insta 0.1.4 → 0.1.5

package/README.md

@@ -230,7 +230,7 @@ build never reaches a production installer.
 | `insta billing` | Current cycle overview; `subscribe <tier>` · `portal` · `usage` |
 | `insta agent` | `setup` (this machine's coding agents) · `manifest` · `policy …` · `approvals …` · `observe …` · `events` |
 | `insta config` | `install-mcp` · `regions` · `autoupdate` |
-| `insta feedback` | Report an InstaCloud-side hurdle (bug / feature-request / friction) to the team — never for the app you are building; works logged-out |
+| `insta feedback` | Report an InstaCloud-side hurdle (bug / feature-request / friction) to the team — never for the app you are building; on InstaCloud it needs `insta login`, so the team can reply |
 | `insta upgrade` | Update the CLI |
 
 Every command accepts `--api-url <url>` for this invocation only (internal debugging); for `compute exec`, place it before `compute`. `insta --help` documents it.

package/dist/commands/feedback.js

@@ -5,14 +5,15 @@
 //
 // The backend is InstaCloud dogfooding itself: the "InstaCloud Agent Feedback" project runs the
 // ingest service (InsForge/instacloud-feedback repo) on a postgres + compute pair. It is NOT the
-// control-plane API on purpose — feedback must work logged-out, unlinked, and from insta-oss,
-// and a control-plane outage is exactly when we most want reports to still arrive.
+// control-plane API on purpose — feedback must work unlinked, from insta-oss, and through a
+// control-plane outage, which is exactly when we most want reports to still arrive.
 import { readFileSync, statSync } from 'node:fs';
 import os from 'node:os';
 import * as clack from '@clack/prompts';
+import { ApiClient, ApiError } from '../api.js';
 import { readGlobal, readProject } from '../config.js';
 import { envForApiUrl } from '../env.js';
-import { info, printJson, CliCancel } from '../util.js';
+import { info, printJson, refuse, CliCancel } from '../util.js';
 import { clean } from '../redact.js';
 import { cliVersion } from '../version.js';
 export const TYPES = ['bug', 'feature-request', 'friction', 'other'];
@@ -42,6 +43,8 @@ const FEEDBACK_INGEST_TOKEN = process.env.INSTA_FEEDBACK_TOKEN || 'insta-feedbac
 // the DB wake and persists, so a report can land after a shorter deadline gave up on it).
 // An expired deadline is reported as UNCONFIRMED, not failed — the report may well be stored.
 const FEEDBACK_TIMEOUT_MS = 15_000;
+// A slow control plane may cost a report its ticket, never the report itself.
+const ASSERTION_TIMEOUT_MS = 5_000;
 const MAX_FILE_BYTES = 256 * 1024;
 function requireEnum(value, allowed, flag) {
     if (!allowed.includes(value)) {
@@ -156,7 +159,7 @@ export async function buildPayload(opts, ctx) {
 /** One POST, one bounded attempt (FEEDBACK_TIMEOUT_MS), zero retries — feedback is a side quest and must never hang the CLI.
  *  Transport and server failures come back as a result, not an exception: the caller downgrades
  *  them to a warning so a broken feedback backend can't fail the user's actual task. */
-export async function submit(payload, fetchImpl) {
+export async function submit(payload, fetchImpl, assertion) {
     let res;
     try {
         res = await fetchImpl(FEEDBACK_ENDPOINT, {
@@ -164,6 +167,7 @@ export async function submit(payload, fetchImpl) {
             headers: {
                 'Content-Type': 'application/json',
                 Authorization: `Bearer ${FEEDBACK_INGEST_TOKEN}`,
+                ...(assertion ? { 'Insta-User-Assertion': assertion } : {}),
             },
             body: JSON.stringify(payload),
             signal: AbortSignal.timeout(FEEDBACK_TIMEOUT_MS),
@@ -184,7 +188,34 @@ export async function submit(payload, fetchImpl) {
         return { status: 'error', error: body?.error ?? `HTTP ${res.status}` };
     return { status: body?.status === 'duplicate' ? 'duplicate' : 'received', id: body?.id ?? null };
 }
+const SIGNED_OUT = 'not signed in to InstaCloud — run `insta login`, then send this again so the team can reply to you';
+const STAGING = 'not accepted from staging — send InstaCloud feedback from production';
+// Exit 2, not the submit path's 0: the caller can act on this one.
+function refuseFeedback(message, json) {
+    if (json)
+        printJson({ status: 'refused', submitted: false, error: message });
+    refuse([`insta feedback: ${message}`]);
+}
+function inputError(e, json) {
+    if (!json)
+        throw e;
+    printJson({ status: 'error', submitted: false, error: e instanceof Error ? e.message : String(e) });
+    process.exitCode = 1;
+}
 export async function feedback(opts, deps = {}) {
+    let api;
+    try {
+        api = deps.api ?? await ApiClient.load();
+    }
+    catch (e) {
+        return inputError(e, opts.json);
+    }
+    const env = envForApiUrl(api.apiUrl);
+    if (env === 'staging')
+        refuseFeedback(STAGING, opts.json);
+    // Before the prompts, so nobody types out a report only to be told to sign in.
+    if (env === 'prod' && !api.config.accessToken)
+        refuseFeedback(SIGNED_OUT, opts.json);
     const interactive = deps.interactive ?? (!opts.json && !!process.stdin.isTTY && !!process.stdout.isTTY);
     const missingRequired = !opts.type || !opts.component || !opts.title || (!opts.detail && !opts.file);
     if (missingRequired && interactive)
@@ -198,13 +229,22 @@ export async function feedback(opts, deps = {}) {
         payload = await buildPayload(opts, { cliVersion: deps.cliVersion ?? cliVersion() });
     }
     catch (e) {
-        if (!opts.json)
-            throw e;
-        printJson({ status: 'error', submitted: false, error: e instanceof Error ? e.message : String(e) });
-        process.exitCode = 1;
-        return;
+        return inputError(e, opts.json);
+    }
+    // Fetched after the prompts: it lives five minutes, and a person can take longer than that to type.
+    let assertion;
+    if (env === 'prod') {
+        try {
+            // Bearer only: agent evidence adds a session round trip the timeout cannot bound, and 401s signing in cannot fix.
+            assertion = (await api.request('GET', '/me/feedback-assertion', undefined, { evidence: false, signal: AbortSignal.timeout(ASSERTION_TIMEOUT_MS) })).token;
+        }
+        catch (e) {
+            if (e instanceof ApiError && e.status === 401)
+                refuseFeedback(SIGNED_OUT, opts.json);
+            process.stderr.write(`warning: could not confirm who you are (${e instanceof Error ? e.message : String(e)}) — sending anyway, but nobody can reply to this report\n`);
+        }
     }
-    const result = await submit(payload, deps.fetchImpl ?? fetch);
+    const result = await submit(payload, deps.fetchImpl ?? fetch, assertion);
     if (result.status === 'unconfirmed') {
         // NOT a failure claim: the request was still in flight at the deadline and the server
         // finishes what it started, so saying "not submitted" here would be a false negative.

package/dist/index.js

@@ -574,7 +574,7 @@ const setupCompat = program.command('setup', { hidden: true }).description('Comp
 withSetupAgentOptions(setupCompat.command('agent').description('Alias of `insta agent setup`, kept for the console one-liner'));
 // ---- feedback (agent + human hurdle reports → the InstaCloud team) ----
 program.command('feedback')
-    .description('Report an InstaCloud-side hurdle (bug / missing feature / friction) to the InstaCloud team — about the insta toolkit itself, NEVER about the app you are building. Works logged-out and unlinked.')
+    .description('Report an InstaCloud-side hurdle (bug / missing feature / friction) to the InstaCloud team — about the insta toolkit itself, NEVER about the app you are building. On InstaCloud it needs `insta login`, so the team can reply; works unlinked.')
     .option('--type <type>', `what kind of hurdle: ${feedbackCmd.TYPES.join(' | ')}`)
     .option('--component <component>', `which part of the toolkit: ${feedbackCmd.COMPONENTS.join(' | ')}`)
     .option('--title <title>', 'one-line summary (≤200 chars)')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [