grant the App access to it in the console (Configure GitHub app), or pass --public for a public repository`);
+    const whole = (n) => n !== null && n !== '' && Number.isInteger(Number(n)) && Number(n) > 0;
+    const hit = repos.find((r) => r.owner.toLowerCase() === ref.owner.toLowerCase() && r.repo.toLowerCase() === ref.repo.toLowerCase());
+    if (hit && whole(hit.installationId) && whole(hit.id))
+        return { installationId: Number(hit.installationId), repoId: Number(hit.id) };
+    if (hit)
+        throw new Error(`${ref.owner}/${ref.repo} came back without an installation to build it through — reconnect GitHub in the console, or pass --public for a public repository`);
+    if (repos.length === 0)
+        throw new Error('the InstaCloud GitHub App reaches none of your repositories — install it on the account that owns this one (console → Add Service → GitHub Repo → Connect GitHub), or pass --public for a public repository');
+    throw new Error(`${ref.owner}/${ref.repo} is not one your GitHub account can reach through the App — grant the App access to it on GitHub, or pass --public for a public repository`);
 }
 async function targetService(api, projectId, branch, serviceName) {
     const { services } = await api.request('GET', `/projects/${projectId}/services${q(branch)}`);
@@ -112,7 +187,7 @@ export async function computeConnectRepo(rawRef, serviceName, opts) {
     const svc = await targetService(api, p.projectId, opts.branch ?? p.branch, serviceName);
     const src = opts.public
         ? { source: 'public', ...ref }
-        : { source: 'app', ...(await findInstalledRepo(api, p.orgId, ref)), ...ref };
+        : { source: 'app', ...(await findCallerRepo(api, p.orgId, ref, authorizeTerminal, canAuthorizeHere(opts))), ...ref };
     // Detection must scan the branch that will be built: the build refuses commands that differ from what it detects there.
     const detected = await api.request('POST', `/projects/${p.projectId}/github/detect`, { ...src, ...(opts.repoBranch ? { ref: opts.repoBranch } : {}) });
     const candidate = pickCandidate(detected.services, opts.rootDir);

package/dist/index.js

@@ -255,7 +255,7 @@ for (const [flags, description] of computeCmd.EXEC_OPTIONS)
     execCmd.option(flags, description);
 compute.command('repo [service]').description('Show what a compute service deploys from: the image it runs, or the GitHub repository — owner/repo, the branch it builds, root directory, which paths a push must change to redeploy it, and whether pushes redeploy it at all')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => githubCmd.computeRepo(service, o)));
-compute.command('connect-repo <owner/repo> [service]').description("Connect a GitHub repository to an EXISTING compute service: the repo is built (its Dockerfile, or nixpacks when there is none) and deployed into that service, and every later push to the tracked repository branch redeploys it. The repo must be reachable through the org's GitHub App installation — connect GitHub in the console first (Add Service → GitHub Repo) — or be public. Build and start commands come from detection and cannot be set. Connecting again replaces the service's current source")
+compute.command('connect-repo <owner/repo> [service]').description("Connect a GitHub repository to an EXISTING compute service: the repo is built (its Dockerfile, or nixpacks when there is none) and deployed into that service, and every later push to the tracked repository branch redeploys it. The repo must be one your own GitHub account can reach through the InstaCloud App, or be public; the first connect from a terminal prints a GitHub URL and a code to authorize it once. Build and start commands come from detection and cannot be set. Connecting again replaces the service's current source")
     .option('--public', 'the repo is public and no GitHub App installation is needed (deploys are manual; pushes cannot redeploy)')
     .option('--root-dir <dir>', 'the directory of the repo to build (a monorepo with several deployable directories lists them and exits 1 without it)')
     .option('--repo-branch <name>', "the repository branch to build (default: the repo's default branch)")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.67",
+  "version": "0.0.68",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [