insta 0.0.73 → 0.0.75

package/dist/commands/upgrade.js

@@ -343,9 +343,22 @@ export async function autoupdate(mode) {
 }
 // Called once at CLI start-up. Never blocks: reads the cache synchronously, prints at most one
 // stderr line, and (when due) spawns detached children for the registry check / quiet upgrade.
+/** Commands that must never nudge about an update or spawn a background one.
+ *
+ *  `upgrade`/`autoupdate` are the update machinery itself. Every `__` command
+ *  is internal machinery rather than a user at a prompt, and the rule is
+ *  written as a PREFIX so the next such command inherits it instead of
+ *  rediscovering it -- which is exactly how this was missed:
+ *  `__ssh-ensure-cert` is run by OpenSSH while it PARSES ssh_config, on every
+ *  ssh, scp, `ssh -G` and IDE connection, so a nudge here is written straight
+ *  into the ssh session's stderr and an auto-upgrade spawns a detached process
+ *  mid-connection. Same prefix rule trackCommand already applies to telemetry.
+ */
+export function skipsUpdateCheck(cmd) {
+    return cmd === 'upgrade' || cmd === 'autoupdate' || !!cmd?.startsWith('__');
+}
 export function maybeUpdate(current, argv) {
-    const cmd = argv[2];
-    if (cmd === 'upgrade' || cmd === 'autoupdate' || cmd === '__update-check')
+    if (skipsUpdateCheck(argv[2]))
         return;
     const channel = detectChannel();
     const cache = readCache();

package/dist/config.js

@@ -48,6 +48,7 @@ export async function readGlobal() {
             delete scrubbed.accessToken;
             delete scrubbed.refreshToken;
             delete scrubbed.user;
+            delete scrubbed.agentCredential;
             return scrubbed;
         }
         return { ...parsed, apiUrl: override ?? persisted };

package/dist/index.js

@@ -79,11 +79,12 @@ program.name('insta').description('InstaCloud CLI — manage projects, branches,
 program.option('--agent', 'run as an agent with a verified project session and project agent policy');
 program.hook('preAction', () => configureAgent(detectAgent(!!program.opts().agent)));
 // ---- auth ----
-program.command('login').description('Log in — bare: sign in from your browser (any account type); or --email <email> + password, --oauth <github|google>, --device (headless), --api-key <insta_…> (headless, durable token)')
+program.command('login').description('Log in — bare: sign in from your browser (any account type); or --email <email> + password, --oauth <github|google>, --device (headless), --claim <email> (agent: the named user confirms a code), --api-key <insta_…> (headless, durable token)')
     .option('--email <email>', 'account email (email + password login)')
     .option('--password <password>', 'account password (else $INSTA_PASSWORD or prompt; needs --email)')
     .option('--oauth <provider>', 'browser OAuth login: github | google')
     .option('--device', 'device-code login: like bare login but never opens a browser here — approve from any other machine (VMs, SSH, CI)')
+    .option('--claim <email>', 'agent login confirmed by that user: prints a console link + 6-digit code; they sign in as that email and type the code, and the resulting insta_ key is stored here')
     .option('--api-key <key>', 'non-interactive login with a durable insta_ API token (headless agents / CI)')
     .option('--api-url <url>', 'control-plane API base URL')
     .option('--env <name>', `deployment environment: ${ENV_NAMES.join(' | ')}`)
@@ -247,6 +248,13 @@ compute.command('limits [service]').description("Show or set a compute service's
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeLimits(service, o)));
 compute.command('always-on <mode> [service]').description('Set a compute service always-on (mode: on|off). on = machines never scale to zero (the default for new compute services); off = scale-to-zero. All plans; billing is actual usage either way')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((mode, service, o) => computeCmd.computeAlwaysOn(mode, service, o)));
+compute.command('ssh [service]')
+    .description("Issue a short-lived SSH certificate for a compute service and print the command that uses it -- this command does NOT open the session itself, it makes `ssh` work. `--setup` does the one-time work: it generates a dedicated key under ~/.insta/ssh (your existing keys are never touched), has the platform sign a SHORT-LIVED certificate for it, adds one @cert-authority line to ~/.ssh/known_hosts so every region is trusted without per-node fingerprint prompts, and writes an ssh_config block AT THE TOP of ~/.ssh/config giving each compute service the alias `<service>.insta`. After that it is plain `ssh api.insta`, scp and -L: the block renews that alias's certificate for you while OpenSSH parses the config. Needs an interactive login -- API keys are refused; use `insta compute exec` for one-shot commands from CI")
+    .option('--setup', 'do the one-time client setup as well as issuing a certificate')
+    .option('--ensure-cert <alias>', 'renew the certificate for an alias such as api.insta if it is close to expiry, then exit (used by the ssh_config hook; silent by design)')
+    .option('-b, --branch <branch>', 'branch (default: linked)')
+    .option('--json', 'machine-readable output')
+    .action(guard((service, o) => computeCmd.computeSSH(service, o)));
 const execCmd = compute.command('exec [service]').description("Run a one-shot command inside a compute service's machine (`insta compute exec [service] -- <command> [args…]`) — no interactive shell/PTY: `command` is argv, no shell is invoked (use [\"sh\", \"-c\", \"...\"] for shell features). Wakes the machine first if it's scaled to zero — expect a few seconds of latency, billed as uptime, not an error. Exits with the remote command's own exit code (agents rely on this)")
     .action(guard((service, o) => computeCmd.computeExec(service, execCommand, o, { windowsFallback: execWindowsFallback })));
 // Declared from the same list splitExecArgs uses to find where the CLI's own arguments stop, so a
@@ -389,11 +397,11 @@ ob.command('sync').description('Upload findings into the project timeline').acti
 // ---- policy ----
 const agentPol = program.command('agent-policy').description('Project agent access policy');
 agentPol.command('get').option('--json').action(guard((o) => agentPolicy.get(o)));
-agentPol.command('set <mode>').description('full-access | read-only | branch-developer')
+agentPol.command('set <mode>').description('full-access | read-only | branch-specific (resets rules; customize comes from `rule set`)')
     .option('--json').action(guard((mode, o) => agentPolicy.set(mode, o)));
 agentPol.command('protect-branch <branch>').option('--json').action(guard((branch, o) => agentPolicy.protect(branch, true, o)));
 agentPol.command('unprotect-branch <branch>').option('--json').action(guard((branch, o) => agentPolicy.protect(branch, false, o)));
-agentPol.command('rule').command('set <action> <decision>').description('Set an unprotected-branch rule: allow | deny | approve')
+agentPol.command('rule').command('set <action> <decision>').description('Set an unprotected-branch rule (allow | deny | approve); moves the policy to customize')
     .option('--json').action(guard((action, decision, o) => agentPolicy.rule(action, decision, o)));
 agentPol.command('revoke-sessions').description('Revoke ALL CLI agent sessions for this project')
     .option('--json').action(guard((o) => agentPolicy.revoke(o)));
@@ -420,6 +428,16 @@ program.command('upgrade').description('Update the insta CLI to the latest relea
 program.command('autoupdate [mode]').description('Show or set auto-update: on | off (default: on while pre-1.0)')
     .action(guard((mode) => selfUpdate.autoupdate(mode)));
 program.command('__update-check', { hidden: true }).action(guard(() => selfUpdate.backgroundCheck(cliVersion())));
+// The ssh_config renewal hook. Hidden, and named with the `__` prefix that
+// trackCommand skips, because OpenSSH runs it while PARSING the config on EVERY
+// ssh/scp/`ssh -G`/IDE connection. Under the normal `compute ssh --ensure-cert`
+// path, guard's trackCommand ran afterwards regardless of the action returning
+// early -- reading config, possibly creating ~/.insta/telemetry.json, and
+// making a PostHog request with a timeout of up to 1.5s. That is a network
+// round trip on the critical path of every ordinary ssh, which is exactly what
+// the hook was specified not to do.
+program.command('__ssh-ensure-cert <alias>', { hidden: true })
+    .action(guard((alias) => computeCmd.ensureCertForAlias(alias)));
 selfUpdate.maybeUpdate(cliVersion(), process.argv);
 program.parseAsync(computeArgv);
 //# sourceMappingURL=index.js.map

package/dist/util.js

@@ -1,6 +1,105 @@
 // Output + small pure helpers (env serialization is unit-tested).
 import { createInterface } from 'node:readline';
 import { spawn } from 'node:child_process';
+import { chmodSync, copyFileSync, existsSync, lstatSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { randomBytes } from 'node:crypto';
+/**
+ * Replace a file's contents in one step: write a sibling temporary file, then
+ * rename it over the target.
+ *
+ * For files the USER also owns — `~/.ssh/config`, `known_hosts` — a plain
+ * writeFileSync is a truncate followed by a write, so an interrupt, a full disk
+ * or a crash between the two leaves the user with a half a config and no way to
+ * ssh anywhere. rename(2) is atomic, so a reader sees either the old file or
+ * the new one. `backup` additionally leaves the previous contents recoverable.
+ *
+ * A SYMLINK is followed to its target first. Keeping a dotfiles repo and
+ * symlinking `~/.ssh/config` at it is a common setup, and rename(2) replaces
+ * the link itself rather than writing through it -- so the naive version
+ * silently severs the link, leaving the repo holding a copy that no longer
+ * matches the file ssh reads and the next dotfiles sync quietly reverting our
+ * block. Resolving first keeps the write atomic (the temp file still lands
+ * beside the real file, on the real file's filesystem) AND keeps the link.
+ */
+export function writeFileAtomicSync(target, data, opts = {}) {
+    const mode = opts.mode ?? 0o600;
+    const path = resolveThroughSymlink(target);
+    const tmp = join(dirname(path), `.${basename(path)}.insta-${process.pid}-${randomBytes(6).toString('hex')}`);
+    try {
+        writeFileSync(tmp, data, { mode });
+        // writeFileSync applies `mode` only when it CREATES the file, and a umask
+        // can clear bits even then. ssh refuses a group-readable config outright.
+        chmodSync(tmp, mode);
+        if (opts.backup && existsSync(path))
+            copyFileSync(path, path + '.insta-bak');
+        renameSync(tmp, path);
+    }
+    catch (e) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch { /* never created, or already gone */ }
+        throw e;
+    }
+}
+/** The file `path` ultimately NAMES: itself when it is not a link, otherwise the
+ *  end of the symlink chain -- whether or not that end exists yet.
+ *
+ *  A DANGLING link resolves to the target it names, not to itself. `realpath`
+ *  gives up with ENOENT there, and returning the link path made the caller
+ *  rename over the LINK: a `~/.ssh/config` symlinked into a dotfiles repo that
+ *  has not been populated yet -- a fresh clone, a new machine -- was silently
+ *  turned into a regular file, destroying wiring that `readlink` could still
+ *  read off the link perfectly well. So the chain is walked by hand from there,
+ *  and the write lands on the file the user actually pointed at, creating it.
+ *
+ *  Every OTHER failure still propagates. A blanket catch was a quiet hole:
+ *  `ELOOP` (a symlink cycle) and `EACCES` (a directory the user cannot
+ *  traverse) would both return the link path and sever a link because we could
+ *  not read it. Cannot-confirm is not a licence to write -- and with the
+ *  dangling case handled above, there is no longer any case where replacing a
+ *  link is the right answer. */
+export function resolveThroughSymlink(path) {
+    // realpath resolves a live chain in one call and reports ELOOP for a cycle,
+    // so a hand-walk only ever runs past the point where the chain dangles --
+    // which is finite by construction. The cap is for a link created underneath
+    // us mid-walk, where finite is no longer guaranteed.
+    for (let hop = 0; hop <= MAX_SYMLINK_HOPS; hop++) {
+        let link;
+        try {
+            if (!lstatSync(path).isSymbolicLink())
+                return path;
+            return realpathSync(path);
+        }
+        catch (e) {
+            if (e?.code !== 'ENOENT')
+                throw e;
+        }
+        try {
+            link = readlinkSync(path);
+        }
+        catch (e) {
+            // ENOENT from both calls means nothing is at `path` at all -- it is the
+            // file to create, which is what the caller wants written.
+            if (e?.code === 'ENOENT')
+                return path;
+            throw e;
+        }
+        // Link text is resolved against the directory holding the LINK, as the
+        // kernel does it -- not against the process cwd, which would scatter files
+        // into wherever the CLI happened to be run from. The REAL directory, too:
+        // the kernel resolves a relative target from where the link actually
+        // lives, so when `~/.ssh` is itself a link into a dotfiles repo, a
+        // `../x` inside it names a sibling of the repo directory, not of `~/.ssh`.
+        // The directory exists (the link was just lstat'ed inside it), and any
+        // failure resolving it propagates like every other one above.
+        path = resolve(realpathSync(dirname(path)), link);
+    }
+    throw new Error(`too many levels of symbolic links resolving ${JSON.stringify(path)}`);
+}
+/** Linux allows 40; the exact number does not matter, only that the walk ends. */
+const MAX_SYMLINK_HOPS = 40;
 /** How to launch the default browser for `url` on `platform`. Pure so the Windows encoding is
  *  testable. On Windows NO shell may ever parse the URL: cmd.exe splits at bare `&` (which #138
  *  fixed by quoting) but ALSO expands `%…%` sequences even inside quotes, and a percent-encoded

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.73",
+  "version": "0.0.75",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [