insta 0.1.15 → 0.1.17

package/README.md

@@ -231,7 +231,7 @@ build never reaches a production installer.
 | `insta secrets` | Write `.env`, plus `list` · `set` · `unset` · `bind` · `unbind` · `bindings` · `sources` · `tree` |
 | `insta domain` | Bought or bring-your-own: `attach` · `check` · `detach`; buy through InstaCloud: `search` · `buy` · `list` · `status` · `records …` |
 | `insta compute` | `start` · `stop` · `suspend` · `restart` · `status` · `scale` · `limits` · `volume` · `always-on` · `exec` · `ssh` · `repo` · `connect-repo` · `watch-paths` · `disconnect-repo` · `logs` · `metrics` |
-| `insta postgres` | `url` (print the DSN) · `connect` (psql) · `stats` · `limits` · `volume` · `always-on` · `private-access` · `public-access` · `logs` · `metrics` — every verb takes `[service]` |
+| `insta postgres` | `url` (print the DSN) · `connect` (psql) · `stats` · `limits` · `restart` · `volume` · `always-on` · `private-access` · `public-access` · `logs` · `metrics` — every verb takes `[service]` |
 | `insta redis` · `mysql` · `mongodb` | `query` · `status` · `limits` · `volume` · `always-on` · `logs` · `metrics` |
 | `insta storage` | `list` · `get` · `delete` · `set-access` |
 | `insta build [dir]` · `deploy [dir]` | Verify a source dir would build; deploy a source directory (built remotely) or `--image <url>`. `insta build logs <id>` reads source-build output: `--source archive` (default) uses the deploy operation ID, `--source github` uses a GitHub build ID; `--follow` watches output, `--json` returns one snapshot |

package/dist/agent.js

@@ -18,6 +18,9 @@ export function canonicalTarget(path) {
     return url.pathname + url.search;
 }
 const guidance = 'agent session missing, expired, or for another project/environment — run `insta agent setup`';
+/** No usable agent session for the project, looked up from the current directory. */
+export class AgentSessionMissing extends Error {
+}
 export async function issueAgentSession(api, projectId) {
     const pair = generateKeyPairSync('ed25519');
     const client = mode?.client ?? detectAgent(false)?.client ?? 'unknown';
@@ -60,7 +63,7 @@ export async function loadAgentSession(apiUrl, projectId, cwd = process.cwd()) {
         return session;
     }
     catch {
-        throw new Error(guidance);
+        throw new AgentSessionMissing(guidance);
     }
 }
 // Routes the CLI may call on an account-level (bootstrap) session, by first path segment. Every

package/dist/commands/auth.js

@@ -325,7 +325,7 @@ export async function claimGrant(email, client, post, wait = sleepSeconds, open,
     throw expired();
 }
 // Start a loopback server, open the browser at the platform bridge, and await the token.
-function browserOauth(apiUrl, provider) {
+export function browserOauth(apiUrl, provider, open = openUrl) {
     return new Promise((resolve, reject) => {
         const state = randomBytes(16).toString('hex');
         let timer;
@@ -340,7 +340,7 @@ function browserOauth(apiUrl, provider) {
             const err = url.searchParams.get('error');
             const ok = !!token && !err && url.searchParams.get('state') === state;
             res.writeHead(ok ? 200 : 400, { 'content-type': 'text/html' });
-            res.end(`<!doctype html><meta charset=utf-8><body style="font-family:system-ui;text-align:center;margin-top:4rem"><h2>InstaCloud</h2><p>${ok ? '✓ Login complete — you can close this tab.' : '✗ Login failed' + (err ? ` (${err})` : '')}</p></body>`);
+            res.end(`<!doctype html><meta charset=utf-8><body style="font-family:system-ui;text-align:center;margin-top:4rem"><h2>InstaCloud</h2><p>${ok ? '✓ Login complete — you can close this tab.' : '✗ Login failed' + (err ? ` (${err.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;')})` : '')}</p></body>`);
             clearTimeout(timer);
             server.close();
             if (err)
@@ -362,7 +362,7 @@ function browserOauth(apiUrl, provider) {
             // event, so openUrl's return value cannot see it (e.g. powershell.exe blocked by AppLocker
             // on hardened fleets) — and the silent variant of that failure looks exactly like a hang.
             info(`if nothing opens, use this URL:\n  ${authorizeUrl}`);
-            openUrl(authorizeUrl);
+            open(authorizeUrl);
             info('waiting for you to finish in the browser… (times out in 2m; ctrl-c to abort)');
             timer = setTimeout(() => { server.close(); reject(new Error('timed out waiting for browser login (2m)')); }, 120_000);
         });

package/dist/commands/billing.js

@@ -32,15 +32,36 @@ export function billingLines(s, org) {
     ];
     if (s.subscriptionStatus)
         lines.push(`subscription:    ${s.subscriptionStatus}`);
-    if (s.billingStatus === 'suspended') {
-        // Four causes, five messages, and every one is a dead end for the others. Tier first: only a
+    if (s.pendingPlanChange) {
+        const pending = s.pendingPlanChange;
+        const boundary = new Date(pending.effectiveAt).toISOString().replace('T', ' ').replace('.000Z', ' UTC');
+        lines.push(pending.status === 'scheduled'
+            ? `next plan:       ${pending.toTier} at ${boundary}`
+            : `plan change:     preparing ${pending.toTier}; requested boundary ${boundary}`);
+        if (pending.changeKind === 'upgrade') {
+            lines.push(`full-cycle allowance: $${Number(pending.includedUsd).toFixed(2)} (next renewal)`);
+            lines.push('Current cycle: proportional allowance increase; existing usage and renewal date are preserved.');
+        }
+        else
+            lines.push(`next allowance:  $${Number(pending.includedUsd).toFixed(2)} (available after cutover)`);
+        lines.push(pending.changeKind === 'downgrade'
+            ? 'Current paid plan remains active until period end. Withdraw this downgrade in Console Plans before it takes effect.'
+            : 'A plan change is pending; contact support for billing changes.');
+    }
+    if (s.tier === 'enterprise') {
+        lines.push('Enterprise billing is managed by staff; payment failure does not change the plan.');
+        if (s.billingStatus === 'suspended')
+            lines.push('Contact support for billing or resource recovery.');
+    }
+    else if (s.billingStatus === 'suspended' && !s.pendingPlanChange) {
+        // Ordinary-plan recovery advice depends on the cause. Tier first: only a
         // free org can spend a prepaid wallet, and waiting for the next cycle genuinely fixes that one.
         // (Tier, not subscriptionStatus, because rows written before non-payment suspended carry
         // `unpaid` beside tier 'free' and survive with no migration.) Then the status splits the paid
         // branch three ways: an invoice to settle, a subscription to replace, or — when it reads
         // healthy — a suspension that outlived its cause, which is what a recovery whose compute failed
         // to restart looks like, and where telling them to pay means re-settling a paid invoice. The
-        // replace case is the one that splits again, because enterprise has no self-serve checkout.
+        // Enterprise and pending changes were handled above: neither offers self-serve checkout.
         //
         // EVERY command here carries the caller's --org. `billing` and the command being suggested
         // resolve the target independently, so a hint that drops the flag acts on a different org than
@@ -53,13 +74,9 @@ export function billingLines(s, org) {
             : lapsed
                 ? `⚠  org suspended — subscription payment did not go through; settle it in \`insta billing portal${flag}\``
                 : ended
-                    ? s.tier === 'enterprise'
-                        // Per-deal, and `billing subscribe` cannot create one: naming a self-serve tier here
-                        // would move them off the plan they negotiated.
-                        ? '⚠  org suspended — the subscription ended; contact support to restore this plan'
-                        // Their OWN tier, not a hardcoded one: suggesting `subscribe pro` to a Team org
-                        // resubscribes it onto the wrong plan.
-                        : `⚠  org suspended — the subscription ended; resubscribe with \`insta billing subscribe ${s.tier}${flag}\``
+                    // Their OWN tier, not a hardcoded one: suggesting `subscribe pro` to a Team org
+                    // resubscribes it onto the wrong plan.
+                    ? `⚠  org suspended — the subscription ended; resubscribe with \`insta billing subscribe ${s.tier}${flag}\``
                     // Deliberately claims nothing about the subscription: `incomplete` reaches here too,
                     // and that one is neither current nor failed. All this branch knows is that the
                     // suspension has no billing cause it can name.
@@ -157,7 +174,7 @@ export async function billingRedeem(code, opts) {
     for (const l of redeemLines(res))
         info(l);
 }
-// insta billing portal — open the Stripe Customer Portal (change plan / card / cancel).
+// insta billing portal — manage payment methods. UTC-managed plans cannot change/cancel here.
 export async function billingPortal(opts) {
     const api = await ApiClient.load();
     const orgId = await resolveOrgId(opts);

package/dist/commands/compute.js

@@ -1,4 +1,6 @@
-import { ApiClient, ApiError, requireProject } from '../api.js';
+import { AgentApprovalRequired, ApiClient, ApiError, requireProject } from '../api.js';
+import { AgentSessionMissing } from '../agent.js';
+import { safeText } from '../config.js';
 import { info, printJson, handleApproval, relayExitCode, writeFileAtomicSync, resolveThroughSymlink } from '../util.js';
 import { resolveComputeServiceId, resolveSoleService, q, parseVolumeGib, parseCount } from './services.js';
 export const isWorker = (s) => s.port === 0;
@@ -103,7 +105,7 @@ export function domainStatusLines(r, ctx = {}) {
     }
     const records = recordsOf(r);
     const out = [`${r.hostname} -> ${targetOf(r)}`];
-    const txt = records.find((d) => d.type === 'TXT');
+    const txt = records.find((d) => d.type === 'TXT' && d.purpose !== 'edge_ownership');
     // The ROUTING records for the hostname, whatever type they take: a CNAME for a subdomain, or the
     // A/AAAA PAIR an apex needs (Fly's apex path emits both). All of them, not the first one —
     // a correct A beside a missing AAAA is not "routing is fine".
@@ -111,12 +113,6 @@ export function domainStatusLines(r, ctx = {}) {
     const routing = records.filter(isRouting);
     const blockers = [];
     const stage = (label, state, detail) => out.push(`  ${pad(label, 12)}${pad(state, 10)}${detail ? `  ${detail}` : ''}`);
-    // The ONE verdict rule, applied to EVERY record the platform returned regardless of its role.
-    // A record is settled only when the platform says `ok` — or, for a provider that reports no
-    // per-record status at all (Fly), when it vouched for the whole set with `configured`. missing,
-    // mismatch and never-checked are each outstanding and each add a blocker. Applying this to only
-    // some records lets an apex whose AAAA is missing, or a still-pending validation record, ride
-    // under a `serving https://…` line.
     const verdictOf = (d) => d.status ?? (r.configured ? 'ok' : 'unchecked');
     if (txt) {
         const st = verdictOf(txt);
@@ -173,15 +169,16 @@ export function domainStatusLines(r, ctx = {}) {
             blockers.push(`${d.type} unchecked`);
         }
     }
-    // Everything else the platform returned — a Let's Encrypt validation CNAME, any extra record.
-    // Same rule, no exemption: an outstanding record is outstanding whatever its role.
     for (const d of records) {
         if (d === txt || isRouting(d))
             continue;
         const st = verdictOf(d);
         const lbl = d.type.toLowerCase();
         const where = `${d.name} -> ${d.value}${d.note ? `  (${d.note})` : ''}`;
-        if (st === 'ok')
+        if (d.type === 'TXT' && d.purpose === 'edge_ownership' && st === 'unchecked') {
+            stage('edge TXT', 'unchecked', `${where} (Cloudflare validates this record; see certificate status below)`);
+        }
+        else if (st === 'ok')
             stage(lbl, 'ok', where);
         else if (st === 'mismatch') {
             stage(lbl, 'mismatch', `${d.type} ${d.name} must point at ${d.value}`);
@@ -822,7 +819,7 @@ import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
-import { aliasFor, certifiesPublicKey, hasOwnedBlock, isSafeAlias, isSafeConfigValue, isSafeSSHHost, isSafeSSHUsername, isSafeTimestamp, isSSHCertificateRecord, mayWidenCAHost, parseCAPublicKey, planCertAuthority, renderConfigBlock, revertCertAuthority, upsertConfigBlock, ownedBlock, ownedBlockIsFirst } from './ssh-config.js';
+import { ALIAS_SUFFIX, aliasFor, certifiesPublicKey, hasOwnedBlock, isSafeAlias, isSafeConfigValue, isSafeSSHHost, isSafeSSHUsername, isSafeTimestamp, isSSHCertificateRecord, mayWidenCAHost, parseCAPublicKey, planCertAuthority, renderConfigBlock, revertCertAuthority, upsertConfigBlock, ownedBlock, ownedBlockIsFirst } from './ssh-config.js';
 /** Where this CLI keeps its own SSH material. Deliberately NOT ~/.ssh: we never
  *  touch a key the user already had, and a dedicated key pairs with
  *  IdentitiesOnly to avoid being identified by the wrong one. */
@@ -1017,6 +1014,8 @@ function ensureKeyPair() {
 const keyMaterial = (record) => record.split(/\s+/).slice(0, 2).join(' ');
 async function mintCert(api, projectId, serviceId, publicKey, alias, signal) {
     const res = await api.rawRequest('POST', `/projects/${projectId}/services/${serviceId}/ssh-cert`, { publicKey }, { signal });
+    if (res.status === 202 && res.body?.status === 'approval_required')
+        throw new AgentApprovalRequired(res.body);
     if (res.status < 200 || res.status >= 300) {
         throw new ApiError(res.status, res.body?.error ?? 'could not issue an ssh certificate');
     }
@@ -1458,6 +1457,27 @@ function readUserText(path) {
     }
     return text;
 }
+/** Another process holds this alias's renewal lock and is renewing it now. */
+class RenewalInProgress extends Error {
+}
+/** The one line a missing or expired certificate that could not be renewed gets: the cause and the fix. */
+export function renewalFailureNotice(alias, err) {
+    const head = `insta: the SSH certificate for ${alias} is missing or expired`;
+    const fix = `insta compute ssh ${alias.slice(0, -ALIAS_SUFFIX.length)}`;
+    if (err instanceof RenewalInProgress) {
+        return `${head} and another ssh may be renewing it right now. Retry in a moment, or run "${fix}".`;
+    }
+    if (err instanceof AgentSessionMissing) {
+        return `${head}. Agent mode found no agent session for its project in this directory. Run ssh from the project directory, or ask a person to run "${fix}".`;
+    }
+    if (err instanceof AgentApprovalRequired) {
+        return `${head} and renewing it needs approval. ${safeText(err.message.replace(/\s+/g, ' ')).trim()} Retry after it is approved.`;
+    }
+    if (err instanceof ApiError && err.status === 403 && err.message.endsWith('denied by agent policy')) {
+        return `${head} and this project's agent policy does not allow renewing it.`;
+    }
+    return `${head} and could not be renewed. Run "${fix}" to renew it.`;
+}
 /**
  * The renewal hook OpenSSH runs while PARSING the config, before it connects.
  *
@@ -1475,15 +1495,20 @@ function readUserText(path) {
  *    rule __update-check relies on), so the fast path is genuinely local only
  *    when the hook enters through that name.
  *  - Silent and fail-safe. An unlinked directory, an expired login or a network
- *    outage must not print anything or fail the parse: the existing certificate
- *    stays in place and the login then fails with SSH's own message, not a CLI
- *    error spliced into the middle of an ssh session.
+ *    outage must not fail the parse: the existing certificate stays in place.
+ *    Only an already expired one earns a single stderr line saying why.
  */
 export async function ensureCertForAlias(alias, timeoutMs = RENEWAL_REQUEST_TIMEOUT_MS) {
     let release;
+    let explainOnExit = false;
+    let cause;
     try {
         if (!isSafeAlias(alias))
             return;
+        const managed = readAliasStore();
+        if (!managed[alias])
+            return; // not an alias this CLI manages: stay silent
+        explainOnExit = true; // set before the repair, which can throw too
         // Repair BEFORE the renewal gate, because the stanza can lag the store
         // with no certificate due: an alias set up before the Port line existed
         // dials :22 on every connection, and waiting for its certificate to age
@@ -1491,15 +1516,17 @@ export async function ensureCertForAlias(alias, timeoutMs = RENEWAL_REQUEST_TIME
         // predicate is content drift, so the common case -- an up-to-date stanza --
         // is one file read and a string compare, with no lock taken; only a stale
         // stanza takes the alias-store lock, re-checks under it and rewrites.
-        if (configBlockStale(readAliasStore())) {
+        if (configBlockStale(managed)) {
             withAliasStoreLock(() => {
                 const store = readAliasStore();
                 if (store[alias] && configBlockStale(store))
                     installConfigBlock(store);
             }, { waitMs: KNOWN_HOSTS_LOCK_WAIT_MS });
         }
-        if (!certNeedsRenewal(instaCertPath(alias)))
+        if (!certNeedsRenewal(instaCertPath(alias))) {
+            explainOnExit = false; // the certificate works, so no second check on the way out
             return;
+        }
         // An IDE opens several connections at once and `scp` adds more, so the
         // near-expiry certificate is observed by every one of them simultaneously
         // and each would mint its own replacement -- redundant requests against a
@@ -1510,8 +1537,10 @@ export async function ensureCertForAlias(alias, timeoutMs = RENEWAL_REQUEST_TIME
         // a lock that can hang `ssh` itself -- strictly worse than the duplicate
         // request it would prevent. The loser simply lets the winner renew.
         release = acquireRenewalLock(alias);
-        if (!release)
+        if (!release) {
+            cause = new RenewalInProgress();
             return;
+        }
         // Re-checked after the lock. Without this the second process through the
         // door renews again over the certificate the first just wrote -- the lock
         // would serialise the stampede instead of collapsing it.
@@ -1619,11 +1648,15 @@ export async function ensureCertForAlias(alias, timeoutMs = RENEWAL_REQUEST_TIME
             out.staged.discard();
         }
     }
-    catch {
-        // Deliberately swallowed. See above.
+    catch (err) {
+        cause = err;
     }
     finally {
         release?.();
+        // Silent unless this ssh is about to fail: any exit that left the certificate expired says why.
+        if (explainOnExit && certNeedsRenewal(instaCertPath(alias), { marginMs: 0 })) {
+            process.stderr.write(renewalFailureNotice(alias, cause) + '\n');
+        }
     }
 }
 /** A renewal lock older than this is broken even if its holder is alive. That

package/dist/commands/domain.js

@@ -208,6 +208,15 @@ export async function domainNameserversReset(domainName, opts, deps) {
     for (const line of domainLines(r, !opts.org))
         info(line);
 }
+export async function domainRenew(domainName, mode, opts, deps) {
+    if (mode !== 'on' && mode !== 'off')
+        die('mode must be on or off');
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('PATCH', domainPath(orgId, domainName), { autorenew: mode === 'on' });
+    if (opts.json)
+        return printJson(r);
+    info(`${r.domainName}  auto-renew ${r.autorenew ? 'on' : 'off'}`);
+}
 export async function domainTransferLock(domainName, mode, opts, deps) {
     if (mode !== 'on' && mode !== 'off')
         die('mode must be on or off');
@@ -386,7 +395,20 @@ export async function zoneDelegate(domainName, opts, deps) {
 }
 export async function zoneList(opts, deps) {
     const { api, orgId } = await orgDeps(opts, deps);
-    const r = await api.request('GET', zonePath(orgId));
+    const r = { items: [] };
+    let cursor;
+    const seen = new Set();
+    do {
+        const path = `${zonePath(orgId)}?limit=100${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ''}`;
+        const page = await api.request('GET', path);
+        r.items.push(...page.items);
+        cursor = page.nextCursor;
+        if (cursor) {
+            if (seen.has(cursor))
+                throw new Error('zone listing returned a repeated pagination cursor');
+            seen.add(cursor);
+        }
+    } while (cursor);
     if (opts.json)
         return printJson(r);
     if (!r.items.length)

package/dist/commands/mcp.js

@@ -51,6 +51,20 @@ export function renderJsonConfig(slug, existing, url, name = MCP_SERVER_NAME) {
     }
     return JSON.stringify(root, null, 2) + '\n';
 }
+export function tomlBasicString(value) {
+    const escaped = value.replace(/[\u0000-\u0008\u000A-\u001F\u007F\\"]/g, (ch) => {
+        switch (ch) {
+            case '\\': return '\\\\';
+            case '"': return '\\"';
+            case '\n': return '\\n';
+            case '\r': return '\\r';
+            case '\b': return '\\b';
+            case '\f': return '\\f';
+            default: return `\\u${ch.charCodeAt(0).toString(16).padStart(4, '0')}`;
+        }
+    });
+    return `"${escaped}"`;
+}
 // Codex config is TOML. Appending a complete `[mcp_servers.<name>]` table is always valid at
 // EOF, so we avoid a TOML parser: string-detect for idempotency, append for install.
 export function renderCodexConfig(existing, url, name = MCP_SERVER_NAME) {
@@ -58,7 +72,7 @@ export function renderCodexConfig(existing, url, name = MCP_SERVER_NAME) {
     if (base.includes(`[mcp_servers.${name}]`))
         return null; // already configured
     const sep = base.length && !base.endsWith('\n') ? '\n' : '';
-    return `${base}${sep}\n[mcp_servers.${name}]\nurl = "${url}"\n`;
+    return `${base}${sep}\n[mcp_servers.${name}]\nurl = ${tomlBasicString(url)}\n`;
 }
 // Install for one agent. Returns 'installed' | 'already' | 'skipped' (unparseable config).
 export async function installFor(slug, home, url, name = MCP_SERVER_NAME) {

package/dist/commands/postgres.js

@@ -282,6 +282,29 @@ export async function dbVolume(service, opts) {
     const vg = res.body?.volumeGib;
     info(`postgres ${service ?? 'default'}: volume ${typeof vg === 'number' ? `grown to ${vg}Gi` : `set to ${sizeGib}Gi`}`);
 }
+export async function dbRestart(service, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const qs = new URLSearchParams();
+    const branch = opts.branch ?? p.branch;
+    if (branch)
+        qs.set('branch', branch);
+    if (service)
+        qs.set('group', service);
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/database/restart${qs.toString() ? `?${qs}` : ''}`);
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    info(restartLine(service ?? 'default', res.body));
+}
+export function restartLine(group, body) {
+    if (body?.pending)
+        return `postgres ${group}: restart accepted and still in progress — settings apply once it is back up`;
+    if (body?.state === 'suspended')
+        return `postgres ${group}: suspended, not restarted — pending settings apply when the next connection starts it`;
+    return `postgres ${group}: restarted — ALTER SYSTEM settings that need a restart are now in effect`;
+}
 export async function resolveDbUrl(api, projectId, branch, service, json) {
     const { services } = await api.request('GET', `/projects/${projectId}/services${q(branch)}`);
     const svc = resolveSoleService(services, 'postgres', service);

package/dist/commands/ssh-config.js

@@ -142,9 +142,7 @@ export function renderConfigBlock(o) {
         // the one carrying our certificate. Without this line a developer with a
         // full ssh-agent gets intermittent, unexplainable auth failures.
         '  IdentitiesOnly yes');
-        // Connection multiplexing collapses scp, an IDE's several connections and a
-        // second terminal onto ONE connection; without it a single developer can
-        // reach the per-service session cap in an afternoon.
+        // Multiplexing spares a handshake per ssh, and 60s keeps a master from outliving a pod that scaled to zero.
         //
         // The socket is keyed on %C -- a hash of (local host, remote host, port,
         // user) -- not %r@%h:%p. A ControlPath is a Unix-domain socket, whose path
@@ -161,7 +159,7 @@ export function renderConfigBlock(o) {
         // effective-config tests need a real `ssh` and skip on Windows, so this
         // branch is asserted on the rendered text instead.
         if ((o.platform ?? process.platform) !== 'win32') {
-            lines.push('  ControlMaster auto', '  ControlPath ~/.insta/ssh/cm-%C', '  ControlPersist 10m');
+            lines.push('  ControlMaster auto', '  ControlPath ~/.insta/ssh/cm-%C', '  ControlPersist 60s');
         }
         if (o.ensureCertCommand) {
             // Renewal happens while OpenSSH PARSES the config, before it connects, so

package/dist/commands/template.js

@@ -34,6 +34,7 @@ export function normalizeInfoServices(raw) {
         name, type: s?.type, port: s?.port,
         volumeGib: s?.volumeGib ?? s?.volume?.size,
         volume: s?.volume === true || s?.volumeGib != null || s?.volume?.size != null,
+        mountPath: typeof s?.mountPath === 'string' ? s.mountPath : undefined,
     });
     if (Array.isArray(raw))
         return raw.map((s) => one(s?.name ?? '?', s));
@@ -73,7 +74,7 @@ export function templateInfoLines(t, bold = (s) => s) {
         const summary = services.map((s) => {
             // A size only when the registry still carries one: a manifest names no size any more, so
             // "persistent /data" is all there is to say until the service exists.
-            const disk = s.volumeGib ? `${s.volumeGib}Gi volume` : s.volume ? 'persistent /data' : undefined;
+            const disk = s.volumeGib ? `${s.volumeGib}Gi volume` : s.volume ? `persistent ${s.mountPath ?? '/data'}` : undefined;
             const bits = [s.type && s.type !== 'compute' ? s.type : undefined, s.port ? `port ${s.port}` : undefined, disk].filter(Boolean);
             return `${s.name}${bits.length ? ` (${bits.join(', ')})` : ''}`;
         });

package/dist/config.js

@@ -2,9 +2,9 @@
 import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { realpathSync } from 'node:fs';
-import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { chmod, lstat, mkdir, readFile, writeFile } from 'node:fs/promises';
 import { ensureGitignore } from './gitignore.js';
-import { die } from './util.js';
+import { die, writeFileAtomicSync } from './util.js';
 import { DEFAULT_ENV, ENVS, envForApiUrl, envFromEnvVar, normalizeUrl } from './env.js';
 const GLOBAL_DIR = join(homedir(), '.insta');
 const GLOBAL_FILE = join(GLOBAL_DIR, 'config.json');
@@ -109,8 +109,10 @@ export async function readPersistedGlobal() {
     }
 }
 export async function writeGlobal(c) {
-    await mkdir(GLOBAL_DIR, { recursive: true });
-    await writeFile(GLOBAL_FILE, JSON.stringify(c, null, 2));
+    await mkdir(GLOBAL_DIR, { recursive: true, mode: 0o700 });
+    if (process.platform !== 'win32' && !(await lstat(GLOBAL_DIR)).isSymbolicLink())
+        await chmod(GLOBAL_DIR, 0o700);
+    writeFileAtomicSync(GLOBAL_FILE, JSON.stringify(c, null, 2));
 }
 /** The home directory is never a project root. `~/.insta/` is this CLI's GLOBAL config directory,
  *  so a project.json there is not a project link: honouring one made every directory under the home
@@ -255,9 +257,10 @@ async function readLinkPlane(root) {
     }
 }
 /** Text safe to echo to a terminal: C0 and C1 control characters and DEL removed — ESC and the
- *  single-byte C1 introducers (U+009B CSI among them) alike, so no escape sequence survives. */
-function safeText(text) {
-    return String(text).replace(/[\u0000-\u001f\u007f-\u009f]/g, '');
+ *  single-byte C1 introducers (U+009B CSI among them) alike, so no escape sequence survives.
+ *  Bidi marks, embeddings, overrides and isolates go too, so nothing can reorder what is shown. */
+export function safeText(text) {
+    return String(text).replace(/[\u0000-\u001f\u007f-\u009f‎‏‪-‮⁦-⁩]/g, '');
 }
 /** A control-plane URL safe to persist and to print: control characters removed, surrounding
  *  whitespace trimmed, and any userinfo (INSTA_API_URL may carry credentials) removed.

package/dist/index.js

@@ -293,6 +293,9 @@ dom.command('list').description("Domains bought through InstaCloud in this org
 dom.command('status <name>').description("A bought domain's order and attach state")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((name, o) => domainCmd.domainStatus(name, o)));
+dom.command('renew <domain> <mode>').description('Turn automatic renewal on or off for a bought domain (mode: on|off). Does not renew immediately. Agent credentials are refused; run with a human login')
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((domain, mode, o) => domainCmd.domainRenew(domain, mode, o)));
 dom.command('delegate <domain>').description("Move a bought domain's DNS onto an InstaCloud-managed zone — the way an apex hostname gets a certificate and serves. Every record is copied first and the nameservers switch after, so serving hostnames stay up and ones that failed by delegating away revive on their own. While managed, `domain records` answers 409 for every verb (managed-zone record editing is not covered yet); `nameservers reset` is the way back (org admin; gated: domain.delegate — agent mode gates from a linked project, an unlinked --org call falls under org administration instead)")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((domain, o) => domainCmd.domainDelegate(domain, o)));
@@ -365,7 +368,7 @@ compute.command('start [service]').description('Bring a compute service online (
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStart(service, o)));
 compute.command('stop [service]').description('Take a compute service offline; traffic will NOT wake it until `start`')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStop(service, o)));
-compute.command('suspend [service]').description('Suspend a compute service (RAM snapshot); stays down until `start`')
+compute.command('suspend [service]').description('Suspend a compute service (RAM snapshot); traffic can wake it unless already stopped; `start` clears the stop')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeSuspend(service, o)));
 compute.command('restart [service]').description("Restart a compute service by re-running the image it already runs against a freshly resolved env bundle — this is how a changed secret or binding reaches a running machine (env is baked into the machine at deploy time), and how a machine that is up but wedged gets cycled (`start` no-ops on one that is already started). No new image, no new spec. The service must be running: a stopped or suspended one comes back with `insta compute start`. All plans; gated: deploy — it lands configuration the same way a deploy does, so a policy denying deploys denies this too (`start`/`stop` stay ungated, and cycle a wedged machine without one). A service whose app fails to answer on its port coming back up reports that failure, and the machines are rolled back, best-effort, to the config they were serving")
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeRestart(service, o)));
@@ -423,7 +426,7 @@ compute.command('volume [service]').description("Show, attach, grow, remount, or
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeVolume(service, o)));
 addObservability(compute, 'compute', 'compute');
 // ---- postgres ----
-const pg = program.command('postgres').description('Postgres services: connection string, psql, stats, resource ceiling, volume, always-on, network access, logs, metrics');
+const pg = program.command('postgres').description('Postgres services: connection string, psql, stats, resource ceiling, restart, volume, always-on, network access, logs, metrics');
 pg.command('url [service]').description('Print the postgres connection string (DSN) — bare on stdout for piping, e.g. `psql "$(insta postgres url)"` (gated: secrets.read). `insta secrets` includes the primary postgres service\'s DATABASE_URL; use this command to select a specific postgres service')
     .option('--json').option('--branch <branch>', 'branch (default: current)')
     .action(guard((service, o) => pgCmd.dbUrl(service, o)));
@@ -437,6 +440,9 @@ pg.command('limits [service]').description("Show or set a postgres service's res
     .option('--cpu <n>', 'vCPU ceiling, e.g. 2 or 2500m').option('--memory <size>', 'memory ceiling, e.g. 4Gi')
     .option('--json').option('--branch <branch>', 'branch (default: current)')
     .action(guard((service, o) => pgCmd.dbLimits(service, o)));
+pg.command('restart [service]').description("Restart the postgres server so settings written with ALTER SYSTEM that need a restart (wal_level, max_wal_senders, max_replication_slots, …) take effect. Connections drop while it restarts; waits for it to finish. A suspended instance stays suspended and picks the settings up on its next connection. insta-db-backed only (gated: deploy)")
+    .option('--json').option('--branch <branch>', 'branch (default: current)')
+    .action(guard((service, o) => pgCmd.dbRestart(service, o)));
 pg.command('volume [service]').description("Show or grow a postgres service's provisioned volume (block disk; insta-db-backed only). No --size: print size and the plan cap (any plan). --size grows it (paid plans; grow-only — a provisioned disk cannot shrink). Billing is actual data stored — the size is a cap, not a price")
     .option('--size <gi>', 'new size in whole Gi, e.g. 10 (must be ≥ the current size)')
     .option('--json').option('--branch <branch>', 'branch (default: current)')
@@ -552,7 +558,7 @@ bill.command('subscribe <tier>').description('Subscribe the org to a paid tier (
 bill.command('redeem <code>').description("Redeem a one-time credit code into the org's wallet")
     .option('--org <id>').option('--json')
     .action(guard((code, o) => billingRedeem(code, o)));
-bill.command('portal').description('Open the Stripe Customer Portal (change plan / card / cancel)')
+bill.command('portal').description('Open Stripe payment-method management (owner/admin)')
     .option('--org <id>').option('--no-open', 'print the URL instead of opening a browser').option('--json')
     .action(guard((o) => billingPortal(o)));
 bill.command('usage').description('Usage for the current billing cycle by billing dimension (org by default; --proj for one project)')

package/dist/observe/hook.js

@@ -1,6 +1,6 @@
 // PostToolUse hook: reads a tool-use event on stdin (Claude Code / Codex), scans every string
 // surface for credential exposure, and appends findings to ./.insta/audit.jsonl.
-import { appendFileSync, mkdirSync } from 'node:fs';
+import { appendFileSync, chmodSync, mkdirSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { scanEvent } from './scanner.js';
@@ -27,9 +27,15 @@ export function recordFindings(event, baseDir) {
         tool: event.tool_name ?? null,
         cwd: event.cwd ?? null,
     };
-    mkdirSync(instaDir, { recursive: true });
+    mkdirSync(instaDir, { recursive: true, mode: 0o700 });
+    // Windows ACLs do not store these modes. On POSIX a failure must surface: main() prints it.
+    if (process.platform !== 'win32')
+        chmodSync(instaDir, 0o700);
     const lines = findings.map((f) => JSON.stringify({ ...common, ...f })).join('\n') + '\n';
-    appendFileSync(join(instaDir, 'audit.jsonl'), lines, 'utf8');
+    const auditPath = join(instaDir, 'audit.jsonl');
+    appendFileSync(auditPath, lines, { encoding: 'utf8', mode: 0o600 });
+    if (process.platform !== 'win32')
+        chmodSync(auditPath, 0o600);
     return findings.length;
 }
 async function readStdin() {

package/dist/observe/scanner.js

@@ -8,7 +8,7 @@ const DETECTORS = [
     { name: 'stripe_secret_key', rx: /\b[rs]k_(?:live|test)_[A-Za-z0-9]{16,}\b/gd, group: false },
     { name: 'llm_api_key', rx: /\bsk-(?:ant-)?[A-Za-z0-9_-]{20,}\b/gd, group: false },
     { name: 'google_api_key', rx: /\bAIza[0-9A-Za-z_-]{35}\b/gd, group: false },
-    { name: 'private_key_block', rx: /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/gd, group: false },
+    { name: 'private_key_block', rx: /-----BEGIN ((?:[A-Z ]+ )?PRIVATE KEY)-----(?:(?:[ \t\r\n]|\\[rn])*(?:Proc-Type|DEK-Info):[^\r\n\\]*(?:\r?\n|\\[rn]|$))*(?:[A-Za-z0-9+/=\r\n \t]|\\[rn])*(?:-----END \1-----)?/gd, group: false },
     { name: 'jwt', rx: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/gd, group: false },
     { name: 'db_conn_string', rx: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^:\s/@]+:[^@\s/]+@[^\s'"]+/gd, group: false },
     { name: 'bearer_token', rx: /\bbearer\s+([A-Za-z0-9._-]{20,})/gid, group: true },
@@ -41,17 +41,13 @@ function fingerprint(secret, detector) {
     const tail = last4 ? '••••' + last4 : '••••';
     return `${detector}:${tail}:#${h}`;
 }
-function snippet(text, span, fp) {
-    const [s, e] = span;
-    const redacted = text.slice(0, s) + '«' + fp + '»' + text.slice(e);
-    const marker = '«' + fp + '»';
-    const i = redacted.indexOf(marker);
-    const start = Math.max(0, i - 36);
-    const end = Math.min(redacted.length, i + marker.length + 36);
-    let out = redacted.slice(start, end).replace(/\s+/g, ' ').trim();
+function snippet(text, offset, fp) {
+    const start = Math.max(0, offset - 36);
+    const end = Math.min(text.length, offset + fp.length + 2 + 36);
+    let out = text.slice(start, end).replace(/\s+/g, ' ').trim();
     if (start > 0)
         out = '…' + out;
-    if (end < redacted.length)
+    if (end < text.length)
         out = out + '…';
     return out.slice(0, 160);
 }
@@ -104,8 +100,12 @@ function scanText(text) {
     hits.sort((a, b) => a[0] - b[0] || a[1] - b[1]); // stable: earlier detector wins an equal span
     const kept = [];
     for (const r of hits) {
-        if (kept.some((k) => !(r[1] <= k[0] || r[0] >= k[1])))
+        const previous = kept.at(-1);
+        if (previous && r[0] < previous[1]) {
+            previous[1] = Math.max(previous[1], r[1]);
+            previous[3] = text.slice(previous[0], previous[1]);
             continue;
+        }
         kept.push(r);
     }
     return kept;
@@ -178,10 +178,20 @@ export function scanEvent(event, opts = {}) {
         if (!text || text.length > 1_000_000)
             continue;
         const side = surface.startsWith('input') ? 'input' : 'output';
-        for (const [start, end, detector, secret] of scanText(text)) {
-            const fp = fingerprint(secret, detector);
+        let redacted = '';
+        let cursor = 0;
+        const hits = scanText(text).map(([start, end, detector, secret]) => {
+            const fp = fingerprint(secret.trimEnd(), detector);
+            redacted += text.slice(cursor, start);
+            const offset = redacted.length;
+            redacted += `«${fp}»`;
+            cursor = end;
+            return { detector, fp, offset };
+        });
+        redacted += text.slice(cursor);
+        for (const { detector, fp, offset } of hits) {
             const [kind, sev, sink, note] = classify(tool, side, command, filePath, secretFileTarget);
-            add(kind, sev, detector, `${tool}:${surface}`, sink, fp, snippet(text, [start, end], fp), note);
+            add(kind, sev, detector, `${tool}:${surface}`, sink, fp, snippet(redacted, offset, fp), note);
         }
     }
     return findings;

package/dist/template-manifest.js

@@ -91,7 +91,7 @@ export function validateManifest(m) {
         // platform's own check (provisioning/templateManifest.ts) so an author hears it here.
         if (type && MANAGED_TYPES.includes(type)) {
             const bare = svc;
-            for (const field of ['image', 'build', 'port', 'healthcheck', 'volume', 'volumeGib', 'spec', 'alwaysOn']) {
+            for (const field of ['image', 'build', 'port', 'healthcheck', 'volume', 'volumeGib', 'spec', 'alwaysOn', 'command', 'mountPath']) {
                 if (bare[field] !== undefined) {
                     problems.push(`${where}.${field}: a ${type} service is platform-managed and carries no ${field} — declare it bare ({ type: ${type} })`);
                 }
@@ -151,6 +151,16 @@ export function validateManifest(m) {
         if (authored.spec !== undefined) {
             problems.push(`${where}: compute size is the platform's to choose — remove spec`);
         }
+        // Validate runtime fields: command and mountPath
+        if (svc.command !== undefined && (typeof svc.command !== 'string' || !svc.command.trim())) {
+            problems.push(`${where}.command must be a non-empty string`);
+        }
+        if (svc.mountPath !== undefined) {
+            if (svc.volume !== true)
+                problems.push(`${where}.mountPath requires volume: true`);
+            else if (typeof svc.mountPath !== 'string' || !svc.mountPath.startsWith('/'))
+                problems.push(`${where}.mountPath must be an absolute path`);
+        }
         const env = svc.env ?? {};
         for (const group of ['fixed', 'generated', 'required', 'optional']) {
             for (const varName of Object.keys(env[group] ?? {})) {

package/dist/util.js

@@ -1,5 +1,6 @@
 // Output + small pure helpers (env serialization is unit-tested).
 import { createInterface } from 'node:readline';
+import { Writable } from 'node:stream';
 import { spawn } from 'node:child_process';
 import { chmodSync, copyFileSync, existsSync, lstatSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
@@ -225,7 +226,7 @@ const targetGroup = (a) => (a.target === 'db' ? 'postgres' : String(a.target ??
 const OP_COMMAND = {
     'service.add': (a) => `insta service add ${a.type ?? '<type>'} ${a.name ?? '<name>'}`,
     deploy: (a) => `insta deploy${a.branch ? ` --branch ${a.branch}` : ''}`,
-    'secrets.set': (a) => `insta secrets set ${a.name ?? '<NAME>'} ${a.value ?? '<value>'}`,
+    'secrets.set': (a) => `insta secrets set ${a.name ?? '<NAME>'} <value>`,
     metrics: (a) => `insta ${targetGroup(a)} metrics`,
     logs: (a) => `insta ${targetGroup(a)} logs`,
     'approvals.approve': (a) => `insta agent approvals approve ${a.approvalId ?? '<id>'}`,
@@ -253,17 +254,39 @@ export function serializeEnv(bundle) {
         .map(([k, v]) => `${k}="${v.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`)
         .join('\n') + '\n');
 }
-// Hidden password prompt (best-effort: mutes echo on a TTY).
-export function promptPassword(label = 'Password: ') {
-    return new Promise((resolve) => {
-        const rl = createInterface({ input: process.stdin, output: process.stdout });
-        const stdout = process.stdout;
-        process.stdout.write(label);
-        let captured = '';
-        stdout._writeToOutput = (s) => { if (s.includes('\n'))
-            process.stdout.write('\n'); };
-        rl.on('line', (line) => { captured = line; rl.close(); });
-        rl.on('close', () => resolve(captured));
+export function mutePasswordOutput(real) {
+    return new Writable({
+        write(chunk, _encoding, callback) {
+            const text = Buffer.isBuffer(chunk) ? chunk.toString('utf8') : String(chunk);
+            const endings = text.replace(/[^\r\n]/g, '');
+            if (endings.length)
+                real.write(endings);
+            callback();
+        },
+    });
+}
+export function promptPasswordFrom(input, output, label = 'Password: ') {
+    return new Promise((resolve, reject) => {
+        let value = '';
+        const rl = createInterface({
+            input,
+            output: mutePasswordOutput(output),
+            // TTY stdin needs raw mode even when stdout is redirected, or the terminal echoes secrets.
+            terminal: Boolean(input.isTTY),
+        });
+        output.write(label);
+        rl.on('SIGINT', () => {
+            reject(new CliCancel());
+            rl.close();
+        });
+        rl.on('line', (line) => {
+            value = line;
+            rl.close();
+        });
+        rl.on('close', () => resolve(value));
     });
 }
+export function promptPassword(label = 'Password: ') {
+    return promptPasswordFrom(process.stdin, process.stdout, label);
+}
 //# sourceMappingURL=util.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [
@@ -52,6 +52,6 @@
     "@types/node": "^20.14.0",
     "tsx": "^4.16.0",
     "typescript": "^5.5.0",
-    "vitest": "^2.0.0"
+    "vitest": "^4.1.11"
   }
 }