fix(go.mod): rename module path + docs(oss-prep): LICENSE/SECURITY/COC/CONTRIBUTING

CODE_OF_CONDUCT.md

@@ -0,0 +1,24 @@
+# Code of conduct
+
+InstaNode is a small, focused engineering community. We want everyone who participates — issue reporters, PR authors, reviewers, maintainers — to feel safe and respected.
+
+## Expectations
+
+- Be respectful in code review and issues. Critique code, not people.
+- Assume good intent. Ask questions before making accusations.
+- Keep discussions on topic. Off-topic and inflammatory threads will be closed.
+- No harassment, personal attacks, discriminatory language, or unwelcome sexual attention.
+
+## Enforcement
+
+Maintainers may close issues, lock threads, edit comments, or block accounts that violate these expectations.
+
+## Reporting
+
+Email security@instanode.dev to report a concern. We treat reports confidentially. We aim to respond within 72 hours.
+
+## Scope
+
+These expectations apply to all project spaces — issues, pull requests, discussions, and any official InstaNode communication channel — and to public spaces when someone is representing the project.
+
+This policy is intentionally short; we will lengthen it as the community grows.

CONTRIBUTING.md

@@ -0,0 +1,44 @@
+# Contributing to the InstaNode CLI
+
+## Filing issues
+
+Bugs and feature requests welcome at https://github.com/InstaNode-dev/cli/issues.
+
+## Workflow
+
+```
+git clone https://github.com/InstaNode-dev/cli
+cd cli
+go build ./...
+go vet ./...
+go test ./... -short -p 1
+```
+
+All three must pass before opening a PR.
+
+## Local testing
+
+```
+go run ./cmd/instanode --help
+go run ./cmd/instanode up
+```
+
+Set `INSTANODE_API_URL=http://localhost:8080` to point at a local api instance.
+
+## Style
+
+- Follow existing patterns. Help strings are user-visible — keep them tight.
+- New flags get a one-line `--help` description and a test that exercises the success + error path.
+- Errors returned to the user should include a one-line agent_action hint matching the api's structured error envelope (see api/internal/handlers/helpers.go for the registry).
+
+## PR checklist
+
+- `go build ./...` green
+- `go vet ./...` green
+- `go test ./... -short -p 1` green
+- Help-text changes mirrored in README if user-visible
+- New command added: include a unit test + a README example
+
+## License
+
+MIT. By contributing, you agree your contributions are licensed under the same.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 InstaNode
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -5,7 +5,7 @@ Zero-friction infrastructure CLI for [instanode.dev](https://instanode.dev).
 ## Install
 
 ```bash
-go install github.com/instant-dev/cli@latest
+go install github.com/InstaNode-dev/cli@latest
 ```
 
 ## Usage

SECURITY.md

@@ -0,0 +1,53 @@
+# Security Policy
+
+We take the security of the InstaNode CLI seriously. Thank you for helping
+keep our users and infrastructure safe.
+
+## Reporting a Vulnerability
+
+Please report suspected security issues by email to **security@instanode.dev**.
+
+Include as much of the following as you can:
+
+- A description of the vulnerability and its impact.
+- Steps to reproduce, ideally a minimal proof of concept.
+- The affected version, commit SHA, or release tag.
+- Any suggested remediation.
+
+We aim to acknowledge new reports within **2 business days** and to provide
+a substantive response (triage outcome, severity, expected timeline) within
+**7 business days**.
+
+Please do **not** open a public GitHub issue, pull request, or discussion
+for suspected vulnerabilities until a fix is available and we have agreed
+on a coordinated disclosure date.
+
+## Scope
+
+In scope:
+
+- The CLI binary and source in this repository (`github.com/InstaNode-dev/cli`).
+- Authentication flows used by the CLI (device-code login, token storage,
+  keyring integration).
+- Any code path that handles user credentials, API tokens, or secrets.
+
+Out of scope:
+
+- Vulnerabilities in third-party dependencies (please report upstream; we
+  will pick up patched versions promptly).
+- Issues that require a pre-compromised local machine (full local user
+  account compromise, malicious OS packages, etc.).
+- Findings that depend on running custom or modified builds of the CLI.
+- Social engineering of InstaNode staff or users.
+
+## Safe Harbor
+
+We will not pursue or support legal action against researchers who:
+
+- Make a good-faith effort to comply with this policy.
+- Avoid privacy violations, destruction of data, and disruption of service.
+- Only interact with accounts they own or have explicit permission to access.
+- Give us a reasonable opportunity to remediate before public disclosure.
+
+If in doubt, email **security@instanode.dev** before testing — we are happy
+to scope a test plan with you.

cmd/bughunt_b15_p1p2_test.go

@@ -21,9 +21,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/instant-dev/cli/internal/cliconfig"
-	"github.com/instant-dev/cli/internal/secretstore"
-	"github.com/instant-dev/cli/internal/tokens"
+	"github.com/InstaNode-dev/cli/internal/cliconfig"
+	"github.com/InstaNode-dev/cli/internal/secretstore"
+	"github.com/InstaNode-dev/cli/internal/tokens"
 )
 
 // ── B15-P1 (9): status --json returns [] on empty (not null) ────────────────

cmd/bughunt_b15_test.go

@@ -23,9 +23,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/instant-dev/cli/internal/cliconfig"
-	"github.com/instant-dev/cli/internal/secretstore"
-	"github.com/instant-dev/cli/internal/tokens"
+	"github.com/InstaNode-dev/cli/internal/cliconfig"
+	"github.com/InstaNode-dev/cli/internal/secretstore"
+	"github.com/InstaNode-dev/cli/internal/tokens"
 )
 
 // ── B15-P0 (1): whoami respects INSTANT_TOKEN ───────────────────────────────

cmd/bughunt_p1_test.go

@@ -26,8 +26,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/instant-dev/cli/internal/cliconfig"
-	"github.com/instant-dev/cli/internal/secretstore"
+	"github.com/InstaNode-dev/cli/internal/cliconfig"
+	"github.com/InstaNode-dev/cli/internal/secretstore"
 )
 
 // ── T16 P1-4 — `up` MUST NOT silently re-provision when the list fetch

cmd/bughunt_p2_test.go

@@ -25,8 +25,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/instant-dev/cli/internal/cliconfig"
-	"github.com/instant-dev/cli/internal/secretstore"
+	"github.com/InstaNode-dev/cli/internal/cliconfig"
+	"github.com/InstaNode-dev/cli/internal/secretstore"
 )
 
 // ── T16 P2-1 — structured error envelope parsing.

cmd/deploy_stub.go

@@ -65,7 +65,7 @@ Use one of these surfaces today:
          -F "tarball=@./app.tar.gz"
 
 Track the upcoming native CLI support at:
-  https://github.com/instant-dev/cli/issues
+  https://github.com/InstaNode-dev/cli/issues
 `,
 	Args: cobra.NoArgs,
 	RunE: func(cmd *cobra.Command, args []string) error {

cmd/extras.go

@@ -24,7 +24,7 @@ import (
 	"strings"
 	"text/tabwriter"
 
-	"github.com/instant-dev/cli/internal/tokens"
+	"github.com/InstaNode-dev/cli/internal/tokens"
 	"github.com/spf13/cobra"
 )
 

cmd/integration_test.go

@@ -34,8 +34,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/instant-dev/cli/internal/secretstore"
-	"github.com/instant-dev/cli/internal/tokens"
+	"github.com/InstaNode-dev/cli/internal/secretstore"
+	"github.com/InstaNode-dev/cli/internal/tokens"
 	"github.com/spf13/cobra"
 )
 

cmd/login.go

@@ -12,8 +12,8 @@ import (
 	"time"
 
 	"github.com/spf13/cobra"
-	"github.com/instant-dev/cli/internal/cliconfig"
-	"github.com/instant-dev/cli/internal/tokens"
+	"github.com/InstaNode-dev/cli/internal/cliconfig"
+	"github.com/InstaNode-dev/cli/internal/tokens"
 )
 
 // pollInterval is how often the CLI checks for auth completion.

cmd/monitor.go

@@ -10,7 +10,7 @@ import (
 	"regexp"
 	"text/tabwriter"
 
-	"github.com/instant-dev/cli/internal/tokens"
+	"github.com/InstaNode-dev/cli/internal/tokens"
 	"github.com/spf13/cobra"
 )
 

cmd/root.go

@@ -9,8 +9,8 @@ import (
 	"time"
 
 	"github.com/spf13/cobra"
-	"github.com/instant-dev/cli/internal/cliconfig"
-	"github.com/instant-dev/cli/internal/secretstore"
+	"github.com/InstaNode-dev/cli/internal/cliconfig"
+	"github.com/InstaNode-dev/cli/internal/secretstore"
 )
 
 var _ = httpListTimeout // documented constant; referenced in tests / future refactor

cmd/up.go

@@ -44,7 +44,7 @@ import (
 	"os"
 	"strings"
 
-	"github.com/instant-dev/cli/internal/tokens"
+	"github.com/InstaNode-dev/cli/internal/tokens"
 	"github.com/spf13/cobra"
 	"gopkg.in/yaml.v3"
 )

cmd/whoami.go

@@ -6,8 +6,8 @@ import (
 	"os"
 	"strings"
 
-	"github.com/instant-dev/cli/internal/cliconfig"
-	"github.com/instant-dev/cli/internal/secretstore"
+	"github.com/InstaNode-dev/cli/internal/cliconfig"
+	"github.com/InstaNode-dev/cli/internal/secretstore"
 	"github.com/spf13/cobra"
 )
 

go.mod

@@ -1,4 +1,4 @@
-module github.com/instant-dev/cli
+module github.com/InstaNode-dev/cli
 
 go 1.23
 

internal/cliconfig/cliconfig.go

@@ -23,7 +23,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/instant-dev/cli/internal/secretstore"
+	"github.com/InstaNode-dev/cli/internal/secretstore"
 )
 
 // ErrNotLoggedIn is returned when an action requires authentication

internal/cliconfig/cliconfig_test.go

@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/instant-dev/cli/internal/secretstore"
+	"github.com/InstaNode-dev/cli/internal/secretstore"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

main.go

@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/instant-dev/cli/cmd"
+	"github.com/InstaNode-dev/cli/cmd"
 )
 
 // B15-P0 (2) — build-info stamping. Wired in at link time via: