insta 0.0.83 → 0.1.1

package/dist/config.js

@@ -19,42 +19,60 @@ const LINK_PLANE_FILE = 'link-plane.json';
 // The cloud API default. Only affects fresh installs: a persisted apiUrl (from a prior login) or
 // INSTA_API_URL wins below.
 const DEFAULT_API = ENVS[DEFAULT_ENV].api;
+// The runtime `--api-url` flag, set by index.ts's preAction hook before any action loads config.
+// Process-local, never persisted: a debugging override must not rewrite the machine's login.
+let cliApiUrlOverride;
+export function setApiUrlOverride(url) {
+    cliApiUrlOverride = url;
+}
+/** Which control plane this process talks to, and which stored session (if any) may travel with
+ *  it. Pure: `parsed` is the persisted file (null when absent or unreadable), `env` the process
+ *  environment, `cliOverride` the runtime flag. Precedence, most explicit first:
+ *    1. --api-url (runtime flag) — this invocation only.
+ *    2. INSTA_API_URL — a literal URL. Overrides the persisted apiUrl, not just the default,
+ *       otherwise the env var is silently ignored as soon as any login has written a config file.
+ *       It also outranks INSTA_ENV: a hand-written URL is the more specific instruction, and it
+ *       is the only way to reach a host no environment name covers (insta-oss, a preview).
+ *    3. INSTA_ENV — a named environment (see env.ts), resolved to its api host.
+ *    4. the persisted apiUrl, written by `insta login --env|--api-url` or `insta env use`.
+ *    5. DEFAULT_API.
+ *
+ *  An override that points at a DIFFERENT deployment than the stored session was minted for must
+ *  not carry that session along. `env use` already drops it on an explicit switch; without this,
+ *  `INSTA_ENV=staging insta …` on a prod-logged-in machine sends prod's bearer to staging and then
+ *  — on the 401 — POSTs prod's REFRESH token to staging's /auth/refresh (api.ts), which is the
+ *  cross-deployment credential leak env.ts's header calls out as never allowed. In-memory only:
+ *  the file keeps the real login, so unsetting the override restores it. A custom host (insta-oss,
+ *  a preview) is treated the same way — its session is equally foreign. */
+export function pickApiUrl(parsed, env, cliOverride) {
+    // `env` is the environment this call is deciding for, so an ABSENT property means unset — not
+    // "ask the real process". envFromEnvVar defaults its parameter to process.env.INSTA_ENV, so
+    // passing it `env.INSTA_ENV` unguarded made a caller handing in `{}` (every test, and any future
+    // caller with a synthetic environment) silently read the ambient one instead.
+    const named = env.INSTA_ENV === undefined ? null : envFromEnvVar(env.INSTA_ENV);
+    const override = cliOverride ?? env.INSTA_API_URL ?? (named ? ENVS[named].api : undefined);
+    if (!parsed)
+        return { apiUrl: override ?? DEFAULT_API };
+    const persisted = parsed.apiUrl ?? DEFAULT_API;
+    if (override && normalizeUrl(override) !== normalizeUrl(persisted)) {
+        const scrubbed = { ...parsed, apiUrl: override };
+        delete scrubbed.accessToken;
+        delete scrubbed.refreshToken;
+        delete scrubbed.user;
+        delete scrubbed.agentCredential;
+        return scrubbed;
+    }
+    return { ...parsed, apiUrl: override ?? persisted };
+}
 export async function readGlobal() {
-    // Precedence, most explicit first:
-    //   1. INSTA_API_URL  — a literal URL. Overrides the persisted apiUrl, not just the default,
-    //      otherwise the env var is silently ignored as soon as any login has written a config file.
-    //      It also outranks INSTA_ENV: a hand-written URL is the more specific instruction, and it
-    //      is the only way to reach a host no environment name covers (insta-oss, a preview).
-    //   2. INSTA_ENV      — a named environment (see env.ts), resolved to its api host.
-    //   3. the persisted apiUrl, written by `insta login --env|--api-url` or `insta env use`.
-    //   4. DEFAULT_API.
-    const envApi = process.env.INSTA_API_URL;
-    const named = envFromEnvVar();
-    const override = envApi ?? (named ? ENVS[named].api : undefined);
+    let parsed;
     try {
-        const parsed = JSON.parse(await readFile(GLOBAL_FILE, 'utf8'));
-        const persisted = parsed.apiUrl ?? DEFAULT_API;
-        // An override that points at a DIFFERENT deployment than the stored session was minted for
-        // must not carry that session along. `env use` already drops it on an explicit switch; without
-        // this, `INSTA_ENV=staging insta …` on a prod-logged-in machine sends prod's bearer to staging
-        // and then — on the 401 — POSTs prod's REFRESH token to staging's /auth/refresh (api.ts), which
-        // is the cross-deployment credential leak env.ts's header calls out as never allowed.
-        //
-        // In-memory only: the file keeps the real login, so unsetting the override restores it. A
-        // custom host (insta-oss, a preview) is treated the same way — its session is equally foreign.
-        if (override && normalizeUrl(override) !== normalizeUrl(persisted)) {
-            const scrubbed = { ...parsed, apiUrl: override };
-            delete scrubbed.accessToken;
-            delete scrubbed.refreshToken;
-            delete scrubbed.user;
-            delete scrubbed.agentCredential;
-            return scrubbed;
-        }
-        return { ...parsed, apiUrl: override ?? persisted };
+        parsed = JSON.parse(await readFile(GLOBAL_FILE, 'utf8'));
     }
     catch {
-        return { apiUrl: override ?? DEFAULT_API };
+        parsed = null;
     }
+    return pickApiUrl(parsed, process.env, cliApiUrlOverride);
 }
 /** The environment the CLI is currently pointed at, plus everything derived from it. `env` is null
  *  when apiUrl is a custom host (insta-oss, a preview deployment) — deliberate, and left alone.

package/dist/deploy-archive.js

@@ -80,7 +80,7 @@ export async function deployArchive(api, projectId, ref, branch, opts, now = Dat
     const operationId = started.body?.operationId;
     if (typeof operationId !== 'string' || !operationId)
         throw new Error('the platform accepted the deploy but returned no operation id — re-run the deploy');
-    log(`build logs: insta build-logs ${operationId}`);
+    log(`build logs: insta build logs ${operationId}`);
     if (started.body?.resumed === true)
         log('resuming the deploy this archive already started');
     const deadline = now() + DEPLOY_DEADLINE_MS;
@@ -93,7 +93,7 @@ export async function deployArchive(api, projectId, ref, branch, opts, now = Dat
         }
     })().catch(() => {
         if (!logController.signal.aborted)
-            log(`Could not follow build logs. Retry with: insta build-logs ${operationId}`);
+            log(`Could not follow build logs. Retry with: insta build logs ${operationId}`);
     }) : undefined;
     let last = '';
     try {

package/dist/ensure-skills.js

@@ -27,7 +27,7 @@ const GITIGNORE_COMMENT = '# InstaCloud: agent skills installed by `npx skills a
 // existing AI_AGENT (e.g. running inside another agent) rather than clobbering it.
 const defaultRunner = (cmdIn, argsIn, inherit = false) => new Promise((resolve) => {
     // resolveSpawnable: on Windows `npx` is a .cmd shim spawn() refuses without a shell —
-    // re-enter npm's CLI script via node instead (same treatment as `insta setup agent`).
+    // re-enter npm's CLI script via node instead (same treatment as `insta agent setup`).
     const { cmd, args } = resolveSpawnable(cmdIn, argsIn);
     const env = { ...process.env, AI_AGENT: process.env.AI_AGENT || 'insta' };
     // npx exports its flags as npm_config_* to children; npm_config_package would pin the inner