insta 0.0.9 → 0.0.11

package/dist/api.js

@@ -1,7 +1,8 @@
 // Thin API client over the platform control-plane. Handles bearer auth + one-shot refresh on 401.
 // 2xx (including 202 approval_required) returns the parsed body; >=400 throws ApiError.
-import { readGlobal, writeGlobal, readProject } from './config.js';
-import { die } from './util.js';
+import { readGlobal, writeGlobal, readProject, writeProject } from './config.js';
+import { autoResolveProject, promptChoice } from './resolve-project.js';
+import { die, info } from './util.js';
 export class ApiError extends Error {
     status;
     constructor(status, msg) {
@@ -92,8 +93,29 @@ export async function linkedProject() { return readProject(); }
 // Resolve the linked project or exit with guidance.
 export async function requireProject() {
     const p = await readProject();
-    if (!p)
-        die('no linked project — run `insta project create <name>` or `insta project link <id>`');
-    return p;
+    if (p)
+        return p;
+    // One command, just works: unlinked ≠ error. Resolve the project (auto when there's one,
+    // one-keystroke picker when several) and persist the choice so this happens once per dir.
+    const api = await ApiClient.load();
+    try {
+        const orgs = (await api.request('GET', '/orgs')).orgs;
+        const orgId = orgs[0]?.id ?? 'local';
+        return await autoResolveProject(orgId, {
+            listProjects: async () => (await api.request('GET', `/orgs/${orgId}/projects`)).projects,
+            promptChoice,
+            save: async (c) => {
+                await writeProject(c);
+                info(`auto-linked project ${c.projectId} → ./.insta/project.json`);
+            },
+            tty: !!process.stdin.isTTY && !!process.stderr.isTTY,
+        });
+    }
+    catch (e) {
+        if (e instanceof ApiError && e.status === 401) {
+            die('not logged in — run `insta login --oauth github` (cloud) or point INSTA_API_URL at your insta-oss daemon');
+        }
+        die(e instanceof Error ? e.message : String(e));
+    }
 }
 //# sourceMappingURL=api.js.map

package/dist/commands/run.js

@@ -0,0 +1,40 @@
+// `insta run -- <cmd>` — the Railway model for credentials: fetch the branch's secret bundle
+// per invocation and inject it into the CHILD PROCESS ENVIRONMENT only. Nothing is written to
+// disk, so there is no .env to leak, stale-out, or commit. The bundle exists exactly as long
+// as the process does.
+import { spawn } from 'node:child_process';
+import { ApiClient, requireProject } from '../api.js';
+import { die, info } from '../util.js';
+/** Core, dependency-injected for tests: spawn cmd with the bundle in env, return its exit code. */
+export async function runWithSecrets(cmd, args, deps) {
+    const bundle = await deps.fetchBundle();
+    return await new Promise((resolve, reject) => {
+        const child = (deps.spawnImpl ?? spawn)(cmd, args, {
+            stdio: 'inherit',
+            cwd: deps.cwd,
+            env: { ...process.env, ...bundle },
+        });
+        child.on('error', reject);
+        child.on('close', (code) => resolve(code ?? 1));
+    });
+}
+export async function run(cmdAndArgs, opts) {
+    const [cmd, ...rest] = cmdAndArgs;
+    if (!cmd)
+        die('usage: insta run [--branch <b>] -- <command> [args…]');
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const code = await runWithSecrets(cmd, rest, {
+        fetchBundle: async () => {
+            const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets?branch=${encodeURIComponent(branch)}`);
+            if (res.status === 202) {
+                die(`secrets.read requires approval — run: insta approvals approve ${res.body.approvalId}, then re-run`);
+            }
+            info(`running with ${Object.keys(res.body.secrets).length} injected secrets (branch ${branch}) — nothing written to disk`);
+            return res.body.secrets;
+        },
+    });
+    process.exit(code);
+}
+//# sourceMappingURL=run.js.map

package/dist/commands/secrets.js

@@ -1,4 +1,6 @@
 import { writeFile } from 'node:fs/promises';
+import { appendFileSync, existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { ApiClient, requireProject } from '../api.js';
 import { info, printJson, serializeEnv, handleApproval, die } from '../util.js';
 function q(branch) {
@@ -22,6 +24,9 @@ export async function secrets(opts) {
     const out = opts.output ?? '.env';
     await writeFile(out, serializeEnv(bundle));
     info(`wrote ${Object.keys(bundle).length} secrets to ${out} (branch ${branch})`);
+    if (ensureIgnored(process.cwd(), out))
+        info(`  .gitignore += ${out} (credentials must never be committed)`);
+    info('  tip: `insta run -- <cmd>` injects these per-run with nothing written to disk');
 }
 export async function secretsList(opts) {
     const api = await ApiClient.load();
@@ -62,4 +67,15 @@ export async function secretsUnset(name, opts) {
         return;
     info(`unset ${name} (${opts.branch ? `branch ${opts.branch}` : 'project-wide'})`);
 }
+/** Gitignore the env file we just wrote (git repos only; idempotent). Returns true if added. */
+export function ensureIgnored(cwd, name) {
+    if (!existsSync(join(cwd, '.git')))
+        return false;
+    const gi = join(cwd, '.gitignore');
+    const current = existsSync(gi) ? readFileSync(gi, 'utf8') : '';
+    if (current.split('\n').some((l) => l.trim() === name))
+        return false;
+    appendFileSync(gi, (current.endsWith('\n') || current === '' ? '' : '\n') + name + '\n');
+    return true;
+}
 //# sourceMappingURL=secrets.js.map

package/dist/commands/setup.js

@@ -7,11 +7,41 @@
 // project doubles as its stack manifest — that install happens on `project create|link`.
 import { spawn } from 'node:child_process';
 import { info } from '../util.js';
+// The skills tool reports agents that don't support user-global installs (Eve, PromptScript, …)
+// as red failures. That's expected reality, not a problem with THIS machine — showing red in the
+// first 30s of onboarding erodes trust (Railway's installer reads all-green for a reason).
+// Classify each output line: drop that expected noise, keep everything real.
+export function classifyInstallLine(line) {
+    if (/does not support global skill installation/.test(line))
+        return 'skip';
+    if (/Failed to install \d+/.test(line))
+        return 'skip';
+    return 'keep';
+}
 const defaultRunner = (cmd, args) => new Promise((resolve) => {
-    const env = { ...process.env, AI_AGENT: process.env.AI_AGENT || 'insta' };
-    const p = spawn(cmd, args, { stdio: 'inherit', env });
+    const env = { ...process.env, AI_AGENT: process.env.AI_AGENT || 'insta', FORCE_COLOR: '1' };
+    const p = spawn(cmd, args, { stdio: ['inherit', 'pipe', 'pipe'], env });
+    let skipped = 0;
+    const sift = (chunk) => {
+        for (const line of chunk.toString().split('\n')) {
+            // strip ANSI before classifying; print the original line to preserve the tool's styling
+            const plain = line.replace(/\x1b\[[0-9;]*m/g, '');
+            if (classifyInstallLine(plain) === 'skip') {
+                skipped++;
+                continue;
+            }
+            if (line.trim())
+                process.stdout.write(line + '\n');
+        }
+    };
+    p.stdout?.on('data', sift);
+    p.stderr?.on('data', sift);
     p.on('error', () => resolve({ ok: false }));
-    p.on('close', (code) => resolve({ ok: code === 0 }));
+    p.on('close', (code) => {
+        if (skipped)
+            info(`  (skipped ${skipped >= 3 ? 'some' : skipped} agent targets that don't support user-global installs — expected)`);
+        resolve({ ok: code === 0 });
+    });
 });
 // -g = user-level (machine-global); -a '*' = every agent dir the skills tool supports
 // (Claude Code, Codex, Cursor, OpenCode, Copilot, …); --copy = real files, not cache symlinks.

package/dist/config.js

@@ -40,6 +40,15 @@ export async function findProjectRoot(cwd = process.cwd()) {
     }
 }
 export async function readProject(cwd = process.cwd()) {
+    // Linkless targeting (CI / one-offs / agents): INSTA_PROJECT_ID resolves the project with no
+    // link file, and beats one when both exist — an explicit parameter outranks ambient state.
+    if (process.env.INSTA_PROJECT_ID) {
+        return {
+            projectId: process.env.INSTA_PROJECT_ID,
+            orgId: process.env.INSTA_ORG_ID ?? '',
+            branch: process.env.INSTA_BRANCH ?? 'main',
+        };
+    }
     const root = await findProjectRoot(cwd);
     if (!root)
         return null;

package/dist/index.js

@@ -5,6 +5,7 @@ import { ApiError } from './api.js';
 import { die } from './util.js';
 import * as auth from './commands/auth.js';
 import * as setup from './commands/setup.js';
+import * as runCmd from './commands/run.js';
 import * as org from './commands/org.js';
 import * as project from './commands/project.js';
 import * as branch from './commands/branch.js';
@@ -56,6 +57,11 @@ program.command('login').description('Log in with email + password, or --oauth <
     .action(guard((o) => auth.login(o)));
 program.command('logout').description('Log out and clear local tokens').action(guard(() => auth.logout()));
 program.command('status').description('Show login + linked project').option('--json').action(guard((o) => auth.status(o)));
+// ---- run (per-request secret injection — nothing written to disk) ----
+program.command('run <cmd> [args...]').description('Run a command with the branch credential bundle injected into its environment (no .env written)')
+    .option('--branch <b>', 'branch bundle to inject (default: linked branch)')
+    .passThroughOptions().allowUnknownOption()
+    .action(guard((cmd, args, o) => runCmd.run([cmd, ...(args ?? [])], o)));
 // ---- agent setup (the `curl … | sh --agents` target) ----
 const setupCmd = program.command('setup').description('Set up this machine for InstaCloud agent workflows');
 setupCmd.command('agent').description('Install the insta skill user-globally for all coding agents')

package/dist/resolve-project.js

@@ -0,0 +1,45 @@
+// "One command, just works": when a command needs a project and the directory isn't linked
+// (and no INSTA_PROJECT_ID is set), resolve it instead of lecturing about `project link` —
+// one project auto-selects silently, several get a one-keystroke picker, and either way the
+// choice is SAVED so this happens at most once per directory. (Railway prompts every unlinked
+// machine; we persist the answer and, via the committed link file, share it with the team.)
+import { createInterface } from 'node:readline/promises';
+export async function autoResolveProject(orgId, deps) {
+    const projects = await deps.listProjects();
+    if (projects.length === 0) {
+        throw new Error('no projects yet — start one with `insta project create <name>`');
+    }
+    let picked;
+    if (projects.length === 1) {
+        picked = projects[0];
+    }
+    else if (deps.tty) {
+        picked = await deps.promptChoice(projects);
+    }
+    else {
+        const list = projects.map((p) => `  ${p.id}  ${p.name}`).join('\n');
+        throw new Error(`several projects and no terminal to pick — set INSTA_PROJECT_ID or run \`insta project link <id>\`:\n${list}`);
+    }
+    const cfg = { projectId: picked.id, orgId, branch: 'main' };
+    await deps.save(cfg);
+    return cfg;
+}
+/** Real picker: numbered list on stderr, one line of input. Dependency-free. */
+export async function promptChoice(items) {
+    process.stderr.write('pick a project:\n');
+    items.forEach((p, i) => process.stderr.write(`  ${i + 1}) ${p.name}  (${p.id})\n`));
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        for (;;) {
+            const answer = (await rl.question(`1-${items.length} > `)).trim();
+            const idx = Number(answer) - 1;
+            const hit = items[idx];
+            if (hit)
+                return hit;
+        }
+    }
+    finally {
+        rl.close();
+    }
+}
+//# sourceMappingURL=resolve-project.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.9",
+  "version": "0.0.11",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [