insta 0.1.13 → 0.1.16

package/README.md

@@ -231,7 +231,7 @@ build never reaches a production installer.
 | `insta secrets` | Write `.env`, plus `list` · `set` · `unset` · `bind` · `unbind` · `bindings` · `sources` · `tree` |
 | `insta domain` | Bought or bring-your-own: `attach` · `check` · `detach`; buy through InstaCloud: `search` · `buy` · `list` · `status` · `records …` |
 | `insta compute` | `start` · `stop` · `suspend` · `restart` · `status` · `scale` · `limits` · `volume` · `always-on` · `exec` · `ssh` · `repo` · `connect-repo` · `watch-paths` · `disconnect-repo` · `logs` · `metrics` |
-| `insta postgres` | `url` (print the DSN) · `connect` (psql) · `stats` · `limits` · `volume` · `always-on` · `private-access` · `public-access` · `logs` · `metrics` — every verb takes `[service]` |
+| `insta postgres` | `url` (print the DSN) · `connect` (psql) · `stats` · `limits` · `restart` · `volume` · `always-on` · `private-access` · `public-access` · `logs` · `metrics` — every verb takes `[service]` |
 | `insta redis` · `mysql` · `mongodb` | `query` · `status` · `limits` · `volume` · `always-on` · `logs` · `metrics` |
 | `insta storage` | `list` · `get` · `delete` · `set-access` |
 | `insta build [dir]` · `deploy [dir]` | Verify a source dir would build; deploy a source directory (built remotely) or `--image <url>`. `insta build logs <id>` reads source-build output: `--source archive` (default) uses the deploy operation ID, `--source github` uses a GitHub build ID; `--follow` watches output, `--json` returns one snapshot |

package/dist/commands/auth.js

@@ -325,7 +325,7 @@ export async function claimGrant(email, client, post, wait = sleepSeconds, open,
     throw expired();
 }
 // Start a loopback server, open the browser at the platform bridge, and await the token.
-function browserOauth(apiUrl, provider) {
+export function browserOauth(apiUrl, provider, open = openUrl) {
     return new Promise((resolve, reject) => {
         const state = randomBytes(16).toString('hex');
         let timer;
@@ -340,7 +340,7 @@ function browserOauth(apiUrl, provider) {
             const err = url.searchParams.get('error');
             const ok = !!token && !err && url.searchParams.get('state') === state;
             res.writeHead(ok ? 200 : 400, { 'content-type': 'text/html' });
-            res.end(`<!doctype html><meta charset=utf-8><body style="font-family:system-ui;text-align:center;margin-top:4rem"><h2>InstaCloud</h2><p>${ok ? '✓ Login complete — you can close this tab.' : '✗ Login failed' + (err ? ` (${err})` : '')}</p></body>`);
+            res.end(`<!doctype html><meta charset=utf-8><body style="font-family:system-ui;text-align:center;margin-top:4rem"><h2>InstaCloud</h2><p>${ok ? '✓ Login complete — you can close this tab.' : '✗ Login failed' + (err ? ` (${err.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;')})` : '')}</p></body>`);
             clearTimeout(timer);
             server.close();
             if (err)
@@ -362,7 +362,7 @@ function browserOauth(apiUrl, provider) {
             // event, so openUrl's return value cannot see it (e.g. powershell.exe blocked by AppLocker
             // on hardened fleets) — and the silent variant of that failure looks exactly like a hang.
             info(`if nothing opens, use this URL:\n  ${authorizeUrl}`);
-            openUrl(authorizeUrl);
+            open(authorizeUrl);
             info('waiting for you to finish in the browser… (times out in 2m; ctrl-c to abort)');
             timer = setTimeout(() => { server.close(); reject(new Error('timed out waiting for browser login (2m)')); }, 120_000);
         });

package/dist/commands/deploy.js

@@ -147,12 +147,9 @@ export async function deploy(dir, opts) {
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
     const log = note(opts);
-    // Junk fails here, before a directory is packed and uploaded for a body the platform would only
-    // refuse: the same parser every other --port in this CLI runs. `Number()` alone sent NaN as
-    // `null` and let 0 or 70000 travel to the server.
     let port;
     try {
-        port = opts.port === undefined ? undefined : parsePort(opts.port);
+        port = opts.port === undefined ? undefined : parsePort(opts.port, { allowZero: true });
     }
     catch (e) {
         die(`--${e.message}`);

package/dist/commands/mcp.js

@@ -51,6 +51,20 @@ export function renderJsonConfig(slug, existing, url, name = MCP_SERVER_NAME) {
     }
     return JSON.stringify(root, null, 2) + '\n';
 }
+export function tomlBasicString(value) {
+    const escaped = value.replace(/[\u0000-\u0008\u000A-\u001F\u007F\\"]/g, (ch) => {
+        switch (ch) {
+            case '\\': return '\\\\';
+            case '"': return '\\"';
+            case '\n': return '\\n';
+            case '\r': return '\\r';
+            case '\b': return '\\b';
+            case '\f': return '\\f';
+            default: return `\\u${ch.charCodeAt(0).toString(16).padStart(4, '0')}`;
+        }
+    });
+    return `"${escaped}"`;
+}
 // Codex config is TOML. Appending a complete `[mcp_servers.<name>]` table is always valid at
 // EOF, so we avoid a TOML parser: string-detect for idempotency, append for install.
 export function renderCodexConfig(existing, url, name = MCP_SERVER_NAME) {
@@ -58,7 +72,7 @@ export function renderCodexConfig(existing, url, name = MCP_SERVER_NAME) {
     if (base.includes(`[mcp_servers.${name}]`))
         return null; // already configured
     const sep = base.length && !base.endsWith('\n') ? '\n' : '';
-    return `${base}${sep}\n[mcp_servers.${name}]\nurl = "${url}"\n`;
+    return `${base}${sep}\n[mcp_servers.${name}]\nurl = ${tomlBasicString(url)}\n`;
 }
 // Install for one agent. Returns 'installed' | 'already' | 'skipped' (unparseable config).
 export async function installFor(slug, home, url, name = MCP_SERVER_NAME) {

package/dist/commands/postgres.js

@@ -282,6 +282,29 @@ export async function dbVolume(service, opts) {
     const vg = res.body?.volumeGib;
     info(`postgres ${service ?? 'default'}: volume ${typeof vg === 'number' ? `grown to ${vg}Gi` : `set to ${sizeGib}Gi`}`);
 }
+export async function dbRestart(service, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const qs = new URLSearchParams();
+    const branch = opts.branch ?? p.branch;
+    if (branch)
+        qs.set('branch', branch);
+    if (service)
+        qs.set('group', service);
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/database/restart${qs.toString() ? `?${qs}` : ''}`);
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    info(restartLine(service ?? 'default', res.body));
+}
+export function restartLine(group, body) {
+    if (body?.pending)
+        return `postgres ${group}: restart accepted and still in progress — settings apply once it is back up`;
+    if (body?.state === 'suspended')
+        return `postgres ${group}: suspended, not restarted — pending settings apply when the next connection starts it`;
+    return `postgres ${group}: restarted — ALTER SYSTEM settings that need a restart are now in effect`;
+}
 export async function resolveDbUrl(api, projectId, branch, service, json) {
     const { services } = await api.request('GET', `/projects/${projectId}/services${q(branch)}`);
     const svc = resolveSoleService(services, 'postgres', service);

package/dist/commands/services.js

@@ -47,14 +47,13 @@ export function parseCount(raw) {
     }
     return n;
 }
-// Parse a TCP port. Junk fails here rather than reaching the API as NaN (the parseCpu lesson).
-// Decimal digits only, as parseVolumeGib: `Number()` alone would quietly read 0x1f90 as 8080 and
-// 1e3 as 1000, and a port written in hex is a typo worth reporting, not one worth honouring.
-export function parsePort(raw) {
+// Keep TCP-only callers strict; port 0 is reserved for explicitly opted-in compute workers.
+export function parsePort(raw, opts = {}) {
+    const min = opts.allowZero ? 0 : 1;
     const m = /^\s*(\d+)\s*$/.exec(raw);
     const n = m ? Number(m[1]) : NaN;
-    if (!Number.isInteger(n) || n < 1 || n > 65535)
-        throw new Error(`port must be an integer between 1 and 65535, got: ${raw}`);
+    if (!Number.isInteger(n) || n < min || n > 65535)
+        throw new Error(`port must be an integer between ${min} and 65535, got: ${raw}`);
     return n;
 }
 // Parse a volume size in whole Gi: "10" or "10Gi" (suffix case-insensitive — unlike the db
@@ -112,10 +111,11 @@ function defaultDatabasePort(type) {
 export function servicesAddRequestBody(type, name, branch, opts) {
     return {
         type, name, ...(branch ? { branch } : {}), public: !!opts.public,
-        ...(opts.image ? { image: opts.image } : {}), ...(opts.port ? { port: parsePort(opts.port) } : {}),
+        ...(opts.image ? { image: opts.image } : {}), ...(opts.port !== undefined ? { port: parsePort(opts.port, { allowZero: type === 'compute' }) } : {}),
         ...(opts.region ? { region: opts.region } : {}),
-        // Sent whenever the flag was given, false included: compute is born always-on by default,
-        // so `--no-always-on` must reach the API as an explicit false. Omitted means the platform default.
+        // Sent whenever the flag was given, false included: the birth default is platform config
+        // (INSTA_COMPUTE_ALWAYS_ON_DEFAULT, scale-to-zero unless set), so an explicit --no-always-on
+        // must reach the API as false to hold whatever that config says. Omitted means the platform default.
         ...(opts.alwaysOn !== undefined ? { alwaysOn: opts.alwaysOn } : {}),
         ...(opts.volume !== undefined ? { volumeGib: parseVolumeGib(opts.volume) } : {}),
         ...(opts.mountPath !== undefined ? { volumeMountPath: opts.mountPath } : {}),
@@ -130,10 +130,10 @@ export async function servicesAdd(type, name, opts = {}) {
         throw new Error('--region is not valid for storage services');
     if (opts.image && type !== 'compute')
         throw new Error('--image is only valid for compute services');
-    if (opts.port) {
+    if (opts.port !== undefined) {
         if (type !== 'compute')
             throw new Error('--port is only valid for compute services');
-        parsePort(opts.port); // junk fails here, before any config/network access
+        parsePort(opts.port, { allowZero: true });
     }
     // Presence, not truthiness: `--no-always-on` is an explicit false and is just as compute-only.
     if (opts.alwaysOn !== undefined && type !== 'compute')

package/dist/config.js

@@ -2,9 +2,9 @@
 import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { realpathSync } from 'node:fs';
-import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { chmod, lstat, mkdir, readFile, writeFile } from 'node:fs/promises';
 import { ensureGitignore } from './gitignore.js';
-import { die } from './util.js';
+import { die, writeFileAtomicSync } from './util.js';
 import { DEFAULT_ENV, ENVS, envForApiUrl, envFromEnvVar, normalizeUrl } from './env.js';
 const GLOBAL_DIR = join(homedir(), '.insta');
 const GLOBAL_FILE = join(GLOBAL_DIR, 'config.json');
@@ -109,8 +109,10 @@ export async function readPersistedGlobal() {
     }
 }
 export async function writeGlobal(c) {
-    await mkdir(GLOBAL_DIR, { recursive: true });
-    await writeFile(GLOBAL_FILE, JSON.stringify(c, null, 2));
+    await mkdir(GLOBAL_DIR, { recursive: true, mode: 0o700 });
+    if (process.platform !== 'win32' && !(await lstat(GLOBAL_DIR)).isSymbolicLink())
+        await chmod(GLOBAL_DIR, 0o700);
+    writeFileAtomicSync(GLOBAL_FILE, JSON.stringify(c, null, 2));
 }
 /** The home directory is never a project root. `~/.insta/` is this CLI's GLOBAL config directory,
  *  so a project.json there is not a project link: honouring one made every directory under the home

package/dist/deploy-archive.js

@@ -121,7 +121,7 @@ export async function deployArchive(api, projectId, ref, branch, opts, now = Dat
             if (state === 'live') {
                 const image = res.body?.imageRef;
                 const url = res.body?.url;
-                if (typeof image !== 'string' || !image || typeof url !== 'string' || !url) {
+                if (typeof image !== 'string' || !image || typeof url !== 'string' || (!url && opts.port !== '0')) {
                     throw new Error('the deploy finished but the platform returned no image or URL for it — check `insta status`');
                 }
                 const optionalString = (field, v) => {

package/dist/index.js

@@ -153,9 +153,9 @@ svc.command('add [type] [name]').description('Provision a service on demand (com
     .option('--region <region>', 'region for postgres/compute/managed databases, e.g. us-east (see `insta config regions`)')
     .option('--public', 'storage only: serve the bucket with anonymous public-read (default private)')
     .option('--image <url>', 'compute only: run this container image at creation')
-    .option('--port <n>', 'compute only: port the image listens on (default 8080)')
-    .option('--always-on', 'compute only: create as always-on — never scales to zero (the default for new compute services; all plans; billing is actual usage either way)')
-    .option('--no-always-on', 'compute only: create as scale-to-zero — idle machines suspend and wake on the next request')
+    .option('--port <n>', 'compute only: port the image listens on (default 8080; 0 for a worker without a routed port)')
+    .option('--always-on', 'compute only: create as always-on — never scales to zero (all plans; billing is actual usage either way). A worker (--port 0) is always-on regardless')
+    .option('--no-always-on', 'compute only: create as scale-to-zero — idle machines suspend and wake on the next request (the default for new compute services; refused with --port 0, a worker cannot scale to zero)')
     .option('--mount-path <path>', 'compute only: container mount path for a new volume (requires --volume; default /data)')
     .option('--volume <gi>', 'compute only: attach a persistent volume of this many whole Gi (also attachable later: `insta compute volume <name> --size <gi>`). Any plan may attach up to its own plan cap (10Gi free, 50Gi paid by default; the bare `insta compute volume <name>` read prints it as plan max); a size above the free cap is paid. Volume services keep 1 machine and stop (cold wake) instead of suspend when idle')
     .option('--pg-version <major>', 'postgres only: the Postgres major version to create the database on — 16, 17 or 18 (default 16). Fixed for the database\'s lifetime; branches keep it')
@@ -365,7 +365,7 @@ compute.command('start [service]').description('Bring a compute service online (
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStart(service, o)));
 compute.command('stop [service]').description('Take a compute service offline; traffic will NOT wake it until `start`')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStop(service, o)));
-compute.command('suspend [service]').description('Suspend a compute service (RAM snapshot); stays down until `start`')
+compute.command('suspend [service]').description('Suspend a compute service (RAM snapshot); traffic can wake it unless already stopped; `start` clears the stop')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeSuspend(service, o)));
 compute.command('restart [service]').description("Restart a compute service by re-running the image it already runs against a freshly resolved env bundle — this is how a changed secret or binding reaches a running machine (env is baked into the machine at deploy time), and how a machine that is up but wedged gets cycled (`start` no-ops on one that is already started). No new image, no new spec. The service must be running: a stopped or suspended one comes back with `insta compute start`. All plans; gated: deploy — it lands configuration the same way a deploy does, so a policy denying deploys denies this too (`start`/`stop` stay ungated, and cycle a wedged machine without one). A service whose app fails to answer on its port coming back up reports that failure, and the machines are rolled back, best-effort, to the config they were serving")
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeRestart(service, o)));
@@ -379,7 +379,7 @@ compute.command('scale [count] [service]').description('Set a compute service sa
 compute.command('limits [service]').description("Show or set a compute service's resource ceiling (any plan within the free cap; raising above it needs a paid plan). --memory is the dial; cpu derives from it unless --cpu is given. Billing is actual usage — the ceiling caps what the app may burn, it is not a price")
     .option('--memory <size>', 'memory ceiling, e.g. 512mb or 1gb').option('--cpu <n>', 'vCPU ceiling override (provider sizes: 1, 2, 4, 6, 8)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeLimits(service, o)));
-compute.command('always-on <mode> [service]').description('Set a compute service always-on (mode: on|off). on = machines never scale to zero (the default for new compute services); off = scale-to-zero. All plans; billing is actual usage either way')
+compute.command('always-on <mode> [service]').description('Set a compute service always-on (mode: on|off). on = machines never scale to zero; off = scale-to-zero (the default for new compute services; refused on a worker, port 0). All plans; billing is actual usage either way')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((mode, service, o) => computeCmd.computeAlwaysOn(mode, service, o)));
 compute.command('ssh [service]')
     .description("Issue a short-lived SSH certificate for a compute service and print the command that uses it -- this command does NOT open the session itself, it makes `ssh` work. `--setup` does the one-time work: it generates a dedicated key under ~/.insta/ssh (your existing keys are never touched), has the platform sign a SHORT-LIVED certificate for it, adds one @cert-authority line to ~/.ssh/known_hosts so every region is trusted without per-node fingerprint prompts, and writes an ssh_config block AT THE TOP of ~/.ssh/config giving each compute service the alias `<service>.insta`. After that it is plain `ssh api.insta`, scp and -L: the block renews that alias's certificate for you while OpenSSH parses the config. Needs an interactive login -- API keys are refused; use `insta compute exec` for one-shot commands from CI")
@@ -423,7 +423,7 @@ compute.command('volume [service]').description("Show, attach, grow, remount, or
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeVolume(service, o)));
 addObservability(compute, 'compute', 'compute');
 // ---- postgres ----
-const pg = program.command('postgres').description('Postgres services: connection string, psql, stats, resource ceiling, volume, always-on, network access, logs, metrics');
+const pg = program.command('postgres').description('Postgres services: connection string, psql, stats, resource ceiling, restart, volume, always-on, network access, logs, metrics');
 pg.command('url [service]').description('Print the postgres connection string (DSN) — bare on stdout for piping, e.g. `psql "$(insta postgres url)"` (gated: secrets.read). `insta secrets` includes the primary postgres service\'s DATABASE_URL; use this command to select a specific postgres service')
     .option('--json').option('--branch <branch>', 'branch (default: current)')
     .action(guard((service, o) => pgCmd.dbUrl(service, o)));
@@ -437,6 +437,9 @@ pg.command('limits [service]').description("Show or set a postgres service's res
     .option('--cpu <n>', 'vCPU ceiling, e.g. 2 or 2500m').option('--memory <size>', 'memory ceiling, e.g. 4Gi')
     .option('--json').option('--branch <branch>', 'branch (default: current)')
     .action(guard((service, o) => pgCmd.dbLimits(service, o)));
+pg.command('restart [service]').description("Restart the postgres server so settings written with ALTER SYSTEM that need a restart (wal_level, max_wal_senders, max_replication_slots, …) take effect. Connections drop while it restarts; waits for it to finish. A suspended instance stays suspended and picks the settings up on its next connection. insta-db-backed only (gated: deploy)")
+    .option('--json').option('--branch <branch>', 'branch (default: current)')
+    .action(guard((service, o) => pgCmd.dbRestart(service, o)));
 pg.command('volume [service]').description("Show or grow a postgres service's provisioned volume (block disk; insta-db-backed only). No --size: print size and the plan cap (any plan). --size grows it (paid plans; grow-only — a provisioned disk cannot shrink). Billing is actual data stored — the size is a cap, not a price")
     .option('--size <gi>', 'new size in whole Gi, e.g. 10 (must be ≥ the current size)')
     .option('--json').option('--branch <branch>', 'branch (default: current)')
@@ -515,7 +518,7 @@ buildCmd.command('logs <build-id>').description('Read source-build output for a
     .action(guard((id, opts) => buildLogs(id, opts)));
 // ---- deploy ----
 program.command('deploy [dir]').description('Deploy a source directory (built remotely; on insta-compute a Dockerfile is optional and nixpacks detects the runtime) or a prebuilt --image to a branch compute group')
-    .option('--image <url>', 'prebuilt container image to deploy (instead of a source dir)').option('--branch <b>').option('--group <g>').option('--port <p>')
+    .option('--image <url>', 'prebuilt container image to deploy (instead of a source dir)').option('--branch <b>').option('--group <g>').option('--port <p>', 'port the app listens on (0 for a worker without a routed port)')
     .option('--websocket', 'run a WebSocket app (larger guest + connection-based concurrency)')
     .option('--replace-source', 'the service deploys from a connected GitHub repo: switch it to this image and remove the repo connection (admin); without it such a deploy is refused')
     .option('--json', 'print the deploy result as JSON (build progress goes to stderr)')

package/dist/observe/hook.js

@@ -1,6 +1,6 @@
 // PostToolUse hook: reads a tool-use event on stdin (Claude Code / Codex), scans every string
 // surface for credential exposure, and appends findings to ./.insta/audit.jsonl.
-import { appendFileSync, mkdirSync } from 'node:fs';
+import { appendFileSync, chmodSync, mkdirSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { scanEvent } from './scanner.js';
@@ -27,9 +27,15 @@ export function recordFindings(event, baseDir) {
         tool: event.tool_name ?? null,
         cwd: event.cwd ?? null,
     };
-    mkdirSync(instaDir, { recursive: true });
+    mkdirSync(instaDir, { recursive: true, mode: 0o700 });
+    // Windows ACLs do not store these modes. On POSIX a failure must surface: main() prints it.
+    if (process.platform !== 'win32')
+        chmodSync(instaDir, 0o700);
     const lines = findings.map((f) => JSON.stringify({ ...common, ...f })).join('\n') + '\n';
-    appendFileSync(join(instaDir, 'audit.jsonl'), lines, 'utf8');
+    const auditPath = join(instaDir, 'audit.jsonl');
+    appendFileSync(auditPath, lines, { encoding: 'utf8', mode: 0o600 });
+    if (process.platform !== 'win32')
+        chmodSync(auditPath, 0o600);
     return findings.length;
 }
 async function readStdin() {

package/dist/observe/scanner.js

@@ -8,7 +8,7 @@ const DETECTORS = [
     { name: 'stripe_secret_key', rx: /\b[rs]k_(?:live|test)_[A-Za-z0-9]{16,}\b/gd, group: false },
     { name: 'llm_api_key', rx: /\bsk-(?:ant-)?[A-Za-z0-9_-]{20,}\b/gd, group: false },
     { name: 'google_api_key', rx: /\bAIza[0-9A-Za-z_-]{35}\b/gd, group: false },
-    { name: 'private_key_block', rx: /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/gd, group: false },
+    { name: 'private_key_block', rx: /-----BEGIN ((?:[A-Z ]+ )?PRIVATE KEY)-----(?:(?:[ \t\r\n]|\\[rn])*(?:Proc-Type|DEK-Info):[^\r\n\\]*(?:\r?\n|\\[rn]|$))*(?:[A-Za-z0-9+/=\r\n \t]|\\[rn])*(?:-----END \1-----)?/gd, group: false },
     { name: 'jwt', rx: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/gd, group: false },
     { name: 'db_conn_string', rx: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^:\s/@]+:[^@\s/]+@[^\s'"]+/gd, group: false },
     { name: 'bearer_token', rx: /\bbearer\s+([A-Za-z0-9._-]{20,})/gid, group: true },
@@ -41,17 +41,13 @@ function fingerprint(secret, detector) {
     const tail = last4 ? '••••' + last4 : '••••';
     return `${detector}:${tail}:#${h}`;
 }
-function snippet(text, span, fp) {
-    const [s, e] = span;
-    const redacted = text.slice(0, s) + '«' + fp + '»' + text.slice(e);
-    const marker = '«' + fp + '»';
-    const i = redacted.indexOf(marker);
-    const start = Math.max(0, i - 36);
-    const end = Math.min(redacted.length, i + marker.length + 36);
-    let out = redacted.slice(start, end).replace(/\s+/g, ' ').trim();
+function snippet(text, offset, fp) {
+    const start = Math.max(0, offset - 36);
+    const end = Math.min(text.length, offset + fp.length + 2 + 36);
+    let out = text.slice(start, end).replace(/\s+/g, ' ').trim();
     if (start > 0)
         out = '…' + out;
-    if (end < redacted.length)
+    if (end < text.length)
         out = out + '…';
     return out.slice(0, 160);
 }
@@ -104,8 +100,12 @@ function scanText(text) {
     hits.sort((a, b) => a[0] - b[0] || a[1] - b[1]); // stable: earlier detector wins an equal span
     const kept = [];
     for (const r of hits) {
-        if (kept.some((k) => !(r[1] <= k[0] || r[0] >= k[1])))
+        const previous = kept.at(-1);
+        if (previous && r[0] < previous[1]) {
+            previous[1] = Math.max(previous[1], r[1]);
+            previous[3] = text.slice(previous[0], previous[1]);
             continue;
+        }
         kept.push(r);
     }
     return kept;
@@ -178,10 +178,20 @@ export function scanEvent(event, opts = {}) {
         if (!text || text.length > 1_000_000)
             continue;
         const side = surface.startsWith('input') ? 'input' : 'output';
-        for (const [start, end, detector, secret] of scanText(text)) {
-            const fp = fingerprint(secret, detector);
+        let redacted = '';
+        let cursor = 0;
+        const hits = scanText(text).map(([start, end, detector, secret]) => {
+            const fp = fingerprint(secret.trimEnd(), detector);
+            redacted += text.slice(cursor, start);
+            const offset = redacted.length;
+            redacted += `«${fp}»`;
+            cursor = end;
+            return { detector, fp, offset };
+        });
+        redacted += text.slice(cursor);
+        for (const { detector, fp, offset } of hits) {
             const [kind, sev, sink, note] = classify(tool, side, command, filePath, secretFileTarget);
-            add(kind, sev, detector, `${tool}:${surface}`, sink, fp, snippet(text, [start, end], fp), note);
+            add(kind, sev, detector, `${tool}:${surface}`, sink, fp, snippet(redacted, offset, fp), note);
         }
     }
     return findings;

package/dist/pack.js

@@ -109,31 +109,8 @@ function walk(root, rel, out, links, ig, files, flavour, cap = Infinity) {
         }
     }
 }
-// The walk classifies with lstat and the read happens later, so a plain readFileSync would
-// FOLLOW a symlink that replaced the file in between and put a file from outside the directory
-// into an archive that promises none. Two guards, and neither is a full one on its own:
-//
-//   O_NOFOLLOW refuses when the final component is a symlink AT OPEN TIME, closing the swap the
-//   walk cannot see. Undefined on Windows, where it degrades to the check below.
-//
-//   fstat on the OPEN HANDLE must still describe the file the walk measured: same inode, same
-//   device, same size. Its job is the tar's own consistency -- a file rewritten to a different
-//   length mid-pack would otherwise produce a header whose count disagrees with its payload.
-//
-// Two things neither closes, and both are stated rather than implied away:
-//
-//   An ANCESTOR directory swapped for a symlink. Node exposes no openat, so resolving each
-//   component against a directory handle is not available here.
-//
-//   A same-size plain file deleted and recreated. Measured on linux rather than assumed: the
-//   inode is REUSED and mtimeNs/ctimeNs are byte-identical for a delete+create inside one
-//   timestamp tick, so no stat-based identity can see it. It is also the least interesting case
-//   -- the symlink promise still holds, the tar stays well formed because the length did not
-//   move, and the archive simply carries a slightly newer copy of a file the caller owns.
-//
-// The residual on both is narrow: someone able to rewrite files and directories inside the tree
-// being packed can already put any bytes they like into it by writing them.
-export function readEntry(abs, e) {
+// O_NOFOLLOW closes final-component symlink swaps only on platforms that expose it.
+export function readEntry(abs, e, platform = process.platform) {
     const noFollow = constants.O_NOFOLLOW ?? 0;
     let fd;
     try {
@@ -147,8 +124,10 @@ export function readEntry(abs, e) {
     }
     try {
         const st = fstatSync(fd);
+        // Some Windows libuv versions omit lstat's device ID; inode and size must still match.
+        const missingDevice = platform === 'win32' && (e.dev === 0 || e.dev === 0n);
         const same = st.isFile() && st.size === e.size
-            && (e.ino === undefined || st.ino === e.ino) && (e.dev === undefined || st.dev === e.dev);
+            && (e.ino === undefined || st.ino === e.ino) && (e.dev === undefined || missingDevice || st.dev === e.dev);
         if (!same)
             throw new Error(`${e.path} changed while packing — re-run the deploy`);
         return readFileSync(fd);

package/dist/resolve-service.js

@@ -70,7 +70,7 @@ export async function resolveServiceArgs(type, name, deps, given = {}) {
         throw new Error(missingArgsMessage(type));
     // A bad --port is a typo in the command, not an answer: fail before asking anything.
     if (given.port !== undefined)
-        parsePort(given.port);
+        parsePort(given.port, { allowZero: !type || type === 'compute' });
     const kind = type
         ? SERVICE_KINDS.find((k) => k.type === type && !k.needsImage)
         : await deps.selectKind(SERVICE_KINDS);
@@ -133,12 +133,12 @@ export async function promptServiceName(kind, suggested) {
 }
 export async function promptPort(fallback) {
     const answer = await clack.text({
-        message: 'Port the image listens on:',
+        message: 'Port the image listens on (0 for a worker):',
         initialValue: fallback,
         // The rule the command enforces, so the prompt and a --port can never disagree.
         validate: (v) => {
             try {
-                parsePort(v.trim());
+                parsePort(v.trim(), { allowZero: true });
                 return undefined;
             }
             catch (e) {

package/dist/util.js

@@ -1,5 +1,6 @@
 // Output + small pure helpers (env serialization is unit-tested).
 import { createInterface } from 'node:readline';
+import { Writable } from 'node:stream';
 import { spawn } from 'node:child_process';
 import { chmodSync, copyFileSync, existsSync, lstatSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
@@ -253,17 +254,39 @@ export function serializeEnv(bundle) {
         .map(([k, v]) => `${k}="${v.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`)
         .join('\n') + '\n');
 }
-// Hidden password prompt (best-effort: mutes echo on a TTY).
-export function promptPassword(label = 'Password: ') {
-    return new Promise((resolve) => {
-        const rl = createInterface({ input: process.stdin, output: process.stdout });
-        const stdout = process.stdout;
-        process.stdout.write(label);
-        let captured = '';
-        stdout._writeToOutput = (s) => { if (s.includes('\n'))
-            process.stdout.write('\n'); };
-        rl.on('line', (line) => { captured = line; rl.close(); });
-        rl.on('close', () => resolve(captured));
+export function mutePasswordOutput(real) {
+    return new Writable({
+        write(chunk, _encoding, callback) {
+            const text = Buffer.isBuffer(chunk) ? chunk.toString('utf8') : String(chunk);
+            const endings = text.replace(/[^\r\n]/g, '');
+            if (endings.length)
+                real.write(endings);
+            callback();
+        },
+    });
+}
+export function promptPasswordFrom(input, output, label = 'Password: ') {
+    return new Promise((resolve, reject) => {
+        let value = '';
+        const rl = createInterface({
+            input,
+            output: mutePasswordOutput(output),
+            // TTY stdin needs raw mode even when stdout is redirected, or the terminal echoes secrets.
+            terminal: Boolean(input.isTTY),
+        });
+        output.write(label);
+        rl.on('SIGINT', () => {
+            reject(new CliCancel());
+            rl.close();
+        });
+        rl.on('line', (line) => {
+            value = line;
+            rl.close();
+        });
+        rl.on('close', () => resolve(value));
     });
 }
+export function promptPassword(label = 'Password: ') {
+    return promptPasswordFrom(process.stdin, process.stdout, label);
+}
 //# sourceMappingURL=util.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.13",
+  "version": "0.1.16",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [