instabox 0.8.46 → 0.8.48

package/README.md

@@ -3,6 +3,7 @@
 ```
 npx instabox@latest      # sign in, install the CLI and the agent skills (--no-skills: no skills)
 npx instabox@latest sh   # the same, then start a new box and SSH into it
+npx instabox@latest skills install -y   # only the agent skills: no sign-in, no network
 ```
 
 `npx instabox@latest` signs you in to instabox with a device code (first run only: open the page it prints on any device and enter the code; it opens the page for you where there is a browser, never with `--no-browser`), installs the `instabox` CLI already signed in or updates an out-of-date one (skip with `--no-cli`), installs or updates the agent skills from [`../skills`](../skills) in `~/.claude/skills` and `~/.agents/skills` (skip with `--no-skills`), and prints the next steps. It does not touch your boxes.
@@ -11,6 +12,10 @@ npx instabox@latest sh   # the same, then start a new box and SSH into it
 
 A GitHub and a Google sign-in are separate instabox accounts, each with its own boxes. Both this entry point and `instabox login` let the sign-in page offer both. `--google` asks for Google directly, as does `instabox login --provider google`. An agent with no browser and nobody at the keyboard signs itself up instead with `instabox login --agent` once the CLI is installed (docs/agent-auth.md): it prints a claim page and a code for the account owner, who approves later from any device.
 
+Without a terminal (an agent, CI), nobody can enter a device code, so the sign-in comes from `INSTABOX_API_KEY` (an `ibk_...` key, as the CLI takes it: no browser, no device code, nothing saved), a sign-in already saved, or an agent key from `instabox login --agent`. With none of them it exits at once with status 3 and says how to go on, instead of waiting for a code nobody will enter. `--device-code` asks for the device code anyway, for an agent that relays it to a person. `-y` (`--yes`) asks nothing: no invite-code prompt.
+
+`npx instabox@latest skills install [-y] [--claude|--codex|--cursor|--all]` installs only the agent skills, with no sign-in: Claude Code's in `~/.claude/skills`, Codex's and Cursor's in `~/.agents/skills` (both read it, so one copy serves both). With no agent named it installs for all of them, asking first at a terminal unless `-y`. An unknown flag is a usage error, status 2.
+
 Any other command line is the instabox CLI's ([`cmd/instabox`](../cmd/instabox)): `npx instabox@latest ls` runs `instabox ls`, installing the CLI first if it is missing.
 
 ## How it works

package/bin/instabox.mjs

@@ -10,13 +10,10 @@ import {
   writeFileSync,
   rmSync,
   existsSync,
-  mkdirSync,
-  readdirSync,
 } from 'node:fs';
 import { createInterface } from 'node:readline/promises';
 import { tmpdir, homedir } from 'node:os';
 import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
 import { createClient } from '../lib/api.mjs';
 import { orderBoxes } from '../lib/boxes.mjs';
 import { guestUserNote, localGuestUser } from '../lib/guestuser.mjs';
@@ -38,6 +35,7 @@ import { browserCommand, canOpenBrowser, deviceLogin } from '../lib/login.mjs';
 import { makeDirPrivate, sessionArgs } from '../lib/ssh.mjs';
 import { loadCredentials, saveCredentials } from '../lib/credentials.mjs';
 import { agentName, track } from '../lib/telemetry.mjs';
+import { AGENT_DIRS, describeSkills, installSkills, skillRoots } from '../lib/skills.mjs';
 
 // Same variables, same order as the instabox CLI, so both talk to one server.
 const API = (
@@ -55,6 +53,15 @@ const CERT_MIN = 120;
 const PROVIDER = process.argv.includes('--google') ? 'google' : process.argv.includes('--github') ? 'github' : '';
 // The code is always printed; --no-browser only stops opening the sign-in page.
 const NO_BROWSER = process.argv.includes('--no-browser');
+// -y: never ask a question (the invite code); the sign-in itself still needs a key or a person.
+const YES = process.argv.includes('-y') || process.argv.includes('--yes');
+// --device-code: print the sign-in code and wait even without a terminal (an agent relaying the
+// code to a person). Without it, no terminal and no credentials fail at once instead of waiting.
+const DEVICE_CODE = process.argv.includes('--device-code');
+// An API key (ibk_...) the way the CLI takes it: it wins over a stored sign-in.
+const API_KEY = (process.env.INSTABOX_API_KEY || '').trim();
+// Exit status when there is no credential and nobody to sign in (2 is a usage error).
+const EXIT_NEEDS_SIGN_IN = 3;
 const bold = (s) => (process.stdout.isTTY ? `\x1b[1m${s}\x1b[0m` : s);
 const dim = (s) => (process.stdout.isTTY ? `\x1b[2m${s}\x1b[0m` : s);
 const green = (s) => (process.stdout.isTTY ? `\x1b[32m${s}\x1b[0m` : s);
@@ -77,8 +84,15 @@ function usage() {
       --no-browser                  only print the sign-in page and code; do not open a browser
       --no-cli                      do not install or update the instabox CLI
       --no-skills                   do not install the instabox agent skills
+      -y, --yes                     ask nothing (no invite-code prompt)
+      --device-code                 sign in with a device code even without a terminal
+  npx instabox@latest skills install [--claude|--codex|--cursor|--all] [-y]
+                                    only the agent skills; no sign-in
   npx instabox@latest <command>     run an instabox CLI command (instabox help lists them)
 
+  INSTABOX_API_KEY=ibk_... signs in with that key: no browser, no device code. Without a key
+  or a saved sign-in, and with no terminal, it exits at once (status 3).
+
   INSTABOX_IMAGE=<template> picks the template sh starts from (default agent-browser);
   INSTABOX_IMAGE=snapshot:<name> starts from a snapshot of yours instead.
 
@@ -139,7 +153,7 @@ async function signInWithInvite() {
     });
     if (r.tok) return r.tok;
     const waitlisted = r.code === 'invite_required' || r.code === 'invite_invalid';
-    if (waitlisted) invite = await askInvite(r.code === 'invite_invalid');
+    if (waitlisted && !YES) invite = await askInvite(r.code === 'invite_invalid');
     if (waitlisted && invite) continue;
     if (waitlisted)
       die(
@@ -149,9 +163,13 @@ async function signInWithInvite() {
   }
 }
 
-// The CLI's saved token, a refreshed one, or a device-code sign-in; saved where the CLI reads it.
+// INSTABOX_API_KEY, the CLI's saved token (or an agent's key from `instabox login --agent`), a
+// refreshed one, or a device-code sign-in, saved where the CLI reads it. A key is never saved,
+// refreshed or traded for a sign-in.
 async function signedIn() {
+  if (API_KEY) return { accessToken: API_KEY, apiKey: true };
   const c = loadCredentials(API);
+  if (c?.apiKey) return { accessToken: c.apiKey, apiKey: true };
   if (c?.accessToken && new Date(c.accessExpiresAt) - Date.now() > 60_000) return c;
   if (c?.refreshToken && new Date(c.refreshExpiresAt) > Date.now()) {
     try {
@@ -160,6 +178,16 @@ async function signedIn() {
       return t;
     } catch {}
   }
+  // Nobody can enter a code: say what works, now, instead of waiting for a sign-in that never comes.
+  if (!DEVICE_CODE && !(process.stdin.isTTY && process.stdout.isTTY)) {
+    console.error(`  ${bold('instabox needs a sign-in, and there is no terminal to sign in from.')} Either:
+    1. set INSTABOX_API_KEY=ibk_... (make one in the dashboard under API keys, or with
+       instabox keys create from a signed-in machine) and run this again, or
+    2. run npx instabox@latest in a terminal to sign in with a device code.
+  The agent skills need no sign-in: npx instabox@latest skills install -y
+`);
+    process.exit(EXIT_NEEDS_SIGN_IN);
+  }
   const t = await signInWithInvite();
   freshSignIn = true;
   saveCredentials(API, t);
@@ -290,96 +318,62 @@ async function ensureBundledCli(bundled, found) {
   );
 }
 
-// A skill directory's files, relative to it, sorted.
-function skillFiles(dir, rel = '') {
-  return readdirSync(join(dir, rel), { withFileTypes: true })
-    .sort((a, b) => a.name.localeCompare(b.name))
-    .flatMap((e) => {
-      const r = rel ? `${rel}/${e.name}` : e.name;
-      return e.isDirectory() ? skillFiles(dir, r) : e.isFile() ? [r] : [];
-    });
+// Waits for the CLI install started earlier, installs the skills, and prints a line for each.
+async function reportInstalls(cli) {
+  const cliLine = await cli;
+  if (cliLine) console.log(`  ${green('✓')} ${cliLine}`);
+  if (process.argv.includes('--no-skills')) return;
+  const skillsLine = describeSkills(installSkills(skillRoots([])));
+  if (skillsLine) console.log(`  ${green('✓')} ${skillsLine} ${dim('(~/.claude/skills, ~/.agents/skills)')}`);
 }
 
-// Skills this package used to ship under another name. A copy we installed (marked
-// `installed-by: instabox`) is removed, so the agent does not see both; the user's own is kept.
-const RETIRED_SKILLS = [
-  'instabox-migrate', // now instabox-move-repo
-  'instabox-move-all', // now instabox-basic-setup
-];
+// `skills install`: the agent skills only. No sign-in, no network, nothing else installed.
+const SKILLS_USAGE = `
+  usage: npx instabox@latest skills install [-y] [--claude] [--codex] [--cursor] [--all]
 
-function removeRetiredSkills(roots) {
-  const removed = new Set();
-  for (const root of roots)
-    for (const n of RETIRED_SKILLS) {
-      try {
-        if (!readFileSync(join(root, n, 'SKILL.md'), 'utf8').includes('installed-by: instabox')) continue;
-        rmSync(join(root, n), { recursive: true, force: true });
-        removed.add(n);
-      } catch {}
-    }
-  return [...removed];
-}
+  Copies the instabox agent skills into the folders your coding agents read. No sign-in needed.
+      --claude      Claude Code: ~/.claude/skills
+      --codex       Codex: ~/.agents/skills
+      --cursor      Cursor: ~/.agents/skills (Cursor reads it; the same copy as --codex)
+      --all         all of them (the default when no agent is named)
+      -y, --yes     do not ask; without a terminal it never asks
+`;
 
-// Agent skills shipped in this package (skills/<name>/SKILL.md, with any scripts beside it) into
-// the folders coding agents read. Overwrites only copies we installed earlier (marked
-// `installed-by: instabox`).
-function installSkills() {
-  if (process.argv.includes('--no-skills')) return null;
-  const src = join(dirname(fileURLToPath(import.meta.url)), '..', 'skills');
-  let names;
-  try {
-    names = readdirSync(src).filter((n) => existsSync(join(src, n, 'SKILL.md')));
-  } catch {
-    return null;
+async function skillsCommand(argv) {
+  const [sub, ...rest] = argv;
+  if (sub === undefined || sub === '-h' || sub === '--help' || sub === 'help') {
+    console.log(SKILLS_USAGE);
+    return;
   }
-  const roots = [join(homedir(), '.claude', 'skills'), join(homedir(), '.agents', 'skills')];
-  // A skill counts as updated if any of its copies changed, else installed if one was new.
-  const outcome = new Map();
-  const rank = { unchanged: 0, installed: 1, updated: 2 };
-  const kept = new Set();
-  for (const root of roots) {
-    for (const n of names) {
-      const dest = join(root, n, 'SKILL.md');
-      try {
-        let what = 'installed';
-        if (existsSync(dest)) {
-          const old = readFileSync(dest, 'utf8');
-          if (!old.includes('installed-by: instabox')) {
-            kept.add(n);
-            continue;
-          }
-          what = 'unchanged';
-        }
-        // SKILL.md and whatever else the skill ships (scripts/...).
-        for (const f of skillFiles(join(src, n))) {
-          const body = readFileSync(join(src, n, f));
-          const to = join(root, n, f);
-          if (existsSync(to) && readFileSync(to).equals(body)) continue;
-          if (what === 'unchanged') what = 'updated';
-          mkdirSync(dirname(to), { recursive: true });
-          writeFileSync(to, body);
-        }
-        if (rank[what] > (rank[outcome.get(n)] ?? -1)) outcome.set(n, what);
-      } catch {}
+  if (sub !== 'install') {
+    console.error(`  instabox: unknown command "skills ${sub}"\n${SKILLS_USAGE}`);
+    process.exit(2);
+  }
+  const agents = [];
+  let yes = false;
+  for (const a of rest) {
+    if (a === '-h' || a === '--help') return console.log(SKILLS_USAGE);
+    if (a === '-y' || a === '--yes') yes = true;
+    else if (a === '--all') agents.push(...Object.keys(AGENT_DIRS));
+    else if (a.startsWith('--') && Object.hasOwn(AGENT_DIRS, a.slice(2))) agents.push(a.slice(2));
+    else {
+      console.error(`  instabox: unknown flag ${a} for skills install\n${SKILLS_USAGE}`);
+      process.exit(2);
     }
   }
-  const of = (what) => names.filter((n) => outcome.get(n) === what);
-  const parts = [];
-  if (of('updated').length) parts.push(`updated ${of('updated').join(', ')}`);
-  if (of('installed').length) parts.push(`installed ${of('installed').join(', ')}`);
-  if (of('unchanged').length) parts.push(`${of('unchanged').join(', ')} already up to date`);
-  if (kept.size) parts.push(`kept your own ${[...kept].join(', ')}`);
-  const retired = removeRetiredSkills(roots);
-  if (retired.length) parts.push(`removed the old ${retired.join(', ')}`);
-  return parts.length ? `agent skills: ${parts.join('; ')} ${dim('(~/.claude/skills, ~/.agents/skills)')}` : null;
-}
-
-// Waits for the CLI install started earlier, installs the skills, and prints a line for each.
-async function reportInstalls(cli) {
-  const cliLine = await cli;
-  if (cliLine) console.log(`  ${green('✓')} ${cliLine}`);
-  const skillsLine = installSkills();
-  if (skillsLine) console.log(`  ${green('✓')} ${skillsLine}`);
+  const roots = skillRoots(agents);
+  const shown = roots.map((r) => r.replace(homedir(), '~')).join(', ');
+  // Only a person at a terminal is asked, and only when no agent was named.
+  if (!yes && !agents.length && process.stdin.isTTY && process.stdout.isTTY) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = (await rl.question(`  Install the instabox agent skills into ${shown}? [Y/n] `)).trim();
+    rl.close();
+    if (/^n/i.test(answer)) return;
+  }
+  const r = installSkills(roots);
+  if (!r) die('this package carries no skills (run from a checkout? npm pack copies them in)');
+  console.log(`  ${green('✓')} ${describeSkills(r) ?? 'agent skills: nothing to install'} ${dim(`(${shown})`)}`);
+  if (r.failed.length) process.exit(1);
 }
 
 // The commands to run next, one per line, descriptions lined up.
@@ -395,8 +389,17 @@ async function onboard(wantBox) {
   console.log(`\n  ${bold('instabox')} ${dim('· a cloud box in seconds')}\n`);
 
   const started = Date.now();
-  client.use(await signedIn());
-  const me = await client.call('GET', '/v1/me').catch((e) => die(`instabox did not accept the sign-in: ${e.message}`));
+  const session = await signedIn();
+  client.use(session);
+  const me = await client
+    .call('GET', '/v1/me')
+    .catch((e) =>
+      die(
+        API_KEY
+          ? `instabox did not accept INSTABOX_API_KEY: ${e.message}`
+          : `instabox did not accept the sign-in: ${e.message}`,
+      ),
+    );
   // outcome: ready, or quota_full; never names, paths or messages.
   const report = (outcome, extra = {}) =>
     track(
@@ -420,7 +423,12 @@ async function onboard(wantBox) {
       { server: API },
     );
   console.log(
-    `  ${dim('signed in as')} ${bold(me.name || me.login)}${me.login && me.name ? dim(` (${me.login})`) : ''} ${dim('· not you?')} npx instabox@latest logout`,
+    `  ${dim('signed in as')} ${bold(me.name || me.login)}${me.login && me.name ? dim(` (${me.login})`) : ''} ` +
+      (API_KEY
+        ? dim('with INSTABOX_API_KEY')
+        : session.apiKey
+          ? dim('with an agent key')
+          : `${dim('· not you?')} npx instabox@latest logout`),
   );
 
   const cli = ensureCli();
@@ -512,6 +520,7 @@ async function onboard(wantBox) {
 // this package's own build when it carries one, else the installed CLI, else a fresh install.
 const args = process.argv.slice(2);
 if (args.length === 1 && (args[0] === '-h' || args[0] === '--help')) usage();
+else if (args[0] === 'skills') await skillsCommand(args.slice(1));
 else if (isOnboarding(args)) await onboard(args.includes('sh'));
 else {
   let path = bundledCli() || findCli();

package/cli/SHA256SUMS

@@ -1,6 +1,6 @@
-d5c8ad82b08cd2d83202a61e59290fd30b3bb33b5461b86aebdb407ed542694f  instabox-darwin-amd64
-7ba1e6a219e1cda32916953895d2583a24f9b0ebea4a027c428f290f123786a3  instabox-darwin-arm64
-027b1af8ac556c9a6ef72d9ecfa100e447cf0c3e7fa2cd4ced8c53093005db5d  instabox-linux-amd64
-5848d4b62ad816107be1b46b218d1d227129b55cdf65b662b74e2a5b09b4f61a  instabox-linux-arm64
-1445567ac0abcd19934d50fbbfd8ba3e45c7594b8741b824a41dc143f8f8d370  instabox-windows-amd64.exe
-7c8ef19418468a247452723cfb2a77b6cfa4b4d7cd04683fc354dc869d9bb175  instabox-windows-arm64.exe
+17b97e7017bee2e9b31b0a37e2ed9e1e7323434179097995cf60e212e2aa85c3  instabox-darwin-amd64
+f88e557ed44edcf832ed792e74c65314ab733ba8fd5a8b2b79e373ac003f5482  instabox-darwin-arm64
+74542ca4d5b61f328879b7ac0318281896b4dd4af9bf97c8750e98ee569e41b4  instabox-linux-amd64
+4a62f75a0f5f73e661c160aa2c915040591f2d0e0bfa5eca6d6b93bf8aead2be  instabox-linux-arm64
+b72c212cd353552672d173cad436c23f1ccfb023eed969c34e135dfcf4fe0c07  instabox-windows-amd64.exe
+610f362a6ebae1d894c35388df39f158deb89cfa829c72a1de65bfa9188c5819  instabox-windows-arm64.exe

package/lib/api.mjs

@@ -43,6 +43,8 @@ export function createClient(
 
   // The CLI's newer token if it already refreshed (a reused refresh token ends the session), else one rotation.
   async function renew() {
+    // An API key has nothing to refresh; a 401 is its answer.
+    if (session.apiKey) return false;
     const c = load();
     if (c?.accessToken && c.accessToken !== session.accessToken && new Date(c.accessExpiresAt) - Date.now() > 60_000) {
       session = c;

package/lib/cli.mjs

@@ -19,7 +19,16 @@ import { dirname, join, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { buildName, platformFor } from './platforms.mjs';
 
-const OUR_FLAGS = new Set(['--github', '--google', '--no-browser', '--no-cli', '--no-skills']);
+const OUR_FLAGS = new Set([
+  '--github',
+  '--google',
+  '--no-browser',
+  '--no-cli',
+  '--no-skills',
+  '-y',
+  '--yes',
+  '--device-code',
+]);
 
 // Bare `instabox` or `sh`, with only our flags; anything else is a CLI command.
 export function isOnboarding(args) {

package/lib/skills.mjs

@@ -0,0 +1,120 @@
+// The agent skills this package ships (skills/<name>/SKILL.md, with any scripts beside it), copied
+// into the folders coding agents read. Nothing here signs in or talks to the network.
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const SKILLS_SRC = join(dirname(fileURLToPath(import.meta.url)), '..', 'skills');
+
+// Where each agent reads user-level skills. Claude Code reads ~/.claude/skills. Codex and Cursor
+// both read ~/.agents/skills (the user-level location in their docs), so one copy there serves
+// both; a second copy in ~/.cursor/skills would show Cursor every skill twice.
+export const AGENT_DIRS = {
+  claude: ['.claude', 'skills'],
+  codex: ['.agents', 'skills'],
+  cursor: ['.agents', 'skills'],
+};
+
+// The skill folders for the chosen agents (every agent when none is chosen), each once.
+export function skillRoots(agents, home = homedir()) {
+  const names = agents.length ? agents : Object.keys(AGENT_DIRS);
+  return [...new Set(names.map((a) => join(home, ...AGENT_DIRS[a])))];
+}
+
+// A skill directory's files, relative to it, sorted.
+function skillFiles(dir, rel = '') {
+  return readdirSync(join(dir, rel), { withFileTypes: true })
+    .sort((a, b) => a.name.localeCompare(b.name))
+    .flatMap((e) => {
+      const r = rel ? `${rel}/${e.name}` : e.name;
+      return e.isDirectory() ? skillFiles(dir, r) : e.isFile() ? [r] : [];
+    });
+}
+
+// Skills this package used to ship under another name. A copy we installed (marked
+// `installed-by: instabox`) is removed, so the agent does not see both; the user's own is kept.
+const RETIRED_SKILLS = [
+  'instabox-migrate', // now instabox-move-repo
+  'instabox-move-all', // now instabox-basic-setup
+];
+
+function removeRetiredSkills(roots) {
+  const removed = new Set();
+  for (const root of roots)
+    for (const n of RETIRED_SKILLS) {
+      try {
+        if (!readFileSync(join(root, n, 'SKILL.md'), 'utf8').includes('installed-by: instabox')) continue;
+        rmSync(join(root, n), { recursive: true, force: true });
+        removed.add(n);
+      } catch {}
+    }
+  return [...removed];
+}
+
+// Copies the skills into each root, overwriting only copies we installed earlier (marked
+// `installed-by: instabox`). Returns null when this package carries no skills, else the skill
+// names by outcome: { installed, updated, unchanged, kept, removed, failed }.
+export function installSkills(roots, src = SKILLS_SRC) {
+  let names;
+  try {
+    names = readdirSync(src).filter((n) => existsSync(join(src, n, 'SKILL.md')));
+  } catch {
+    return null;
+  }
+  // A skill counts as updated if any of its copies changed, else installed if one was new.
+  const outcome = new Map();
+  const rank = { unchanged: 0, installed: 1, updated: 2 };
+  const kept = new Set();
+  const failed = new Set();
+  for (const root of roots) {
+    for (const n of names) {
+      const dest = join(root, n, 'SKILL.md');
+      try {
+        let what = 'installed';
+        if (existsSync(dest)) {
+          const old = readFileSync(dest, 'utf8');
+          if (!old.includes('installed-by: instabox')) {
+            kept.add(n);
+            continue;
+          }
+          what = 'unchanged';
+        }
+        // SKILL.md and whatever else the skill ships (scripts/...).
+        for (const f of skillFiles(join(src, n))) {
+          const body = readFileSync(join(src, n, f));
+          const to = join(root, n, f);
+          if (existsSync(to) && readFileSync(to).equals(body)) continue;
+          if (what === 'unchanged') what = 'updated';
+          mkdirSync(dirname(to), { recursive: true });
+          writeFileSync(to, body);
+        }
+        if (rank[what] > (rank[outcome.get(n)] ?? -1)) outcome.set(n, what);
+      } catch {
+        failed.add(n);
+      }
+    }
+  }
+  const of = (what) => names.filter((n) => outcome.get(n) === what && !failed.has(n));
+  return {
+    installed: of('installed'),
+    updated: of('updated'),
+    unchanged: of('unchanged'),
+    kept: [...kept],
+    removed: removeRetiredSkills(roots),
+    failed: [...failed],
+  };
+}
+
+// What installSkills did, as one line, or null when there is nothing to say.
+export function describeSkills(r) {
+  if (!r) return null;
+  const parts = [];
+  if (r.updated.length) parts.push(`updated ${r.updated.join(', ')}`);
+  if (r.installed.length) parts.push(`installed ${r.installed.join(', ')}`);
+  if (r.unchanged.length) parts.push(`${r.unchanged.join(', ')} already up to date`);
+  if (r.kept.length) parts.push(`kept your own ${r.kept.join(', ')}`);
+  if (r.removed.length) parts.push(`removed the old ${r.removed.join(', ')}`);
+  if (r.failed.length) parts.push(`could not write ${r.failed.join(', ')}`);
+  return parts.length ? `agent skills: ${parts.join('; ')}` : null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instabox",
-  "version": "0.8.46",
+  "version": "0.8.48",
   "description": "A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest",
   "type": "module",
   "bin": {

package/skills/instabox/SKILL.md

@@ -16,11 +16,11 @@ instabox whoami              # who is signed in (fails if nobody)
 instabox login               # device code: open the printed page, enter the code
 ```
 
-A GitHub sign-in and a Google sign-in with the same verified email share one account; with different emails they are separate accounts with separate boxes. Both `instabox login` and `npx instabox@latest` sign in with a device code: they print a page and a code (and open the page when there is a browser); the user opens it on any device, enters the code and chooses GitHub or Google there. It works the same over SSH or on a machine without a browser. Relay the page and the code to the user and wait; the command finishes on its own. For Google directly, use `instabox login --provider google`, or `npx instabox@latest --google`. The CLI shares the sign-in `npx` made.
+A GitHub sign-in and a Google sign-in with the same verified email share one account; with different emails they are separate accounts with separate boxes. Both `instabox login` and `npx instabox@latest` sign in with a device code: they print a page and a code (and open the page when there is a browser); the user opens it on any device, enters the code and chooses GitHub or Google there. It works the same over SSH or on a machine without a browser. Relay the page and the code to the user and wait; the command finishes on its own. Without a terminal, `npx instabox@latest` does not wait for a code: it uses `INSTABOX_API_KEY` when set (no browser, no code), else exits at once with status 3; add `--device-code` to get the page and code to relay. For Google directly, use `instabox login --provider google`, or `npx instabox@latest --google`. The CLI shares the sign-in `npx` made.
 
 `instabox update` replaces the CLI with the server's current build (it prints "already up to date" when it is); run it when a command the docs describe is missing, or when a command ends with `instabox X is outdated (latest Y): run instabox update` on stderr (a daily check; `instabox version --json` has `outdated`/`latest`; `INSTABOX_NO_UPDATE_CHECK=1` silences it). `instabox completion bash|zsh|fish|powershell` prints a shell completion script for the user's shell startup file.
 
-For CI or an agent without a browser, use an API key instead: `export INSTABOX_API_KEY=ibk_...` (the user creates it in the dashboard: API keys in the sidebar). Never print, commit or log a key.
+For CI or an agent without a browser, use an API key instead: `export INSTABOX_API_KEY=ibk_...` (the user creates it in the dashboard: API keys in the sidebar). Never print, commit or log a key. Installing or updating these skills needs no sign-in: `npx instabox@latest skills install -y` (`--claude` for `~/.claude/skills`, `--codex` or `--cursor` for `~/.agents/skills`; none named: all).
 
 With no key and nobody at the keyboard, sign up by yourself: `instabox login --agent` (optionally `--name 'what this agent is' --scope machines:read,machines:write --expires-in-days 30`). It prints a claim page (`https://dashboard.instabox.sh/dashboard/claim?code=XXXX-XXXX`) and the code; relay both to the user and wait. The user opens the page on any device, signs in or signs up, checks what you ask for and approves; the command then finishes on its own, stores the API key made for you in the user's account, and every later `instabox` command uses it. The code works for 24 hours. If you must do other work meanwhile, `instabox login --agent --no-wait` prints the page and code and exits, and `instabox login --agent` later resumes the same registration. Before the user approves you have no account and no credential: do not retry other commands, wait. A denial or an expired code is an error; register again only if the user asks. The user can also approve from their own terminal with `instabox claim XXXX-XXXX`.