feat(cli): operate-verb parity with MCP + Homebrew tap publishing (#30)

Wave-2 A4. Adds the day-2 operate surface the MCP server shipped in
v0.9 (vault, env-patch, presign, pause, resume, rotate, wake,
capabilities, deploy-events) plus the backups read/write surface, so
agents no longer fall back to curl after provisioning. Endpoints mirror
mcp/src/client.ts exactly; path fragments are named constants.

New commands:
  instant vault set <env> <key>        PUT   /api/v1/vault/:env/:key
  instant vault rotate <env> <key>     POST  /api/v1/vault/:env/:key/rotate
  instant deploy env <id> K=V...       PATCH /deploy/:id/env
  instant deploy wake <id>             POST  /deploy/:id/wake
  instant deploy events <id>           GET   /api/v1/deployments/:id/events
  instant stack env <slug> K=V...      PATCH /stacks/:slug/env
  instant storage presign <token>      POST  /storage/:token/presign
  instant capabilities                 GET   /api/v1/capabilities
  instant resource pause|resume        POST  /api/v1/resources/:token/{pause,resume}
  instant resource rotate <token>      POST  /api/v1/resources/:token/rotate-credentials
  instant resource backup <token>      POST  /api/v1/resources/:token/backup
  instant resource backups <token>     GET   /api/v1/resources/:token/backups

Auth contract matches MCP: everything requires a token except
storage presign (broker mode — the storage token in the URL is the
credential) and capabilities (public pre-flight discovery). Every
command supports --json; errors flow through wrapJSONErr.

Homebrew tap:
  - brews block publishing the 'instant' formula to
    InstaNode-dev/homebrew-tap (repo created this sprint)
  - release.yml passes HOMEBREW_TAP_TOKEN through to goreleaser
  - skip_upload template guard: until the operator mints a repo-scoped
    PAT on the tap and sets the HOMEBREW_TAP_TOKEN secret, the formula
    push is skipped WITHOUT failing the release (verified via
    'goreleaser release --snapshot' dry run)

VERSION bumped to 0.3.0 for the release cut after merge.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: mastermanas805

.github/workflows/release.yml

@@ -71,3 +71,11 @@ jobs:
           # NOT a long-lived PAT. GoReleaser uses it to upload the
           # release artifacts to the same repo.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # HOMEBREW_TAP_TOKEN pushes the brew formula to
+          # InstaNode-dev/homebrew-tap (a cross-repo write the per-job
+          # GITHUB_TOKEN cannot do — it needs an operator-minted PAT with
+          # `repo` scope on the tap). When the secret is unset this
+          # resolves to "" and the brews.skip_upload guard in
+          # .goreleaser.yml skips the formula push WITHOUT failing the
+          # release.
+          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}

.gitignore

@@ -6,3 +6,7 @@ bin/
 
 # GoReleaser snapshot/release artifacts
 dist/
+
+# Local coverage artifacts (CI regenerates these)
+coverage.out
+coverage.xml

.goreleaser.yml

@@ -121,6 +121,41 @@ sboms:
   - id: instant-sbom
     artifacts: archive
 
+# Homebrew tap (Wave-2 A4). Publishes a formula to InstaNode-dev/homebrew-tap
+# so `brew tap InstaNode-dev/tap && brew install instant` works.
+#
+# TOKEN SHAPE: pushing to the tap repo needs a PAT with `repo` scope on
+# InstaNode-dev/homebrew-tap, stored as the HOMEBREW_TAP_TOKEN secret on
+# THIS repo (the per-job GITHUB_TOKEN is scoped to InstaNode-dev/cli and
+# cannot push to the tap). Until the operator mints that PAT and runs
+# `gh secret set HOMEBREW_TAP_TOKEN -R InstaNode-dev/cli`, the skip_upload
+# guard below turns the formula push into a no-op — the release itself
+# still succeeds (binaries, checksums, signatures, SBOMs all land).
+# envOrDefault keeps local `goreleaser release` runs (no env var at all)
+# from failing template evaluation.
+brews:
+  - name: instant
+    repository:
+      owner: InstaNode-dev
+      name: homebrew-tap
+      branch: main
+      token: '{{ envOrDefault "HOMEBREW_TAP_TOKEN" "" }}'
+    directory: Formula
+    homepage: https://instanode.dev
+    description: "instanode.dev CLI — zero-friction developer infrastructure"
+    license: MIT
+    commit_author:
+      name: instanode-release-bot
+      email: noreply@instanode.dev
+    commit_msg_template: "chore: brew formula update for {{ .ProjectName }} {{ .Tag }}"
+    install: |
+      bin.install "instant"
+    test: |
+      system "#{bin}/instant", "--version"
+    # Resilient-by-default: skip the tap push (NOT the release) when the
+    # operator hasn't created HOMEBREW_TAP_TOKEN yet.
+    skip_upload: '{{ if envOrDefault "HOMEBREW_TAP_TOKEN" "" }}false{{ else }}true{{ end }}'
+
 release:
   github:
     owner: InstaNode-dev

VERSION

@@ -1 +1 @@
-0.2.0
+0.3.0

cmd/deploy_stub.go

@@ -43,8 +43,13 @@ var deployCmd = &cobra.Command{
 	// The Short string surfaces in the root command list — that one row is
 	// the agent's first signal, so it has to carry the "use MCP or curl"
 	// pointer.
-	Short: "[stub — current MCP/API path: POST /deploy/new or create_deploy via MCP. CLI deploy verbs not yet implemented]",
-	Long: `Deploy commands are not implemented in the CLI yet.
+	Short: "[stub for build verbs — POST /deploy/new or create_deploy via MCP; native: env, wake, events]",
+	Long: `Deploy BUILD commands (new/list/get/logs/redeploy/delete) are not
+implemented in the CLI yet. The operate verbs ARE native:
+
+  instant deploy env <app-id> KEY=VALUE…   Merge env vars (PATCH /deploy/:id/env)
+  instant deploy wake <app-id>             Wake a scaled-to-zero app (POST /deploy/:id/wake)
+  instant deploy events <app-id>           Failure timeline (GET /api/v1/deployments/:id/events)
 
 The platform exposes the full deploy API at:
   POST   /deploy/new          (multipart tarball upload + build)

cmd/donebar_command_coverage_test.go

@@ -95,6 +95,18 @@ var commandTestMap = map[string]string{
 	"instant deploy redeploy": "TestDeployStub_KnownVerbs",
 	"instant deploy delete":   "TestDeployStub_KnownVerbs",
 
+	// ── operate verbs (Wave-2 A4 — MCP parity, operate.go) ───────────────────
+	"instant vault":           "TestOperate_BareGroupsPrintHelp",
+	"instant vault set":       "TestOperate_VaultSet",
+	"instant vault rotate":    "TestOperate_VaultRotate",
+	"instant stack":           "TestOperate_BareGroupsPrintHelp",
+	"instant stack env":       "TestOperate_StackEnvPatch",
+	"instant deploy env":      "TestOperate_DeployEnvPatch",
+	"instant deploy wake":     "TestOperate_DeployWake",
+	"instant deploy events":   "TestOperate_DeployEvents",
+	"instant storage presign": "TestOperate_StoragePresign",
+	"instant capabilities":    "TestOperate_Capabilities",
+
 	// ── bundle / manifest ────────────────────────────────────────────────────
 	"instant up": "TestIntegration_UpProvisionsAndReconciles",
 

cmd/extras.go

@@ -66,29 +66,42 @@ var vectorNewCmd = &cobra.Command{
 // stays the list view). `instant resource <token>` shows one resource;
 // `instant resource delete <token>` tears it down.
 var resourceCmd = &cobra.Command{
-	Use:   "resource <token> | delete <token>",
-	Short: "Show or delete a single resource by token",
-	Long: `Show or delete a single resource by token.
+	Use:   "resource <token> | <verb> <token>",
+	Short: "Show, delete, or operate on a single resource by token",
+	Long: `Show, delete, or operate on a single resource by token.
 
   instant resource <token>             Print the resource's metadata + connection URL
   instant resource delete <token>      Tear down the resource. Requires --yes
                                        (or an interactive 'y' confirmation) to
                                        actually delete — printing nothing
                                        destructive when --yes is absent.
+  instant resource pause <token>       Suspend without deleting (POST …/pause, Pro+)
+  instant resource resume <token>      Un-pause (POST …/resume, Pro+)
+  instant resource rotate <token>      Rotate credentials; prints the NEW
+                                       connection URL (POST …/rotate-credentials)
+  instant resource backup <token>      Queue an ad-hoc backup (POST …/backup, tier-gated)
+  instant resource backups <token>     List backups (GET …/backups)
 
 The token argument is the bearer token returned by 'instant <type> new' or
 listed in 'instant resources'.`,
 	Args: cobra.MinimumNArgs(1),
 	RunE: func(cmd *cobra.Command, args []string) error {
-		// `instant resource delete <token>` routes here via the same parent;
-		// peel the verb off and dispatch. Done at RunE rather than as a real
-		// sub-sub-command so the natural `instant resource <token>` (no
+		// `instant resource <verb> <token>` routes here via the same parent;
+		// peel the verb off and dispatch. Done at RunE rather than as real
+		// sub-sub-commands so the natural `instant resource <token>` (no
 		// verb) reads as the detail view.
-		if args[0] == "delete" {
+		switch verb := args[0]; verb {
+		case "delete":
 			if len(args) < 2 {
 				return wrapJSONErr(cmd, fmt.Errorf("instant resource delete: token argument is required"))
 			}
 			return wrapJSONErr(cmd, runResourceDelete(cmd, args[1]))
+		case "pause", "resume", "rotate", "backup", "backups":
+			// Wave-2 A4 operate verbs — handlers live in operate.go.
+			if len(args) < 2 {
+				return wrapJSONErr(cmd, fmt.Errorf("instant resource %s: token argument is required", verb))
+			}
+			return wrapJSONErr(cmd, runResourceOperate(verb, args[1]))
 		}
 		return wrapJSONErr(cmd, runResourceDetail(cmd, args[0]))
 	},