feat: bare insta login signs in from the browser

[CarmenDou]

What

Bare insta login now signs you in from the browser instead of dying with --email is required. It rides the existing RFC 8628 device grant and additionally opens the console approval page locally — sign in there with whatever the account uses (email, GitHub, Google), check the code, approve. setup agent flows into this same login instead of hardcoding --oauth github, which dead-ended Google/email accounts.

This makes the console Quick Start's Login step (insta login + "sign in when the browser opens", insta-frontend src/lib/agent-setup.ts loginCommand) true as printed — no console change needed. Same shape as insforge login: browser session present → approve for that account; none → the page's /signin?next=… round-trip first.

How

• commands/auth.ts — login() bare branch calls loginDevice(opts, openUrl) instead of die; a password (--password / $INSTA_PASSWORD) without --email still errors, now saying so. deviceGrant takes an optional open launcher: when present it opens the verification link and still prints it (spawn launch failures are async-only, same reasoning as browserOauth); the expiry retry hint names the flow that ran (insta login vs insta login --device).
• commands/setup.ts — loginFlow.login = loginDevice({}, openUrl); prompt copy "log in now in the browser? (Y/n)"; the failed-login hint no longer claims the browser flow can't work remotely (the printed link works from any device).
• index.ts — help text: bare = browser sign-in; --device = same, print-only for other machines.
• --email, --oauth github|google, --device, --api-key behavior unchanged.
• README quickstart/auth sections + install.sh next-steps hint now lead with bare insta login.

Verify

• npm run typecheck && npm test — 657/657 green (new: opener launched at the verification link and link still printed; expiry hint per flow; --device hint pinned).
• Smoke from dist/ against prod: bare insta login prints "opening your browser to sign in…" + the console.instacloud.com/device?user_code=… fallback link and polls; insta login --device unchanged (print-only); insta login --password x errors with the --email hint; login --help shows the new synopsis.

---

Summary by cubic

Bare insta login now opens your browser to sign in from the console approval page instead of failing with --email is required. setup agent uses this same browser login instead of hardcoding --oauth github, which dead-ended Google and email accounts.

• Works with any account type (email, GitHub, Google) via the existing device grant.
• --device keeps the print-only link for machines without a usable browser.
• --password without --email still errors, now with a message saying so; an explicitly empty --email errors too instead of falling through to the bare browser flow.
• The expiry retry hint names the flow that ran (insta login vs insta login --device).
• Help text, README quickstart, install.sh, and the not-logged-in and env-switch hints now lead with bare insta login.

^{Written for commit 6b899f0. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 7 files

_{You’re at about 91% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[jwfing]

LGTM - approved.

[jwfing]

Summary
Bare browser login is implemented in the expected place, but the PR misses a required command-reference update.

Requirements context
I used the PR title/description as the behavioral intent: bare insta login should launch the browser-backed device approval flow, --device should stay print-only, and setup agent should no longer hardcode GitHub OAuth. I also used the repo guidance in AGENTS.md, which explicitly requires command/flag changes to be mirrored in skills/insta/cli-reference.md, and the README’s pointer to that file as the full command reference.

Findings

Critical

• AGENTS.md:16-17, src/index.ts:64-68, README.md:193-198: This changes the public insta login command contract, but the required agent-facing reference skills/insta/cli-reference.md is not updated in this change. That file is called out as non-negotiable for command/flag changes, and agents using the documented full reference may keep learning the old GitHub-first login behavior. Please update the CLI reference in the matching superproject skills submodule/change set.

Suggestion

• src/api.ts:127-129, src/commands/env.ts:70-74: Two runtime hints still tell unauthenticated users to run insta login --oauth github. Since this PR’s stated goal is to make bare insta login the account-type-neutral path, these should probably move to insta login as well.
• src/commands/auth.ts:27-32, test/device-login.test.ts:145-170: The new opener behavior is covered at deviceGrant, but there is no direct test that top-level login({}) dispatches to the opener-backed device flow, or that --password / $INSTA_PASSWORD without --email takes the new error branch. Consider adding a thin dispatch-level test so this public default does not regress silently.

Information

• Software engineering: The implementation follows the existing DI style for side-effectful flows, and git diff --check main...HEAD is clean. I did not run npm run typecheck or npm test because node_modules is absent and this review is read-only, so installing dependencies was out of scope.
• Security: No security-relevant issue found. The new local browser launch uses the existing openUrl path, which gates to HTTP(S) before spawning (src/util.ts:36-51), and the device flow still prints the user-code verification step (src/commands/auth.ts:138-150).
• Performance: No performance issue found. The polling loop retains the bounded lifetime and interval/backoff behavior (src/commands/auth.ts:137-157, src/commands/auth.ts:168-170).

Verdict
Request changes due to the missing required CLI reference update.

[jwfing]

Summary
Bare insta login is implemented through the existing device grant with a local opener, but the required CLI reference mirror is missing/stale.

Requirements Context
I based the intended behavior on the PR title/description, the updated README authentication docs (README.md:61-93, README.md:191-198), and the repo requirements in AGENTS.md:15-17 plus .claude/skills/developing-insta-cli/SKILL.md:36-38. I did not see a linked issue in the provided PR metadata. I also checked the README-linked command reference, which currently still documents only explicit email/OAuth/device login forms: https://github.com/InsForge/insta-skills/blob/main/insta/cli-reference.md#L7-L8

Findings

Critical

• AGENTS.md:15-17, .claude/skills/developing-insta-cli/SKILL.md:36-38: This PR changes the login command surface and help text (src/commands/auth.ts:26-35, src/index.ts:64-68) but does not include the required mirror update to skills/insta/cli-reference.md. The README points users/agents to that full reference at README.md:193-194, and the current linked reference remains stale for bare insta login and the new --device distinction. Because that mirror is explicitly non-negotiable and agent-facing, this should be fixed before merge.

Suggestion

• (none)

Information

• Software engineering/functionality: The implementation follows the repo’s DI testing pattern and adds focused coverage for bare-login dispatch, opener invocation, printed fallback link, expiry hint wording, empty --email, password-without-email, and the setup-agent prompt (test/login-dispatch.test.ts:28-70, test/device-login.test.ts:145-169, test/setup-agent.test.ts:143-154).
• Security: No security-relevant changes found. The new opener path still goes through the existing HTTP(S)-only launcher guard (src/util.ts:36-45), and the device flow continues to print the user-code verification guard (src/commands/auth.ts:141-153).
• Performance: No performance-relevant changes found. The device polling loop keeps the existing bounded lifetime and slow_down backoff behavior (src/commands/auth.ts:156-182).
• Verification note: git diff --check main...HEAD passed. npm run typecheck could not run in this checkout because node_modules is absent and tsc was not found; I did not run npm test for the same missing dependency reason (package.json:35-40).

Verdict
Request changes until the required skills/insta/cli-reference.md mirror is updated for bare browser login and print-only --device semantics.

[jwfing]

LGTM - approved.