insta 0.0.72 → 0.0.73

package/dist/commands/github.js

@@ -1,6 +1,6 @@
 import { ApiClient, ApiError, requireProject } from '../api.js';
 import { agentMode } from '../agent.js';
-import { info, printJson } from '../util.js';
+import { info, printJson, openUrl } from '../util.js';
 import { resolveSoleService, parsePort, q } from './services.js';
 export function parseRepoRef(raw) {
     const s = raw.trim().replace(/^https?:\/\//i, '').replace(/^(www\.)?github\.com\//i, '').replace(/\/+$/, '').replace(/\.git$/i, '');
@@ -81,7 +81,7 @@ const sleepSeconds = (s) => new Promise((r) => setTimeout(r, s * 1000));
 const pollDelay = (s) => Math.min(Math.max(s, 1), 60);
 // GitHub shows the person a code to type; the platform holds the device code and finishes the exchange,
 // so nothing secret passes through the CLI.
-export async function authorizeTerminal(api, wait = sleepSeconds) {
+export async function authorizeTerminal(api, wait = sleepSeconds, open = openUrl) {
     const start = await api.request('POST', '/me/github/device', {});
     const deadline = Date.parse(start.expiresAt);
     // A NaN deadline makes every comparison false, which reads as an instant expiry — or, inverted, as a
@@ -92,6 +92,7 @@ export async function authorizeTerminal(api, wait = sleepSeconds) {
     const say = (line) => process.stderr.write(line + '\n');
     say('this terminal is not authorized with GitHub yet — authorize it once:');
     say(`  open ${start.verificationUri} and enter the code ${start.userCode}`);
+    open(start.verificationUri);
     say('waiting for you to confirm… (ctrl-c to abort)');
     const stopAt = Math.min(deadline, Date.now() + 3600_000); // no device code sensibly outlives an hour
     const asked = Number(start.interval);
@@ -126,21 +127,64 @@ export function canAuthorizeHere(opts = {}) {
         return false;
     return !!agentMode() || !!process.stderr.isTTY;
 }
-export async function findCallerRepo(api, ref, authorize = authorizeTerminal, canAuthorize = canAuthorizeHere()) {
-    const mine = await api.request('GET', '/me/github/repos');
+export async function findCallerRepo(api, ref, authorize = authorizeTerminal, canAuthorize = canAuthorizeHere(), wait = sleepSeconds, open = openUrl) {
+    let mine = await api.request('GET', '/me/github/repos');
     if (!mine.linked && !canAuthorize) {
         throw new Error('this GitHub account is not authorized for InstaCloud yet, and nothing here can read the code GitHub shows — run `insta compute connect-repo` from a terminal, connect the repository from the console, or pass --public for a public repository');
     }
-    const repos = mine.linked ? mine.repos : await authorize(api);
-    const whole = (n) => n !== null && n !== '' && Number.isInteger(Number(n)) && Number(n) > 0;
-    const hit = repos.find((r) => r.owner.toLowerCase() === ref.owner.toLowerCase() && r.repo.toLowerCase() === ref.repo.toLowerCase());
-    if (hit && whole(hit.installationId) && whole(hit.id))
+    const repos = mine.linked ? mine.repos : await authorize(api, wait, open);
+    const lookup = (rows) => {
+        const hit = rows.find((r) => r.owner.toLowerCase() === ref.owner.toLowerCase() && r.repo.toLowerCase() === ref.repo.toLowerCase());
+        if (!hit)
+            return;
+        const whole = (n) => n !== null && n !== '' && Number.isInteger(Number(n)) && Number(n) > 0;
+        if (!whole(hit.installationId) || !whole(hit.id))
+            throw new Error(`${ref.owner}/${ref.repo} came back without an installation to build it through — reconnect GitHub in the console, or pass --public for a public repository`);
         return { installationId: Number(hit.installationId), repoId: Number(hit.id) };
+    };
+    const hit = lookup(repos);
     if (hit)
-        throw new Error(`${ref.owner}/${ref.repo} came back without an installation to build it through — reconnect GitHub in the console, or pass --public for a public repository`);
-    if (repos.length === 0)
-        throw new Error('the InstaCloud GitHub App reaches none of your repositories — install it on the account that owns this one (console → Add Service → GitHub Repo → Connect GitHub), or pass --public for a public repository');
-    throw new Error(`${ref.owner}/${ref.repo} is not one your GitHub account can reach through the App — grant the App access to it on GitHub, or pass --public for a public repository`);
+        return hit;
+    if (!canAuthorize)
+        throw new Error(`${ref.owner}/${ref.repo} is not one your GitHub account can reach through the App — run \`insta compute connect-repo\` without --json from a terminal to install or configure the App, or pass --public for a public repository`);
+    if (!mine.linked)
+        mine = await api.request('GET', '/me/github/repos');
+    const installation = mine.installations.find((i) => i.accountLogin.toLowerCase() === ref.owner.toLowerCase());
+    let url;
+    if (installation) {
+        const settings = installation.accountType === 'Organization' ? `/organizations/${encodeURIComponent(installation.accountLogin)}/settings` : '/settings';
+        url = `https://github.com${settings}/installations/${installation.installationId}`;
+    }
+    else {
+        const setup = await api.request('POST', '/me/github/setup', {});
+        const install = new URL(setup.installUrl);
+        // The CLI verifies access by polling; this marker only selects the browser's return-to-terminal page.
+        install.searchParams.set('state', 'cli');
+        url = install.toString();
+    }
+    process.stderr.write(`${installation ? 'configure' : 'install'} the InstaCloud GitHub App on ${ref.owner} and grant access to ${ref.owner}/${ref.repo}:\n  ${url}\nIf you cannot change access, ask the account owner or organization admin.\nWaiting for repository access… (ctrl-c to abort)\n`);
+    open(url);
+    const stopAt = Date.now() + 900_000;
+    let interval = 5;
+    while (Date.now() < stopAt) {
+        await wait(Math.min(interval, (stopAt - Date.now()) / 1000));
+        const remaining = stopAt - Date.now();
+        if (remaining <= 0)
+            break;
+        try {
+            mine = await api.request('GET', '/me/github/repos', undefined, { signal: AbortSignal.timeout(remaining) });
+        }
+        catch (e) {
+            if (e instanceof ApiError && e.status !== 429)
+                throw e;
+            interval = pollDelay(interval + 5);
+            continue;
+        }
+        const ready = lookup(mine.repos);
+        if (ready)
+            return ready;
+    }
+    throw new Error(`timed out waiting for access to ${ref.owner}/${ref.repo} — save the App's repository access on GitHub, then run the command again`);
 }
 async function targetService(api, projectId, branch, serviceName) {
     const { services } = await api.request('GET', `/projects/${projectId}/services${q(branch)}`);

package/dist/index.js

@@ -255,7 +255,7 @@ for (const [flags, description] of computeCmd.EXEC_OPTIONS)
     execCmd.option(flags, description);
 compute.command('repo [service]').description('Show what a compute service deploys from: the image it runs, or the GitHub repository — owner/repo, the branch it builds, root directory, which paths a push must change to redeploy it, and whether pushes redeploy it at all')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => githubCmd.computeRepo(service, o)));
-compute.command('connect-repo <owner/repo> [service]').description("Connect a GitHub repository to an EXISTING compute service: the repo is built (its Dockerfile, or nixpacks when there is none) and deployed into that service, and every later push to the tracked repository branch redeploys it. The repo must be one your own GitHub account can reach through the InstaCloud App, or be public; the first connect from a terminal prints a GitHub URL and a code to authorize it once. Build and start commands come from detection and cannot be set. Connecting again replaces the service's current source")
+compute.command('connect-repo <owner/repo> [service]').description("Connect a GitHub repository to an EXISTING compute service: the repo is built (its Dockerfile, or nixpacks when there is none) and deployed into that service, and every later push to the tracked repository branch redeploys it. The repo must be one your own GitHub account can reach through the InstaCloud App, or be public; the CLI opens GitHub for device-code authorization and App installation or configuration when needed, then waits for repository access and continues. URLs are also printed for remote terminals; --json requires access to be ready. Build and start commands come from detection and cannot be set. Connecting again replaces the service's current source")
     .option('--public', 'the repo is public and no GitHub App installation is needed (deploys are manual; pushes cannot redeploy)')
     .option('--root-dir <dir>', 'the directory of the repo to build (a monorepo with several deployable directories lists them and exits 1 without it)')
     .option('--repo-branch <name>', "the repository branch to build (default: the repo's default branch)")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.72",
+  "version": "0.0.73",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [