insta 0.0.68 → 0.0.70

package/README.md

@@ -16,7 +16,7 @@ Native binary, no Node required (macOS / Linux / WSL). Installs to `~/.insta/bin
 verifies the download against `SHA256SUMS`:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/InsForge/insta-cli/main/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/InsForge/instacloud-cli/main/install.sh | sh
 ```
 
 From npm:
@@ -48,7 +48,7 @@ On macOS/Linux without Node, the native-binary installer puts the `insta` CLI on
 skill + MCP steps it then runs still need Node — the skills tool runs via npx). Never run it
 on native Windows — PowerShell's `curl` alias and the WSL `bash` shim break it; use npx
 above, or download `insta-windows-x64.exe` from the
-[releases page](https://github.com/InsForge/insta-cli/releases):
+[releases page](https://github.com/InsForge/instacloud-cli/releases):
 
 ```bash
 curl -fsSL agents.instacloud.com | sh
@@ -74,7 +74,9 @@ insta deploy .
 opt-in, so you add only what you need. `secrets` writes the current branch's user-defined
 secrets to `./.env` (the postgres connection string is read with `insta db url`). `deploy .`
 builds the directory remotely and ships it to the branch's compute
-service; it needs a `Dockerfile`, but no local Docker.
+service, with no local Docker. Whether it needs a `Dockerfile` depends on where the
+service runs: on insta-compute it is optional, and a directory without one is built
+by nixpacks on the build gateway; on Fly-backed services one is still required.
 
 ## Authentication
 
@@ -157,7 +159,7 @@ other, so switching environments drops the stored session and you log in again.
 | control plane | `api.instacloud.com` | `api.staging.instacloud.com` |
 | MCP server | `mcp.instacloud.com/mcp` | `mcp.staging.instacloud.com/mcp` |
 | MCP registers as | `insta-cloud` | `insta-cloud-staging` |
-| agent skills | `InsForge/insta-skills` | `InsForge/insta-skills#devel` |
+| agent skills | `InsForge/instacloud-skills` | `InsForge/instacloud-skills#devel` |
 | CLI channel | latest stable release | newest prerelease, else stable |
 
 ```bash
@@ -180,7 +182,7 @@ That host is a CloudFront cache, so after a change to the installer it can serve
 previous copy for up to about a day. This form is equivalent and always current:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/InsForge/insta-cli/main/install.sh | sh -s -- --agents --staging
+curl -fsSL https://raw.githubusercontent.com/InsForge/instacloud-cli/main/install.sh | sh -s -- --agents --staging
 ```
 
 If the environment cannot be applied — an installed CLI older than 0.0.23 has no `insta
@@ -204,7 +206,7 @@ build never reaches a production installer.
 ## Commands
 
 `insta --help` is the authoritative list. For flags, approval gates and plan limits, see the
-[full command reference](https://github.com/InsForge/insta-skills/blob/main/insta/cli-reference.md).
+[full command reference](https://github.com/InsForge/instacloud-skills/blob/main/insta/cli-reference.md).
 
 | Command | What it covers |
 |---|---|
@@ -238,6 +240,7 @@ build never reaches a production installer.
 |---|---|
 | `~/.insta/config.json` | API URL, access and refresh tokens, user, auto-update preference |
 | `./.insta/project.json` | Project id, org id, current branch |
+| `./.insta/link-plane.json` | The control-plane URL this machine linked against. Gitignored and per machine; a link made against a different control plane is refused rather than reused. The home directory is never a project |
 
 | Variable | Effect |
 |---|---|
@@ -252,7 +255,7 @@ build never reaches a production installer.
 ## Agent skills
 
 The `insta` skill and its task guides live in
-[InsForge/insta-skills](https://github.com/InsForge/insta-skills). `insta setup agent`
+[InsForge/instacloud-skills](https://github.com/InsForge/instacloud-skills). `insta setup agent`
 installs it user-globally for every coding agent on the machine. `insta project create` and
 `insta project link` additionally install the stack skills (Tigris, Better Auth) into the
 project, along with the `insta observe` credential-audit hook. Postgres needs no stack

package/dist/api.js

@@ -1,6 +1,6 @@
 // Thin API client over the platform control-plane. Handles bearer auth + one-shot refresh on 401.
 // 2xx (including 202 approval_required) returns the parsed body; >=400 throws ApiError.
-import { readGlobal, writeGlobal, readProject, writeProject } from './config.js';
+import { readGlobal, writeGlobal, readProject, persistAutoLink, resolveProjectLink, foreignLinkMessage } from './config.js';
 import { autoResolveProject, promptChoice } from './resolve-project.js';
 import { die } from './util.js';
 import { USER_AGENT } from './version.js';
@@ -77,7 +77,7 @@ export class ApiClient {
     async raw(method, path, body, auth, scope = {}) {
         let r = await this.fetch(method, path, body, auth, scope);
         if (r.status === 401 && auth && this.cfg.refreshToken) {
-            if (await this.refresh())
+            if (await this.refresh(scope.signal))
                 r = await this.fetch(method, path, body, auth, scope);
         }
         return r;
@@ -92,6 +92,7 @@ export class ApiClient {
             method,
             headers,
             body: body === undefined ? undefined : JSON.stringify(body),
+            signal: scope.signal,
         });
         const text = await res.text();
         let parsed = null;
@@ -103,9 +104,9 @@ export class ApiClient {
         }
         return { status: res.status, body: parsed };
     }
-    async refresh() {
+    async refresh(signal) {
         try {
-            const res = await this.fetch('POST', '/auth/refresh', { refreshToken: this.cfg.refreshToken }, false);
+            const res = await this.fetch('POST', '/auth/refresh', { refreshToken: this.cfg.refreshToken }, false, { signal });
             if (res.status >= 400)
                 return false;
             this.cfg.accessToken = res.body.accessToken;
@@ -113,7 +114,12 @@ export class ApiClient {
             await this.persist();
             return true;
         }
-        catch {
+        catch (e) {
+            // Refresh belongs to the original request's time budget. Do not turn its cancellation
+            // into the earlier 401: the caller needs the abort to report a timeout or cancellation.
+            signal?.throwIfAborted();
+            if (e instanceof Error && (e.name === 'AbortError' || e.name === 'TimeoutError'))
+                throw e;
             return false;
         }
     }
@@ -121,12 +127,20 @@ export class ApiClient {
 // Resolve the linked project (./.insta/project.json), or null.
 export async function linkedProject() { return readProject(); }
 // Resolve the linked project or exit with guidance.
-export async function requireProject() {
-    const p = await readProject();
-    if (p)
-        return p;
+export async function requireProject(deps = {}) {
+    const r = await resolveProjectLink(deps.cwd);
+    // Fail CLOSED on a link made against another control plane. Treating it as "unlinked" sent this
+    // into auto-resolve, which with exactly one project on the new plane picks it without a prompt
+    // and SAVES — so a read-only command replaced the committed team binding, and pointing back
+    // flipped it again. Only an explicit `insta project link` may replace a link.
+    if (r?.foreign)
+        die(foreignLinkMessage(r.foreign));
+    if (r)
+        return r.link;
     if (agentMode())
         die('agent mode requires a linked project — run `insta setup agent --project <id>`');
+    if (deps.autoResolve)
+        return deps.autoResolve();
     // One command, just works: unlinked ≠ error. Resolve the project (auto when there's one,
     // one-keystroke picker when several) and persist the choice so this happens once per dir.
     const api = await ApiClient.load();
@@ -137,10 +151,16 @@ export async function requireProject() {
             listProjects: async () => (await api.request('GET', `/orgs/${orgId}/projects`)).projects,
             promptChoice,
             save: async (c) => {
-                await writeProject(c);
                 // stderr: this is a diagnostic that can precede ANY command's output — under --json,
                 // stdout must stay one parseable document.
-                process.stderr.write(`auto-linked project ${c.projectId} → ./.insta/project.json\n`);
+                if (await persistAutoLink(c, deps.cwd)) {
+                    process.stderr.write(`auto-linked project ${c.projectId} → ./.insta/project.json\n`);
+                }
+                else {
+                    // The home directory never holds a link (~/.insta is the global config): use the choice
+                    // for this command instead of failing it after the picker has already run.
+                    process.stderr.write(`using project ${c.projectId} for this command — not saving a link in the home directory; run inside a project directory to remember it\n`);
+                }
             },
             tty: !!process.stdin.isTTY && !!process.stderr.isTTY,
         });

package/dist/commands/billing.js

@@ -14,17 +14,20 @@ export async function resolveOrgId(opts) {
 export function billingLines(s, org) {
     const t = s.totals;
     const lines = [
-        `tier:      ${s.tier}`,
-        `status:    ${s.billingStatus}`,
+        `tier:            ${s.tier}`,
+        `status:          ${s.billingStatus}`,
         cycleLine(s.window),
-        `included:  $${Number(t.includedUsd).toFixed(2)}`,
-        `used:      $${Number(t.usedUsd).toFixed(4)}`,
-        `overage:   $${Number(t.overageUsd).toFixed(4)}`,
-        `credits:   $${Number(t.creditsUsd).toFixed(2)}`,
-        `forecast:  $${Number(t.forecastUsd).toFixed(4)}  (predicted full cycle)`,
+        // Two separate figures, never added together: the plan's allowance for this cycle, and the
+        // org's wallet. "included usage" is the name the console and the pricing page use for the
+        // former; "credits" now means the wallet alone.
+        `included usage:  $${Number(t.includedUsd).toFixed(2)}`,
+        `used:            $${Number(t.usedUsd).toFixed(4)}`,
+        `overage:         $${Number(t.overageUsd).toFixed(4)}`,
+        `credits:         $${Number(t.creditBalanceUsd).toFixed(2)}`,
+        `forecast:        $${Number(t.forecastUsd).toFixed(4)}  (predicted full cycle)`,
     ];
     if (s.subscriptionStatus)
-        lines.push(`subscription: ${s.subscriptionStatus}`);
+        lines.push(`subscription:    ${s.subscriptionStatus}`);
     if (s.billingStatus === 'suspended') {
         // Four causes, five messages, and every one is a dead end for the others. Tier first: only a
         // free org can spend a prepaid wallet, and waiting for the next cycle genuinely fixes that one.

package/dist/commands/branch.js

@@ -1,5 +1,5 @@
 import { ApiClient, requireProject } from '../api.js';
-import { writeProject } from '../config.js';
+import { isHomeLinkTarget, writeProject } from '../config.js';
 import { info, die, printJson, handleApproval, renderNextActions } from '../util.js';
 export async function branchCreate(name, opts) {
     const api = await ApiClient.load();
@@ -20,6 +20,11 @@ export async function branchList(opts) {
         info(`${b.is_default ? '*' : ' '} ${b.name}  [${b.status}]  ${b.id}`);
 }
 export async function branchSwitch(name, opts = {}) {
+    // A switch is remembered in ./.insta/project.json, which never lives in the home directory. Say so
+    // up front, instead of auto-resolving a project "for this command" and then refusing to save.
+    if (await isHomeLinkTarget()) {
+        die('can\'t switch branches in the home directory — the branch is remembered in ./.insta/project.json, and ~/.insta is the insta CLI\'s global config. Run this inside a project directory');
+    }
     const api = await ApiClient.load();
     const p = await requireProject();
     const { branches } = await api.request('GET', `/projects/${p.projectId}/branches`);

package/dist/commands/build.js

@@ -155,21 +155,21 @@ export async function buildReport(dirArg, opts, deps) {
     const envKeys = existsSync(envExample) ? envKeysFromDotEnvExample(readFileSync(envExample, 'utf8')) : [];
     const checks = [];
     // Only a Dockerfile IN the directory passes. A nixpacks-generated one is a real plan, but it is
-    // not a plan `insta deploy <dir>` can execute: that path builds the directory's own Dockerfile and
-    // dies without one, and the nixpacks lane runs server-side for GitHub-connected repos only. This
-    // check used to pass on the generated Dockerfile, so a verifier said "deployable" about a
-    // directory `deploy` refuses — the whole point of the command is to not do that.
+    // not one this machine can hand to every target: on a Fly-backed service `insta deploy <dir>`
+    // builds the directory's own Dockerfile and dies without one. On insta-compute the gateway runs
+    // nixpacks itself, so the same directory ships. The check stays a non-pass because it cannot know
+    // the target, and the detail below says both halves rather than promising either.
     checks.push(dockerfile.source === 'nixpacks'
         ? {
             id: 'dockerfile',
             severity: 'warning',
             status: 'fail',
             title: 'Dockerfile',
-            detail: `${dockerfileDetail} — but \`insta deploy <dir>\` builds the directory's own Dockerfile; the nixpacks lane runs server-side for GitHub-connected repos only`,
+            detail: `${dockerfileDetail} — \`insta deploy <dir>\` builds this on the gateway with nixpacks when the service runs on insta-compute, and needs your own Dockerfile on a Fly-backed one`,
             // NOT "save the generated Dockerfile here": it is not standalone (it COPYs the
             // .nixpacks/nixpkgs-<hash>.nix support files nixpacks writes beside it, which this
             // directory does not have). The detected commands above are the reusable part.
-            nextAction: `to deploy this directory, write a Dockerfile at ${userDockerfilePath} — the detected install/start commands above are the starting point; or connect the GitHub repo to the service (\`insta compute connect-repo <owner/repo>\`) to use the nixpacks lane`,
+            nextAction: `on insta-compute this deploys as-is (nixpacks builds it on the gateway). On a Fly-backed service, write a Dockerfile at ${userDockerfilePath} — the detected install/start commands above are the starting point — or connect the GitHub repo (\`insta compute connect-repo <owner/repo>\`)`,
         }
         : {
             id: 'dockerfile',
@@ -225,8 +225,9 @@ export function renderReport(r, explain) {
     const lines = [];
     lines.push(`plan for ${r.dir}:`);
     // The builder line is the first thing read (and the thing an agent scrapes), so it carries the
-    // lane caveat too — "builder: nixpacks" on its own reads as a promise `insta deploy <dir>` breaks.
-    const lane = r.plan.builder === 'nixpacks' ? ' — GitHub lane only (`insta compute connect-repo`); `insta deploy <dir>` needs a Dockerfile' : '';
+    // lane caveat too — "builder: nixpacks" on its own reads as a promise that is only true on some
+    // targets. It has to say the SAME thing the detail below it says, or a scrape sees both claims.
+    const lane = r.plan.builder === 'nixpacks' ? ' — server-side: insta-compute builds this as-is, a Fly-backed service needs your own Dockerfile' : '';
     lines.push(`  builder: ${r.plan.builder ?? 'none'}${r.plan.providers.length ? ` (providers: ${r.plan.providers.join(', ')})` : ''}${lane}`);
     if (r.plan.installCommand)
         lines.push(`  install: ${r.plan.installCommand}`);

package/dist/commands/deploy.js

@@ -3,14 +3,17 @@ import { existsSync, readFileSync } from 'node:fs';
 import { ApiClient, ApiError, requireProject } from '../api.js';
 import { info, die, printJson, handleApproval, renderNextActions, CliExit } from '../util.js';
 import { flyctlBuildAndPush, ensureFlyctl, defaultBuildRunner, stderrBuildRunner } from '../flyctl-build.js';
+import { packDirectory, windowsModeCaveat } from '../pack.js';
+import { deployArchive, uploadArchive } from '../deploy-archive.js';
+import { parsePort } from './services.js';
 // With --json, stdout must carry exactly one JSON document (the deploy result), so every progress
 // line moves to stderr.
 const note = (opts) => (opts.json ? (m) => void process.stderr.write(m + '\n') : info);
 // Map CLI options to the platform deploy request body. Pure, so it's unit-tested. --websocket is only
-// sent when set (plain deploys unchanged).
-export function deployRequestBody(image, branch, opts) {
+// sent when set (plain deploys unchanged). Exactly one of image | archive rides along.
+export function deployRequestBody(source, branch, opts) {
     return {
-        image,
+        image: source.image,
         branch,
         group: opts.group,
         port: opts.port ? Number(opts.port) : undefined,
@@ -18,6 +21,82 @@ export function deployRequestBody(image, branch, opts) {
         replaceSource: opts.replaceSource ? true : undefined,
     };
 }
+// Ask the platform which lane serves this target, so the CLI stops knowing which provider backs
+// its service. A 404 means the platform predates the contract — and because this is a GET, it
+// 404s the same way for a human and an agent, which a POST would not.
+async function discoverLane(api, projectId, branch, opts) {
+    const q = new URLSearchParams({ branch, ...(opts.group ? { group: opts.group } : {}) });
+    try {
+        const res = await api.rawRequest('GET', `/projects/${projectId}/source-build?${q}`);
+        // Validated, not cast. Every value other than the four we know silently fell through to the
+        // flyctl path below, so a server that grew a fifth lane would send this CLI down the wrong
+        // one and fail somewhere unrelated. An unknown answer is the server being ahead of us, and
+        // saying that is more useful than guessing.
+        const lane = (res.body ?? {});
+        const tag = lane.lane ?? '';
+        const known = ['flyctl', 'local-docker', 'archive', 'none'];
+        if (!known.includes(tag)) {
+            die(`this platform answered with a source-build lane this CLI does not know (${JSON.stringify(tag)}) — upgrade with \`insta upgrade\``);
+        }
+        // The tag alone is not the contract: each branch carries a payload this code then trusts.
+        // An `archive` with malformed limits fell back to local defaults, so the CLI would enforce
+        // caps the SERVER does not have, and a `none` with no reason died with `undefined`.
+        if (tag === 'archive') {
+            const l = lane.limits;
+            const positive = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v > 0;
+            if (!l || !positive(l.maxArchiveBytes) || !positive(l.maxExtractedBytes) || !positive(l.maxFiles)) {
+                die('this platform offered the archive lane without usable size limits — upgrade with `insta upgrade`');
+            }
+        }
+        const reason = lane.reason;
+        if (tag === 'none' && (typeof reason !== 'string' || !reason.trim())) {
+            die('this platform refused a source build without saying why — upgrade with `insta upgrade`');
+        }
+        return lane;
+    }
+    catch (e) {
+        if (e instanceof ApiError && e.status === 404) {
+            // The route answered and the TARGET is what is missing: say so, or flyctl turns it into "no Dockerfile".
+            // Both ways out: the project has several groups and none is named, or it has none at all.
+            if (/compute group not found|branch not found/.test(e.message))
+                die(`${e.message} — name it with \`--group <name>\` (see \`insta services list\`), or add one: \`insta services add compute <name>\``);
+            return { lane: 'legacy' };
+        }
+        throw e;
+    }
+}
+// Turn a source directory into something deployable. Returns null when an approval is pending.
+export async function prepareSource(api, projectId, dir, branch, opts, run = opts.json ? stderrBuildRunner : defaultBuildRunner, upload) {
+    const lane = await discoverLane(api, projectId, branch, opts);
+    if (lane.lane === 'none')
+        die(lane.reason);
+    if (lane.lane !== 'archive') {
+        // flyctl, local-docker and legacy all end in an image, and all three need a Dockerfile.
+        return { image: await buildFromSource(api, projectId, dir, branch, opts, run) };
+    }
+    const log = note(opts);
+    const absDir = resolve(process.cwd(), dir);
+    const caveat = windowsModeCaveat();
+    if (caveat)
+        log(caveat);
+    const packed = packDirectory(absDir, lane.limits);
+    log(`packed ${dir}: ${packed.files} files, ${packed.archive.length} bytes`);
+    const ref = await uploadArchive(api, projectId, packed, branch, opts, upload);
+    if (!ref)
+        return null;
+    log(`deploying ${packed.archive.length} bytes via the gateway (${ref.build.type})`);
+    // One gated call enqueues build+deploy as an operation; the wait is ours, one short poll at a
+    // time, because a platform request has to answer inside the ALB's 60s while a build runs minutes.
+    // A repo-connected service refuses this with a 409 the same way it refuses an image deploy, and
+    // the hint that names the FLAG rather than the API field lives here, beside the `/deploy` path.
+    const out = await deployArchive(api, projectId, ref, branch, opts, Date.now, undefined, log)
+        .catch((e) => { throw e instanceof ApiError && e.status === 409 ? new ApiError(e.status, repoConnectedHint(e.message), e.body) : e; });
+    if (!out)
+        return null;
+    if ('failed' in out)
+        die(out.failed);
+    return { deployed: out };
+}
 // A port mismatch is the #1 deploy mistake: the app boots "successfully" but the proxy routes to
 // the wrong internal port and every request is refused. For source deploys the Dockerfile states
 // the truth — use its (last) EXPOSE as the default instead of a blind 8080.
@@ -30,10 +109,10 @@ export function dockerfileExposedPort(dockerfile) {
     }
     return port;
 }
-// A directory deploy builds the Dockerfile IN the directory — there is no no-Dockerfile lane here.
-// The nixpacks (no-Dockerfile) lane is real but server-side: it runs on the build gateway for
-// GitHub-connected repos only, and nothing reachable from `insta deploy <dir>` can enter it. So the
-// dead-end message names every way forward instead of the bare "add one".
+// This message is for the target that still REQUIRES a Dockerfile: a Fly-backed service, where a
+// directory deploy builds the Dockerfile in the directory and dies without one. On insta-compute
+// the archive lane carries the directory to the gateway and nixpacks builds it, so this dead end is
+// no longer universal. It names every way forward instead of the bare "add one".
 //
 // It deliberately does NOT say "save the Dockerfile `insta build --explain` prints": that file is
 // not standalone — it COPYs `.nixpacks/nixpkgs-<hash>.nix` support files nixpacks writes beside it,
@@ -60,7 +139,16 @@ export async function deploy(dir, opts) {
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
     const log = note(opts);
-    let port = opts.port ? Number(opts.port) : undefined;
+    // Junk fails here, before a directory is packed and uploaded for a body the platform would only
+    // refuse: the same parser every other --port in this CLI runs. `Number()` alone sent NaN as
+    // `null` and let 0 or 70000 travel to the server.
+    let port;
+    try {
+        port = opts.port === undefined ? undefined : parsePort(opts.port);
+    }
+    catch (e) {
+        die(`--${e.message}`);
+    }
     if (dir && port === undefined) {
         const dockerfile = join(resolve(process.cwd(), dir), 'Dockerfile');
         const exposed = existsSync(dockerfile) ? dockerfileExposedPort(readFileSync(dockerfile, 'utf8')) : undefined;
@@ -70,14 +158,26 @@ export async function deploy(dir, opts) {
         }
     }
     const effOpts = { ...opts, port: port?.toString() };
-    const image = dir ? await buildFromSource(api, p.projectId, dir, branch, effOpts) : opts.image;
-    const res = await api.rawRequest('POST', `/projects/${p.projectId}/deploy`, deployRequestBody(image, branch, effOpts))
+    const source = dir ? await prepareSource(api, p.projectId, dir, branch, effOpts) : { image: opts.image };
+    if (!source)
+        return; // an approval is pending; the user approves and re-runs
+    if ('deployed' in source) {
+        // The archive lane's operation already deployed. One output shape whichever lane ran, minus
+        // nextActions, which the operation read does not carry.
+        const d = source.deployed;
+        if (opts.json)
+            return printJson({ image: d.image, url: d.url, branch: d.branch, group: d.group, machineId: d.machineId });
+        info(`deployed ${d.image} -> ${d.url} (branch ${d.branch}, group ${d.group})`);
+        return;
+    }
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/deploy`, deployRequestBody(source, branch, effOpts))
         .catch((e) => { throw e instanceof ApiError && e.status === 409 ? new ApiError(e.status, repoConnectedHint(e.message), e.body) : e; });
     if (handleApproval(res, opts.json))
         return;
+    const what = source.image;
     if (opts.json)
-        return printJson({ image, ...res.body });
-    info(`deployed ${image} -> ${res.body.url} (branch ${res.body.branch}, group ${res.body.group})`);
+        return printJson({ image: source.image, ...res.body });
+    info(`deployed ${what} -> ${res.body.url} (branch ${res.body.branch}, group ${res.body.group})`);
     renderNextActions(res.body.nextActions);
 }
 // The platform refuses an image deploy onto a repo-connected service and names the body field it

package/dist/commands/feedback.js

@@ -4,7 +4,7 @@
 // server, the platform, the skills, the docs. Never for problems in the app the user is building.
 //
 // The backend is InstaCloud dogfooding itself: the "InstaCloud Agent Feedback" project runs the
-// ingest service (InsForge/insta-feedback repo) on a postgres + compute pair. It is NOT the
+// ingest service (InsForge/instacloud-feedback repo) on a postgres + compute pair. It is NOT the
 // control-plane API on purpose — feedback must work logged-out, unlinked, and from insta-oss,
 // and a control-plane outage is exactly when we most want reports to still arrive.
 import { readFileSync, statSync } from 'node:fs';

package/dist/commands/project.js

@@ -1,7 +1,7 @@
 import { homedir } from 'node:os';
 import { agentMode, setupProjectAgentSession } from '../agent.js';
 import { ApiClient, requireProject } from '../api.js';
-import { writeProject } from '../config.js';
+import { HOME_LINK_REFUSAL, isHomeLinkTarget, writeProject } from '../config.js';
 import { info, die, printJson, handleApproval, renderNextActions } from '../util.js';
 import { installObserve } from '../observe/install.js';
 import { installRoot } from './observe.js';
@@ -73,6 +73,10 @@ export async function projectCreate(name, opts) {
         info('  (or just ask your coding agent — it has the insta skill and will do this for you)');
         return;
     }
+    // Refuse the home directory BEFORE provisioning: refusing only inside writeProject created the
+    // project on the control plane and then failed, with no id printed under --json.
+    if (await isHomeLinkTarget())
+        die(HOME_LINK_REFUSAL);
     const api = await ApiClient.load();
     const orgId = await resolveOrg(api, opts.org);
     const out = await api.request('POST', `/orgs/${orgId}/projects`, { name: resolved });
@@ -103,6 +107,11 @@ export async function projectList(opts) {
         info(`${p.id}  ${p.name}  [${p.status}]`);
 }
 export async function projectLink(id, opts = {}) {
+    // Refuse the home directory BEFORE anything with side effects. In agent mode the session below is
+    // saved, and .gitignore edited, at the link root; refusing only inside writeProject left both
+    // behind in ~ after the command had already failed.
+    if (await isHomeLinkTarget())
+        die(HOME_LINK_REFUSAL);
     const api = await ApiClient.load();
     if (agentMode())
         await setupProjectAgentSession(api, id);

package/dist/commands/upgrade.js

@@ -24,7 +24,7 @@ import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { readGlobal, writeGlobal } from '../config.js';
 import { resolveSpawnable } from '../spawn.js';
 import { info } from '../util.js';
-const INSTALL_SH = 'https://raw.githubusercontent.com/InsForge/insta-cli/main/install.sh';
+const INSTALL_SH = 'https://raw.githubusercontent.com/InsForge/instacloud-cli/main/install.sh';
 // The dist-tag document is the authoritative, tiny (~50 byte) answer for `latest`. The full
 // `latest` manifest is the fallback if that route is ever unavailable.
 const REGISTRY_DIST_TAGS = 'https://registry.npmjs.org/-/package/insta/dist-tags';