instabox 0.8.53 → 0.8.55

package/cli/SHA256SUMS

@@ -1,6 +1,6 @@
-a53d5b6114315683dd7ce338d007fc1cfcf721938e38700c6bdb19984d97d3aa  instabox-darwin-amd64
-981fcf0048e6d766ff4af3b608521da296dd30f943e3bd76c0f4e2ecc044c34d  instabox-darwin-arm64
-f3afce3fcf6eda5d8f5e7238858a8b330b49fce6336bc063797509daed07adb9  instabox-linux-amd64
-6638adc3c74932aecd2dc86c458254defbc6979a43eb98c398f3b5fef70b258a  instabox-linux-arm64
-e104b37cd863c44cf65e76f109f5cd81f154ae85ed909dcb414a3ae055dc6359  instabox-windows-amd64.exe
-ffab62c0f737880377dc8107b11066f3dc00d56f6dd96137cdf0a09648aeedb0  instabox-windows-arm64.exe
+b88121fcfba9b4a7caaf82bef924b67acae70584a652203154aa66f61657c0e6  instabox-darwin-amd64
+a2948754399a3fee0b49cfbb7ee690e92de7ff2b451abbd36de86c6923ae960d  instabox-darwin-arm64
+e9b3aea871f95e894fdff526273dc614a9dd19a437f5805c80e9014644c0fa5a  instabox-linux-amd64
+09dea9639d0812e6a495845a27d7b6d330f1af0a3a1661357e30645e8df4fe6f  instabox-linux-arm64
+e47734754140a985b5f79af922b55c19dbb3258d7c2d161c88f23d29a6f51387  instabox-windows-amd64.exe
+b14ecf1186c07b60c28b0a458467edaf48ac0707c8594ec903028efef2609b86  instabox-windows-arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instabox",
-  "version": "0.8.53",
+  "version": "0.8.55",
   "description": "A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest",
   "type": "module",
   "bin": {

package/skills/instabox/SKILL.md

@@ -83,7 +83,7 @@ instabox rm --yes work                          # delete the box (without --yes
 - `create` options: `--template T` or `--snapshot S`, `--vcpus N --mem-mib M` (a size of the plan, see Sizes), `--auto-suspend D|0`, `--max-run-minutes N`, `--delete-after D` (delete it D after creation, 1m-24h, whatever its state), `--meta K=V`, `--org O`, `--secrets all|NAME,NAME|none`, `--no-wait`, `--setup-file PATH|-` (`--wait-setup`), `--fail-fast` (when no host has room, fail at once and create nothing instead of failing the create after; with `--snapshot`, instead of creating it stopped).
 - `create --setup-file PATH` (`-`: stdin; at most 64 KB) runs that script in the new box once it is running, in HOME as the box's user (by its `#!` line, else with bash; CRLF line endings become LF), and prints its output; it replaces create + push + exec for provisioning. A failing script makes `create` exit with the script's code and keeps the box: debug it with `instabox exec work -- /tmp/instabox-setup.sh`. With `--json` the sandbox object gets a `setup` object (`exitCode`, `stdout`, `stderr`, `signal`, `timedOut`, `truncated`, `durationMs`). `create` always waits for the script (`--wait-setup` names that; `=false` is refused) and keeps its state in the box's metadata, so `instabox get work --json` shows it later: `metadata.setupStatus` (`pending`, `running`, `succeeded`, `failed`), `setupExitCode` (`124`: timed out) and `setupLog` (the last 512 characters of its stdout then stderr). The script is killed after `--setup-timeout` (default and at most 10m); for longer installs, use `ssh`. A missing, empty or over-64 KB file is refused before any box is created. `run --setup-file` does the same before its command, with its `-e` variables; when the script fails, run's `--json` `exitCode` is the script's. The script stays at `/tmp/instabox-setup.sh` (and in snapshots), so keep credentials out of it.
 - `create --devcontainer [PATH|DIR]` (also `run --devcontainer`) builds a box from a repo's devcontainer.json (default `.devcontainer/devcontainer.json` or `.devcontainer.json` here; JSONC): it pushes the repo into `workspaceFolder` (default `/workspaces/<dir>`), writes `containerEnv`/`remoteEnv` to `/etc/profile.d/instabox-devcontainer.sh` (login shells, nested `bash -l` and `instabox ssh BOX -- cmd` all get it; `PATH` entries appear once), installs `features` via their install.sh (ones the template already has, such as node/python/go/docker-in-docker/github-cli at the default version, are skipped), and runs `onCreateCommand`/`updateContentCommand`/`postCreateCommand`/`postStartCommand` in the workspace. Do not install the Dev Containers CLI in a box for this. `image`/`build`/compose are not booted (boxes are VM templates); the summary (stderr, or `--json`'s `devcontainer`: `applied`, `skipped`, `ports`, `steps`, `status`, `failedStep`) says what was skipped, and `forwardPorts` come with `instabox port-forward`/`port publish` commands. A failed step exits with its code and keeps the box (`metadata.setupStep` names it); `--name` defaults to the config's name. `${devcontainerId}` is the box's name; the summary shows commands as written (a `${localEnv:TOKEN}` is not printed), but the profile file keeps env values (readable by root and the box user's group, and in snapshots). In `run`, write `--devcontainer=PATH` when a command follows without `--`.
-- Idle auto-pause defaults to 30 minutes. Paid boxes allow 5, 10, 15, 20, 25 or 30 minutes (a time between rounds up; below 5m or above 30m is refused, nothing created), or `0` to turn it off. Free boxes keep 30 minutes unless an admin grants an idle override; asking another value on a free box fails (`permission_denied`, nothing created), so leave `--auto-suspend` out there. Idle means no agent working, no terminal use and little CPU.
+- Idle auto-pause defaults to 30 minutes. Paid boxes allow any whole minute from 5 to 30 (a part minute, below 5m or above 30m is refused, nothing created), or `0` to turn it off. Free boxes keep 30 minutes unless an admin grants an idle override; asking another value on a free box fails (`permission_denied`, nothing created), so leave `--auto-suspend` out there. Idle means no agent working, no terminal use and little CPU.
 - Max run minutes is independent of idle activity: `-1` is unlimited, `0` pauses immediately, and a positive integer forces a pause after that many running minutes. Free boxes have a fixed 480-minute cap that only an admin session can change; paid boxes default to `-1` and can change it. An idle override does not permit changes to a free box's runtime cap. The first limit reached pauses the box; both timers restart after sleep and wake.
 - A runtime pause blocks every wake path during a server-configured cooldown, 5 to 20 minutes by default (`409 machine_cooldown` with `Retry-After`). Wait until the `cooldownUntil` deadline shown by `instabox get`; edits cannot clear it. Afterward, an automatically paused box wakes on `exec`, `ssh`, `files`, a public port request or `instabox wake <box>`. A zero runtime cap must be changed before waking. A normal pause preserves memory and processes.
 - `sudo reboot` inside a box reboots it: `instabox get` shows `starting`, then `running` (same disks, processes gone); wait for `running` before the next `exec`. `sudo poweroff` inside stops it until `instabox start`. Boxes from older template versions stop on a reboot too: start them.
@@ -181,6 +181,10 @@ Both ways, their limits and the reasons a job is refused: https://instabox.sh/do
 
 To move the repo the user is working in (with its worktrees, uncommitted work and agent conversations) onto a new box and install its dependencies there, follow the `instabox-move-repo` skill.
 
+## MCP clients
+
+Keep using the CLI and this skill. If the user wants instabox as MCP tools in Claude Code, Cursor or Codex, `instabox mcp init claude|cursor|codex` writes that client's config (the client then runs `instabox mcp start`, which uses this CLI's sign-in or `INSTABOX_API_KEY` and never opens a browser); `--hosted` points it at `https://api.instabox.sh/mcp` with the key read from `INSTABOX_API_KEY`. The user restarts the client afterwards. Details: https://instabox.sh/docs/mcp.md
+
 ## When instabox itself gets in your way (feedback)
 
 If instabox is at fault — a command breaks the contract its help or this skill states, the skill does not match what really happens, a capability is missing, or the CLI is confusing — report it, then carry on with the user's task using a workaround. Never block on the report, and never report problems in the code the user is building.