instabox 0.6.1 → 0.6.3

package/bin/instabox.mjs

@@ -497,10 +497,7 @@ async function onboard(wantBox) {
   });
   if (kg.status !== 0 || !existsSync(key + '.pub')) die('could not create an SSH key (ssh-keygen failed)');
   const m = await client.call('GET', '/v1/machines/' + enc(box.id));
-  const ttlSeconds = Math.max(
-    60,
-    Math.floor((new Date(m.timeoutAt || Date.now() + CERT_MIN * 60_000) - Date.now()) / 1000),
-  );
+  const ttlSeconds = CERT_MIN * 60;
   const c = await client.call('POST', `/v1/machines/${enc(box.id)}/connections`, {
     publicKey: readFileSync(key + '.pub', 'utf8').trim(),
     ttlSeconds,
@@ -508,8 +505,7 @@ async function onboard(wantBox) {
   writeFileSync(key + '-cert.pub', c.certificate.trim() + '\n');
   writeFileSync(join(dir, 'known_hosts'), `@cert-authority [${c.host}]:${c.port} ${c.hostTrust.publicKey}\n`);
 
-  const pauses = m.timeoutAt ? dim(` · pauses itself in ${Math.max(1, Math.round(ttlSeconds / 60))} min`) : '';
-  process.stdout.write(`\r  ${green('✓')} box ${bold(m.name)} ${ready}${pauses}\n`);
+  process.stdout.write(`\r  ${green('✓')} box ${bold(m.name)} ${ready}\n`);
   const note = guestUserNote(box.user, m.name, m.guestUser);
   if (note) console.log(dim(`  ${note}`));
   await reportInstalls(cli);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instabox",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest",
   "type": "module",
   "bin": {

package/skills/instabox/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: instabox
-description: Use when the user wants a cloud Linux box (instabox sandbox) from the terminal with the `instabox` CLI — create one, SSH in, run a command in it, read its files, set its timeout, or delete it, or to report a problem with instabox itself (`instabox feedback`). For saving or restoring a box's disks, see instabox-snapshots.
+description: Use when the user wants a cloud Linux box (instabox sandbox) from the terminal with the `instabox` CLI — create one, SSH in, run a command in it, read its files, set its idle auto-pause, or delete it, or to report a problem with instabox itself (`instabox feedback`). For saving or restoring a box's disks, see instabox-snapshots.
 metadata:
   installed-by: instabox
 ---
@@ -28,7 +28,19 @@ For CI or an agent without a browser, use an API key instead: `export INSTABOX_A
 - `herdr`: for the herdr client.
 - `orca`: for Orca desktop and mobile.
 
-`instabox templates` lists the ones this server offers.
+`instabox templates` lists the ones this server offers. The free plan creates boxes from `agent-browser` only: another template is refused with `403 template_not_allowed` and needs a paid plan (the user upgrades on the dashboard). A box from a snapshot (`--snapshot`) works on every plan, whatever template the snapshot came from. Do not retry another template on the free plan; use `agent-browser`.
+
+## Sizes
+
+A box is 4 vCPU / 8 GB of memory unless `create` names another size of the account's plan with both `--vcpus` and `--mem-mib`:
+
+| Plan | Sizes (`--vcpus` / `--mem-mib`)               |
+| ---- | --------------------------------------------- |
+| Free | 4 / 8192 (default)                            |
+| Pro  | 2 / 4096, 4 / 8192 (default), 8 / 16384       |
+| Team | 2 / 4096, 4 / 8192 (default) up to 32 / 65536 |
+
+`instabox whoami --json` lists the sizes this account may create as `allowedSpecs` (the default first, then the plan's others and any an admin granted); check it rather than assuming the plan. Another size is refused with `400 spec_not_allowed`, whose message names the account's sizes. Pick a size for the work: 2 vCPU (paid plans) for light editing or a single agent, the default for most builds, 8 vCPU (paid plans) for heavy builds or many processes. `--snapshot` takes the same flags. The size is fixed once the box exists; for another size, save a snapshot and create a new box from it with the size flags.
 
 ## Everyday commands
 
@@ -41,7 +53,6 @@ instabox exec work -- uname -a                  # one command, no SSH client nee
 instabox exec work --cwd /data/home -- ls -la   # exec runs `bash -lc` as the box's user
 instabox files work /data/home                  # list a directory (or print a text file)
 instabox auto-suspend work 10m                  # idle time before it pauses (fixed at 30m unless an admin gave the account manual lifecycle)
-instabox timeout work 2h --on-timeout pause     # pause (keeps memory) or kill at the deadline
 instabox stop work && instabox start work       # stop ends processes, keeps disks
 instabox suspend work && instabox resume work   # pause/resume keeps running processes
 instabox rename work api                        # rename in place, any state; ID and port URLs stay
@@ -49,8 +60,8 @@ instabox rm work                                # delete the box
 ```
 
 - Names or IDs (`m_...`) both work wherever `<id-or-name>` is accepted.
-- `create` options: `--template T` or `--snapshot S`, `--auto-suspend D|0`, `--timeout D [--on-timeout pause|kill]`, `--meta K=V`, `--org O`, `--secrets all|NAME,NAME|none`, `--env-secrets NAME,NAME|none`, `--no-wait`. Every box is the same size (`instabox usage` shows it); there are no size flags.
-- A box pauses itself after 30 idle minutes (no agent working, no terminal use, little CPU) and wakes on the next `exec`, `ssh`, `files`, public port request or `instabox wake <box>`; a paused box keeps its memory and processes. The 30 minutes are fixed for every account unless an admin gave it manual lifecycle: only then do `--auto-suspend 0` (always on) and `--auto-suspend 2h` apply, and the CLI prints a note when the server kept 30m. Timeouts are capped at 4h the same way. Do not try to keep a box on by other means; a paused box resumes on the next command.
+- `create` options: `--template T` or `--snapshot S`, `--vcpus N --mem-mib M` (a size of the plan, see Sizes), `--auto-suspend D|0`, `--meta K=V`, `--org O`, `--secrets all|NAME,NAME|none`, `--env-secrets NAME,NAME|none`, `--no-wait`.
+- A box pauses itself after 30 idle minutes (no agent working, no terminal use, little CPU) and wakes on the next `exec`, `ssh`, `files`, public port request or `instabox wake <box>`; a paused box keeps its memory and processes. The 30 minutes are fixed for every account unless an admin gave it manual lifecycle: only then do `--auto-suspend 0` (always on) and `--auto-suspend 2h` apply, and the CLI prints a note when the server kept 30m. Boxes have no other timeout. Do not try to keep a box on by other means; a paused box resumes on the next command.
 - Use `exec` to run a command and read its output, and `ssh` for an interactive shell.
 - `exec` returns the command's exit code and takes `--stdin` to pipe input. It stops the command after `--timeout` seconds: 60 by default, 600 at most. Run anything longer (installs, builds, test suites) over SSH, which has no time limit and also returns the exit code: `instabox ssh work -- 'cd /data/workspace/app && npm ci'`.
 - The box's HOME has `MACHINE.md` (which box it is, its size, what survives a stop, the installed tools) and `AGENTS.md`. Both are worth reading before working in the box; they appear a moment after it starts.
@@ -109,6 +120,6 @@ instabox feedback --json --type bug --component cli --area exec \
 
 ## Habits
 
-- Forgotten boxes pause themselves. Give a box a `--timeout` when it must stop at a deadline, or `--timeout D --on-timeout kill` when it should be deleted then.
+- Forgotten boxes pause themselves after 30 idle minutes. Delete a box with `instabox rm` once its work is done.
 - When the user asks for a new box, create one, with a name `instabox ls` does not already show. Offer an existing box only when they want to continue earlier work in it.
 - `instabox usage` shows storage use and limits. A quota error means delete or stop something; do not retry the same create in a loop.

package/skills/instabox-move-repo/SKILL.md

@@ -72,7 +72,7 @@ BOX=<box>
 instabox create --name "$BOX" --meta repo="$(basename "$DEST")"
 ```
 
-Box names are lowercase letters, digits and `-`. Every box is the same size. The default template (`agent-browser`, shown as standard in the dashboard) has git, Node.js 22, Python (uv), Go, Rust, a C toolchain, Docker and a desktop with Chromium. Do not add a kill timeout: this box is meant to stay (offer `instabox timeout <box> 8h --on-timeout pause` if the user wants it to pause itself). The `repo=` label can match existing Vault selectors; it does not select org Secrets. Without Secret selection flags the box keeps the existing Vault behavior. Opt into org Secrets explicitly with `--secrets` or `--env-secrets`; at creation, `--env-secrets` alone also selects all org proxy Secrets. Use `--no-vault --secrets none --env-secrets none` when neither store should deliver credentials.
+Box names are lowercase letters, digits and `-`. The box gets the default size, 4 vCPU / 8 GB (the instabox skill's Sizes lists the others a plan offers). The default template (`agent-browser`, shown as standard in the dashboard) has git, Node.js 22, Python (uv), Go, Rust, a C toolchain, Docker and a desktop with Chromium. This box is meant to stay; it pauses itself after 30 idle minutes. The `repo=` label can match existing Vault selectors; it does not select org Secrets. Without Secret selection flags the box keeps the existing Vault behavior. Opt into org Secrets explicitly with `--secrets` or `--env-secrets`; at creation, `--env-secrets` alone also selects all org proxy Secrets. Use `--no-vault --secrets none --env-secrets none` when neither store should deliver credentials.
 
 ## 3. Copy the repo and its worktrees
 

package/skills/instabox-snapshots/SKILL.md

@@ -68,7 +68,7 @@ Snapshots count toward the account's snapshot and storage limits (`instabox usag
 
 ## Typical agent loop
 
-1. `instabox create --name job --snapshot <base>` (it pauses by itself after 30 idle minutes; add `--timeout 2h --on-timeout kill` for a hard end)
+1. `instabox create --name job --snapshot <base>` (it pauses by itself after 30 idle minutes)
 2. Work with `instabox exec job -- ...`
 3. When the setup is worth keeping: `instabox snapshot save job --name <base>-v2` (no need to stop it)
 4. `instabox rm job` when done.