insta 0.0.71 → 0.0.73

package/dist/agent.js

@@ -66,7 +66,7 @@ export async function loadAgentSession(apiUrl, projectId, cwd = process.cwd()) {
 // scope.projectId. A miss fails HERE, naming the route, instead of on the platform as a
 // "for a different project" 403 whose setup hint cannot help — keep this list in step with the
 // account-level paths in src/commands/.
-export const ACCOUNT_ROUTES = new Set(['agent', 'auth', 'me', 'orgs', 'regions', 'templates', 'tokens', 'github']);
+export const ACCOUNT_ROUTES = new Set(['agent', 'auth', 'me', 'orgs', 'regions', 'templates', 'tokens']);
 export async function agentHeaders(api, method, path, rawBody, scope = {}) {
     if (!mode)
         return {};

package/dist/commands/github.js

@@ -1,6 +1,6 @@
 import { ApiClient, ApiError, requireProject } from '../api.js';
 import { agentMode } from '../agent.js';
-import { info, printJson } from '../util.js';
+import { info, printJson, openUrl } from '../util.js';
 import { resolveSoleService, parsePort, q } from './services.js';
 export function parseRepoRef(raw) {
     const s = raw.trim().replace(/^https?:\/\//i, '').replace(/^(www\.)?github\.com\//i, '').replace(/\/+$/, '').replace(/\.git$/i, '');
@@ -81,8 +81,8 @@ const sleepSeconds = (s) => new Promise((r) => setTimeout(r, s * 1000));
 const pollDelay = (s) => Math.min(Math.max(s, 1), 60);
 // GitHub shows the person a code to type; the platform holds the device code and finishes the exchange,
 // so nothing secret passes through the CLI.
-export async function authorizeTerminal(api, orgId, wait = sleepSeconds) {
-    const start = await api.request('POST', `/orgs/${encodeURIComponent(orgId)}/github/device`, {});
+export async function authorizeTerminal(api, wait = sleepSeconds, open = openUrl) {
+    const start = await api.request('POST', '/me/github/device', {});
     const deadline = Date.parse(start.expiresAt);
     // A NaN deadline makes every comparison false, which reads as an instant expiry — or, inverted, as a
     // loop with no way out. Fail on it rather than guess which.
@@ -92,6 +92,7 @@ export async function authorizeTerminal(api, orgId, wait = sleepSeconds) {
     const say = (line) => process.stderr.write(line + '\n');
     say('this terminal is not authorized with GitHub yet — authorize it once:');
     say(`  open ${start.verificationUri} and enter the code ${start.userCode}`);
+    open(start.verificationUri);
     say('waiting for you to confirm… (ctrl-c to abort)');
     const stopAt = Math.min(deadline, Date.now() + 3600_000); // no device code sensibly outlives an hour
     const asked = Number(start.interval);
@@ -100,7 +101,7 @@ export async function authorizeTerminal(api, orgId, wait = sleepSeconds) {
         await wait(interval);
         let answer;
         try {
-            answer = await api.request('POST', `/orgs/${encodeURIComponent(orgId)}/github/device/poll`, { state: start.state });
+            answer = await api.request('POST', '/me/github/device/poll', { state: start.state });
         }
         catch (e) {
             // A dropped link, or the per-IP limiter this cadence already tripped on the login flow, must not
@@ -120,50 +121,70 @@ export async function authorizeTerminal(api, orgId, wait = sleepSeconds) {
     }
     throw new Error('the GitHub authorization expired before it was confirmed — run the command again');
 }
-// Only the platform's own "you have no usable authorization" may send the person to GitHub: any other
-// failure is real, and a device flow cannot fix it.
-const needsAuthorization = (e) => e instanceof ApiError && e.status === 400 && /not linked|no longer accepted/i.test(e.message);
-// The repositories THIS caller's GitHub account can reach — the same question the platform asks again
-// when the connect lands, so a repo missing here would be refused there anyway.
-// Someone has to read the code and type it at GitHub. A terminal qualifies, and so does agent mode —
-// an agent relays the URL to the person driving it — but --json and a bare pipe have no reader, and a
-// ten-minute wait there is a stall where the old code failed with something to act on.
+// Device authorization needs a person to read the code; JSON and bare pipes must fail promptly.
 export function canAuthorizeHere(opts = {}) {
     if (opts.json)
         return false;
     return !!agentMode() || !!process.stderr.isTTY;
 }
-export async function findCallerRepo(api, orgId, ref, authorize = authorizeTerminal, canAuthorize = canAuthorizeHere()) {
-    if (!orgId)
-        throw new Error('this directory is linked without an org — set INSTA_ORG_ID alongside INSTA_PROJECT_ID, or link it with `insta project link`');
-    let repos;
-    try {
-        repos = (await api.request('POST', `/orgs/${encodeURIComponent(orgId)}/github/repos`, {})).repos ?? [];
+export async function findCallerRepo(api, ref, authorize = authorizeTerminal, canAuthorize = canAuthorizeHere(), wait = sleepSeconds, open = openUrl) {
+    let mine = await api.request('GET', '/me/github/repos');
+    if (!mine.linked && !canAuthorize) {
+        throw new Error('this GitHub account is not authorized for InstaCloud yet, and nothing here can read the code GitHub shows — run `insta compute connect-repo` from a terminal, connect the repository from the console, or pass --public for a public repository');
     }
-    catch (e) {
-        // Two 403s carry an action; a third kind would be guessed at, so it is rethrown as the platform put it.
-        if (e instanceof ApiError && e.status === 403 && /unclassified_agent_action/.test(e.message)) {
-            throw new Error('this backend does not let an agent authorize GitHub yet — connect the repository from the console, or pass --public for a public repository');
-        }
-        if (e instanceof ApiError && e.status === 403 && /requires admin/i.test(e.message)) {
-            throw new Error('connecting a repository needs the org admin role — ask an admin to connect it, or pass --public for a public repository');
+    const repos = mine.linked ? mine.repos : await authorize(api, wait, open);
+    const lookup = (rows) => {
+        const hit = rows.find((r) => r.owner.toLowerCase() === ref.owner.toLowerCase() && r.repo.toLowerCase() === ref.repo.toLowerCase());
+        if (!hit)
+            return;
+        const whole = (n) => n !== null && n !== '' && Number.isInteger(Number(n)) && Number(n) > 0;
+        if (!whole(hit.installationId) || !whole(hit.id))
+            throw new Error(`${ref.owner}/${ref.repo} came back without an installation to build it through — reconnect GitHub in the console, or pass --public for a public repository`);
+        return { installationId: Number(hit.installationId), repoId: Number(hit.id) };
+    };
+    const hit = lookup(repos);
+    if (hit)
+        return hit;
+    if (!canAuthorize)
+        throw new Error(`${ref.owner}/${ref.repo} is not one your GitHub account can reach through the App — run \`insta compute connect-repo\` without --json from a terminal to install or configure the App, or pass --public for a public repository`);
+    if (!mine.linked)
+        mine = await api.request('GET', '/me/github/repos');
+    const installation = mine.installations.find((i) => i.accountLogin.toLowerCase() === ref.owner.toLowerCase());
+    let url;
+    if (installation) {
+        const settings = installation.accountType === 'Organization' ? `/organizations/${encodeURIComponent(installation.accountLogin)}/settings` : '/settings';
+        url = `https://github.com${settings}/installations/${installation.installationId}`;
+    }
+    else {
+        const setup = await api.request('POST', '/me/github/setup', {});
+        const install = new URL(setup.installUrl);
+        // The CLI verifies access by polling; this marker only selects the browser's return-to-terminal page.
+        install.searchParams.set('state', 'cli');
+        url = install.toString();
+    }
+    process.stderr.write(`${installation ? 'configure' : 'install'} the InstaCloud GitHub App on ${ref.owner} and grant access to ${ref.owner}/${ref.repo}:\n  ${url}\nIf you cannot change access, ask the account owner or organization admin.\nWaiting for repository access… (ctrl-c to abort)\n`);
+    open(url);
+    const stopAt = Date.now() + 900_000;
+    let interval = 5;
+    while (Date.now() < stopAt) {
+        await wait(Math.min(interval, (stopAt - Date.now()) / 1000));
+        const remaining = stopAt - Date.now();
+        if (remaining <= 0)
+            break;
+        try {
+            mine = await api.request('GET', '/me/github/repos', undefined, { signal: AbortSignal.timeout(remaining) });
         }
-        if (!needsAuthorization(e))
-            throw e;
-        if (!canAuthorize) {
-            throw new Error('this GitHub account is not authorized for InstaCloud yet, and nothing here can read the code GitHub shows — run `insta compute connect-repo` from a terminal, connect the repository from the console, or pass --public for a public repository');
+        catch (e) {
+            if (e instanceof ApiError && e.status !== 429)
+                throw e;
+            interval = pollDelay(interval + 5);
+            continue;
         }
-        repos = await authorize(api, orgId);
+        const ready = lookup(mine.repos);
+        if (ready)
+            return ready;
     }
-    const whole = (n) => n !== null && n !== '' && Number.isInteger(Number(n)) && Number(n) > 0;
-    const hit = repos.find((r) => r.owner.toLowerCase() === ref.owner.toLowerCase() && r.repo.toLowerCase() === ref.repo.toLowerCase());
-    if (hit && whole(hit.installationId) && whole(hit.id))
-        return { installationId: Number(hit.installationId), repoId: Number(hit.id) };
-    if (hit)
-        throw new Error(`${ref.owner}/${ref.repo} came back without an installation to build it through — reconnect GitHub in the console, or pass --public for a public repository`);
-    if (repos.length === 0)
-        throw new Error('the InstaCloud GitHub App reaches none of your repositories — install it on the account that owns this one (console → Add Service → GitHub Repo → Connect GitHub), or pass --public for a public repository');
-    throw new Error(`${ref.owner}/${ref.repo} is not one your GitHub account can reach through the App — grant the App access to it on GitHub, or pass --public for a public repository`);
+    throw new Error(`timed out waiting for access to ${ref.owner}/${ref.repo} — save the App's repository access on GitHub, then run the command again`);
 }
 async function targetService(api, projectId, branch, serviceName) {
     const { services } = await api.request('GET', `/projects/${projectId}/services${q(branch)}`);
@@ -187,7 +208,7 @@ export async function computeConnectRepo(rawRef, serviceName, opts) {
     const svc = await targetService(api, p.projectId, opts.branch ?? p.branch, serviceName);
     const src = opts.public
         ? { source: 'public', ...ref }
-        : { source: 'app', ...(await findCallerRepo(api, p.orgId, ref, authorizeTerminal, canAuthorizeHere(opts))), ...ref };
+        : { source: 'app', ...(await findCallerRepo(api, ref, authorizeTerminal, canAuthorizeHere(opts))), ...ref };
     // Detection must scan the branch that will be built: the build refuses commands that differ from what it detects there.
     const detected = await api.request('POST', `/projects/${p.projectId}/github/detect`, { ...src, ...(opts.repoBranch ? { ref: opts.repoBranch } : {}) });
     const candidate = pickCandidate(detected.services, opts.rootDir);

package/dist/index.js

@@ -255,7 +255,7 @@ for (const [flags, description] of computeCmd.EXEC_OPTIONS)
     execCmd.option(flags, description);
 compute.command('repo [service]').description('Show what a compute service deploys from: the image it runs, or the GitHub repository — owner/repo, the branch it builds, root directory, which paths a push must change to redeploy it, and whether pushes redeploy it at all')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => githubCmd.computeRepo(service, o)));
-compute.command('connect-repo <owner/repo> [service]').description("Connect a GitHub repository to an EXISTING compute service: the repo is built (its Dockerfile, or nixpacks when there is none) and deployed into that service, and every later push to the tracked repository branch redeploys it. The repo must be one your own GitHub account can reach through the InstaCloud App, or be public; the first connect from a terminal prints a GitHub URL and a code to authorize it once. Build and start commands come from detection and cannot be set. Connecting again replaces the service's current source")
+compute.command('connect-repo <owner/repo> [service]').description("Connect a GitHub repository to an EXISTING compute service: the repo is built (its Dockerfile, or nixpacks when there is none) and deployed into that service, and every later push to the tracked repository branch redeploys it. The repo must be one your own GitHub account can reach through the InstaCloud App, or be public; the CLI opens GitHub for device-code authorization and App installation or configuration when needed, then waits for repository access and continues. URLs are also printed for remote terminals; --json requires access to be ready. Build and start commands come from detection and cannot be set. Connecting again replaces the service's current source")
     .option('--public', 'the repo is public and no GitHub App installation is needed (deploys are manual; pushes cannot redeploy)')
     .option('--root-dir <dir>', 'the directory of the repo to build (a monorepo with several deployable directories lists them and exits 1 without it)')
     .option('--repo-branch <name>', "the repository branch to build (default: the repo's default branch)")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.71",
+  "version": "0.0.73",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [