insta 0.0.72 → 0.0.74

package/dist/commands/upgrade.js

@@ -343,9 +343,22 @@ export async function autoupdate(mode) {
 }
 // Called once at CLI start-up. Never blocks: reads the cache synchronously, prints at most one
 // stderr line, and (when due) spawns detached children for the registry check / quiet upgrade.
+/** Commands that must never nudge about an update or spawn a background one.
+ *
+ *  `upgrade`/`autoupdate` are the update machinery itself. Every `__` command
+ *  is internal machinery rather than a user at a prompt, and the rule is
+ *  written as a PREFIX so the next such command inherits it instead of
+ *  rediscovering it -- which is exactly how this was missed:
+ *  `__ssh-ensure-cert` is run by OpenSSH while it PARSES ssh_config, on every
+ *  ssh, scp, `ssh -G` and IDE connection, so a nudge here is written straight
+ *  into the ssh session's stderr and an auto-upgrade spawns a detached process
+ *  mid-connection. Same prefix rule trackCommand already applies to telemetry.
+ */
+export function skipsUpdateCheck(cmd) {
+    return cmd === 'upgrade' || cmd === 'autoupdate' || !!cmd?.startsWith('__');
+}
 export function maybeUpdate(current, argv) {
-    const cmd = argv[2];
-    if (cmd === 'upgrade' || cmd === 'autoupdate' || cmd === '__update-check')
+    if (skipsUpdateCheck(argv[2]))
         return;
     const channel = detectChannel();
     const cache = readCache();

package/dist/config.js

@@ -48,6 +48,7 @@ export async function readGlobal() {
             delete scrubbed.accessToken;
             delete scrubbed.refreshToken;
             delete scrubbed.user;
+            delete scrubbed.agentCredential;
             return scrubbed;
         }
         return { ...parsed, apiUrl: override ?? persisted };

package/dist/index.js

@@ -79,11 +79,12 @@ program.name('insta').description('InstaCloud CLI — manage projects, branches,
 program.option('--agent', 'run as an agent with a verified project session and project agent policy');
 program.hook('preAction', () => configureAgent(detectAgent(!!program.opts().agent)));
 // ---- auth ----
-program.command('login').description('Log in — bare: sign in from your browser (any account type); or --email <email> + password, --oauth <github|google>, --device (headless), --api-key <insta_…> (headless, durable token)')
+program.command('login').description('Log in — bare: sign in from your browser (any account type); or --email <email> + password, --oauth <github|google>, --device (headless), --claim <email> (agent: the named user confirms a code), --api-key <insta_…> (headless, durable token)')
     .option('--email <email>', 'account email (email + password login)')
     .option('--password <password>', 'account password (else $INSTA_PASSWORD or prompt; needs --email)')
     .option('--oauth <provider>', 'browser OAuth login: github | google')
     .option('--device', 'device-code login: like bare login but never opens a browser here — approve from any other machine (VMs, SSH, CI)')
+    .option('--claim <email>', 'agent login confirmed by that user: prints a console link + 6-digit code; they sign in as that email and type the code, and the resulting insta_ key is stored here')
     .option('--api-key <key>', 'non-interactive login with a durable insta_ API token (headless agents / CI)')
     .option('--api-url <url>', 'control-plane API base URL')
     .option('--env <name>', `deployment environment: ${ENV_NAMES.join(' | ')}`)
@@ -247,6 +248,13 @@ compute.command('limits [service]').description("Show or set a compute service's
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeLimits(service, o)));
 compute.command('always-on <mode> [service]').description('Set a compute service always-on (mode: on|off). on = machines never scale to zero (the default for new compute services); off = scale-to-zero. All plans; billing is actual usage either way')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((mode, service, o) => computeCmd.computeAlwaysOn(mode, service, o)));
+compute.command('ssh [service]')
+    .description("Issue a short-lived SSH certificate for a compute service and print the command that uses it -- this command does NOT open the session itself, it makes `ssh` work. `--setup` does the one-time work: it generates a dedicated key under ~/.insta/ssh (your existing keys are never touched), has the platform sign a SHORT-LIVED certificate for it, adds one @cert-authority line to ~/.ssh/known_hosts so every region is trusted without per-node fingerprint prompts, and writes an ssh_config block AT THE TOP of ~/.ssh/config giving each compute service the alias `<service>.insta`. After that it is plain `ssh api.insta`, scp and -L: the block renews that alias's certificate for you while OpenSSH parses the config. Needs an interactive login -- API keys are refused; use `insta compute exec` for one-shot commands from CI")
+    .option('--setup', 'do the one-time client setup as well as issuing a certificate')
+    .option('--ensure-cert <alias>', 'renew the certificate for an alias such as api.insta if it is close to expiry, then exit (used by the ssh_config hook; silent by design)')
+    .option('-b, --branch <branch>', 'branch (default: linked)')
+    .option('--json', 'machine-readable output')
+    .action(guard((service, o) => computeCmd.computeSSH(service, o)));
 const execCmd = compute.command('exec [service]').description("Run a one-shot command inside a compute service's machine (`insta compute exec [service] -- <command> [args…]`) — no interactive shell/PTY: `command` is argv, no shell is invoked (use [\"sh\", \"-c\", \"...\"] for shell features). Wakes the machine first if it's scaled to zero — expect a few seconds of latency, billed as uptime, not an error. Exits with the remote command's own exit code (agents rely on this)")
     .action(guard((service, o) => computeCmd.computeExec(service, execCommand, o, { windowsFallback: execWindowsFallback })));
 // Declared from the same list splitExecArgs uses to find where the CLI's own arguments stop, so a
@@ -255,7 +263,7 @@ for (const [flags, description] of computeCmd.EXEC_OPTIONS)
     execCmd.option(flags, description);
 compute.command('repo [service]').description('Show what a compute service deploys from: the image it runs, or the GitHub repository — owner/repo, the branch it builds, root directory, which paths a push must change to redeploy it, and whether pushes redeploy it at all')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => githubCmd.computeRepo(service, o)));
-compute.command('connect-repo <owner/repo> [service]').description("Connect a GitHub repository to an EXISTING compute service: the repo is built (its Dockerfile, or nixpacks when there is none) and deployed into that service, and every later push to the tracked repository branch redeploys it. The repo must be one your own GitHub account can reach through the InstaCloud App, or be public; the first connect from a terminal prints a GitHub URL and a code to authorize it once. Build and start commands come from detection and cannot be set. Connecting again replaces the service's current source")
+compute.command('connect-repo <owner/repo> [service]').description("Connect a GitHub repository to an EXISTING compute service: the repo is built (its Dockerfile, or nixpacks when there is none) and deployed into that service, and every later push to the tracked repository branch redeploys it. The repo must be one your own GitHub account can reach through the InstaCloud App, or be public; the CLI opens GitHub for device-code authorization and App installation or configuration when needed, then waits for repository access and continues. URLs are also printed for remote terminals; --json requires access to be ready. Build and start commands come from detection and cannot be set. Connecting again replaces the service's current source")
     .option('--public', 'the repo is public and no GitHub App installation is needed (deploys are manual; pushes cannot redeploy)')
     .option('--root-dir <dir>', 'the directory of the repo to build (a monorepo with several deployable directories lists them and exits 1 without it)')
     .option('--repo-branch <name>', "the repository branch to build (default: the repo's default branch)")
@@ -389,11 +397,11 @@ ob.command('sync').description('Upload findings into the project timeline').acti
 // ---- policy ----
 const agentPol = program.command('agent-policy').description('Project agent access policy');
 agentPol.command('get').option('--json').action(guard((o) => agentPolicy.get(o)));
-agentPol.command('set <mode>').description('full-access | read-only | branch-developer')
+agentPol.command('set <mode>').description('full-access | read-only | branch-specific (resets rules; customize comes from `rule set`)')
     .option('--json').action(guard((mode, o) => agentPolicy.set(mode, o)));
 agentPol.command('protect-branch <branch>').option('--json').action(guard((branch, o) => agentPolicy.protect(branch, true, o)));
 agentPol.command('unprotect-branch <branch>').option('--json').action(guard((branch, o) => agentPolicy.protect(branch, false, o)));
-agentPol.command('rule').command('set <action> <decision>').description('Set an unprotected-branch rule: allow | deny | approve')
+agentPol.command('rule').command('set <action> <decision>').description('Set an unprotected-branch rule (allow | deny | approve); moves the policy to customize')
     .option('--json').action(guard((action, decision, o) => agentPolicy.rule(action, decision, o)));
 agentPol.command('revoke-sessions').description('Revoke ALL CLI agent sessions for this project')
     .option('--json').action(guard((o) => agentPolicy.revoke(o)));
@@ -420,6 +428,16 @@ program.command('upgrade').description('Update the insta CLI to the latest relea
 program.command('autoupdate [mode]').description('Show or set auto-update: on | off (default: on while pre-1.0)')
     .action(guard((mode) => selfUpdate.autoupdate(mode)));
 program.command('__update-check', { hidden: true }).action(guard(() => selfUpdate.backgroundCheck(cliVersion())));
+// The ssh_config renewal hook. Hidden, and named with the `__` prefix that
+// trackCommand skips, because OpenSSH runs it while PARSING the config on EVERY
+// ssh/scp/`ssh -G`/IDE connection. Under the normal `compute ssh --ensure-cert`
+// path, guard's trackCommand ran afterwards regardless of the action returning
+// early -- reading config, possibly creating ~/.insta/telemetry.json, and
+// making a PostHog request with a timeout of up to 1.5s. That is a network
+// round trip on the critical path of every ordinary ssh, which is exactly what
+// the hook was specified not to do.
+program.command('__ssh-ensure-cert <alias>', { hidden: true })
+    .action(guard((alias) => computeCmd.ensureCertForAlias(alias)));
 selfUpdate.maybeUpdate(cliVersion(), process.argv);
 program.parseAsync(computeArgv);
 //# sourceMappingURL=index.js.map

package/dist/util.js

@@ -1,6 +1,105 @@
 // Output + small pure helpers (env serialization is unit-tested).
 import { createInterface } from 'node:readline';
 import { spawn } from 'node:child_process';
+import { chmodSync, copyFileSync, existsSync, lstatSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { randomBytes } from 'node:crypto';
+/**
+ * Replace a file's contents in one step: write a sibling temporary file, then
+ * rename it over the target.
+ *
+ * For files the USER also owns — `~/.ssh/config`, `known_hosts` — a plain
+ * writeFileSync is a truncate followed by a write, so an interrupt, a full disk
+ * or a crash between the two leaves the user with a half a config and no way to
+ * ssh anywhere. rename(2) is atomic, so a reader sees either the old file or
+ * the new one. `backup` additionally leaves the previous contents recoverable.
+ *
+ * A SYMLINK is followed to its target first. Keeping a dotfiles repo and
+ * symlinking `~/.ssh/config` at it is a common setup, and rename(2) replaces
+ * the link itself rather than writing through it -- so the naive version
+ * silently severs the link, leaving the repo holding a copy that no longer
+ * matches the file ssh reads and the next dotfiles sync quietly reverting our
+ * block. Resolving first keeps the write atomic (the temp file still lands
+ * beside the real file, on the real file's filesystem) AND keeps the link.
+ */
+export function writeFileAtomicSync(target, data, opts = {}) {
+    const mode = opts.mode ?? 0o600;
+    const path = resolveThroughSymlink(target);
+    const tmp = join(dirname(path), `.${basename(path)}.insta-${process.pid}-${randomBytes(6).toString('hex')}`);
+    try {
+        writeFileSync(tmp, data, { mode });
+        // writeFileSync applies `mode` only when it CREATES the file, and a umask
+        // can clear bits even then. ssh refuses a group-readable config outright.
+        chmodSync(tmp, mode);
+        if (opts.backup && existsSync(path))
+            copyFileSync(path, path + '.insta-bak');
+        renameSync(tmp, path);
+    }
+    catch (e) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch { /* never created, or already gone */ }
+        throw e;
+    }
+}
+/** The file `path` ultimately NAMES: itself when it is not a link, otherwise the
+ *  end of the symlink chain -- whether or not that end exists yet.
+ *
+ *  A DANGLING link resolves to the target it names, not to itself. `realpath`
+ *  gives up with ENOENT there, and returning the link path made the caller
+ *  rename over the LINK: a `~/.ssh/config` symlinked into a dotfiles repo that
+ *  has not been populated yet -- a fresh clone, a new machine -- was silently
+ *  turned into a regular file, destroying wiring that `readlink` could still
+ *  read off the link perfectly well. So the chain is walked by hand from there,
+ *  and the write lands on the file the user actually pointed at, creating it.
+ *
+ *  Every OTHER failure still propagates. A blanket catch was a quiet hole:
+ *  `ELOOP` (a symlink cycle) and `EACCES` (a directory the user cannot
+ *  traverse) would both return the link path and sever a link because we could
+ *  not read it. Cannot-confirm is not a licence to write -- and with the
+ *  dangling case handled above, there is no longer any case where replacing a
+ *  link is the right answer. */
+export function resolveThroughSymlink(path) {
+    // realpath resolves a live chain in one call and reports ELOOP for a cycle,
+    // so a hand-walk only ever runs past the point where the chain dangles --
+    // which is finite by construction. The cap is for a link created underneath
+    // us mid-walk, where finite is no longer guaranteed.
+    for (let hop = 0; hop <= MAX_SYMLINK_HOPS; hop++) {
+        let link;
+        try {
+            if (!lstatSync(path).isSymbolicLink())
+                return path;
+            return realpathSync(path);
+        }
+        catch (e) {
+            if (e?.code !== 'ENOENT')
+                throw e;
+        }
+        try {
+            link = readlinkSync(path);
+        }
+        catch (e) {
+            // ENOENT from both calls means nothing is at `path` at all -- it is the
+            // file to create, which is what the caller wants written.
+            if (e?.code === 'ENOENT')
+                return path;
+            throw e;
+        }
+        // Link text is resolved against the directory holding the LINK, as the
+        // kernel does it -- not against the process cwd, which would scatter files
+        // into wherever the CLI happened to be run from. The REAL directory, too:
+        // the kernel resolves a relative target from where the link actually
+        // lives, so when `~/.ssh` is itself a link into a dotfiles repo, a
+        // `../x` inside it names a sibling of the repo directory, not of `~/.ssh`.
+        // The directory exists (the link was just lstat'ed inside it), and any
+        // failure resolving it propagates like every other one above.
+        path = resolve(realpathSync(dirname(path)), link);
+    }
+    throw new Error(`too many levels of symbolic links resolving ${JSON.stringify(path)}`);
+}
+/** Linux allows 40; the exact number does not matter, only that the walk ends. */
+const MAX_SYMLINK_HOPS = 40;
 /** How to launch the default browser for `url` on `platform`. Pure so the Windows encoding is
  *  testable. On Windows NO shell may ever parse the URL: cmd.exe splits at bare `&` (which #138
  *  fixed by quoting) but ALSO expands `%…%` sequences even inside quotes, and a percent-encoded

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.72",
+  "version": "0.0.74",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [