insta - npm Package Compare versions

Comparing version 0.0.43 to 0.0.44

dist/commands/setup.js

@@ -9,3 +9,3 @@ // `insta setup agent` — make this machine's coding agents InstaCloud-native in one step
 import { spawn } from 'node:child_process';
-import { existsSync, readFileSync, statSync } from 'node:fs';
+import { closeSync, createReadStream, existsSync, openSync, readFileSync, statSync } from 'node:fs';
 import { dirname, join } from 'node:path';
@@ -361,4 +361,51 @@ import os from 'node:os';
 // genuinely human step (authorizing in the browser) starts itself instead of being homework.
+// Where to read the answer from. Under `curl … | sh` stdin is the SCRIPT pipe, not the human —
+// but the controlling terminal can still answer, via /dev/tty (the standard installer trick;
+// Homebrew prompts the same way). Never on Windows (no /dev/tty, and the curl path doesn't exist
+// there), and never without one (agents, CI, cron — openSync fails, so they can't be prompted).
+/** Wrap an already-open fd as a prompt input with SINGLE-OWNER cleanup: the stream owns the fd
+ *  (autoClose), close() only destroys the stream, and post-close stream errors are swallowed.
+ *  ReadStream.destroy() closes the fd asynchronously on Node 20, so a second closeSync here
+ *  would race it into an unhandled EBADF right after the user answers. */
+export function makePromptSource(fd) {
+    const stream = createReadStream('', { fd, autoClose: true });
+    stream.on('error', () => { });
+    return { input: stream, close: () => { try {
+            stream.destroy();
+        }
+        catch { /* already destroyed */ } } };
+}
+const openPromptInput = () => {
+    if (process.stdin.isTTY)
+        return { input: process.stdin, close: () => { } };
+    if (process.platform === 'win32')
+        return null;
+    try {
+        return makePromptSource(openSync('/dev/tty', 'r'));
+    }
+    catch {
+        return null;
+    }
+};
+/** Whether a human can answer a prompt at all: an interactive stdin, or a reachable /dev/tty
+ *  (the curl|sh case). The stdout-TTY requirement lives in shouldOfferLogin — an agent piping
+ *  our output must never be prompted even though its process may have a controlling terminal. */
+export function canPromptViaTty() {
+    if (process.stdin.isTTY)
+        return true;
+    if (process.platform === 'win32')
+        return false;
+    try {
+        closeSync(openSync('/dev/tty', 'r'));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 const defaultAsk = async (question) => {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const src = openPromptInput();
+    if (!src)
+        return false; // gate said yes but the terminal vanished — decline, never hang
+    const rl = createInterface({ input: src.input, output: process.stdout });
     // EOF (Ctrl-D) closes the interface without ever answering the question — resolve that as a
@@ -371,2 +418,3 @@ // decline instead of hanging forever after the checkmarks.
     rl.close();
+    src.close();
     return !/^n/i.test(answer.trim());
@@ -377,3 +425,3 @@ };
     login: () => loginOauth('github', {}),
-    stdinTty: !!process.stdin.isTTY,
+    stdinTty: canPromptViaTty(),
     stdoutTty: !!process.stdout.isTTY,
@@ -452,5 +500,5 @@ }) {
     info(loggedIn
-        ? 'next: open your coding agent inside your app and ask it to "deploy this app on InstaCloud"'
-        : 'next: open your coding agent inside your app and ask it to "deploy this app on InstaCloud" — it will walk you through `insta login`');
+        ? 'next: open your coding agent inside your app and start building — ask it to "deploy this app on InstaCloud" when you\'re ready'
+        : 'next: open your coding agent inside your app and start building — ask it to "deploy this app on InstaCloud" when you\'re ready (it will walk you through `insta login`)');
 }
 //# sourceMappingURL=setup.js.map

package.json

 {
   "name": "insta",
-  "version": "0.0.43",
+  "version": "0.0.44",
   "type": "module",
@@ -5,0 +5,0 @@ "description": "InstaCloud CLI — a thin client of the platform control-plane API.",

README.md

@@ -160,3 +160,3 @@ # insta-cli
 ```bash
-curl -fsSL https://raw.githubusercontent.com/InsForge/insta-cli/main/install.sh | sh -s -- --agents --staging -y
+curl -fsSL https://raw.githubusercontent.com/InsForge/insta-cli/main/install.sh | sh -s -- --agents --staging
 ```
@@ -163,0 +163,0 @@

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

333148

0.65%

Lines of code

5820

0.83%

No dependency changes