instabox 0.8.60 → 0.8.62

package/cli/SHA256SUMS

@@ -1,6 +1,6 @@
-30aa1bc7714abb620483b63d5fc48c02f33411597ea96e1c7dd62f2c1b1c69e9  instabox-darwin-amd64
-77315b3fe76124d13777b1c0943665f471ab959631c43f30417b3db4f0c6d621  instabox-darwin-arm64
-b456013413a1e0964f2a9c5149301bf94c0ef53e3006ebf22e2dbb11ef90bc8a  instabox-linux-amd64
-aab8b808490aca1eb0af787e8e952c101ac00dd1eb0ee0faa4256510dfeba4df  instabox-linux-arm64
-285f211a0386d1c222dd407d30156520d32de8e959b97b6e0df1aa2cc7a26244  instabox-windows-amd64.exe
-92ff0e0c94a34ecb7dcd357f7180390ca83d7841874247ab7c208ccd969e9400  instabox-windows-arm64.exe
+24fc2d87984a11940e1d6f38351cd48650f37a43af7126ad5ff419b71c302634  instabox-darwin-amd64
+30f5bd65c393689a8ba10d0bfb2c20ab2bb8b2e6d28c6f13042804eb37d48cc3  instabox-darwin-arm64
+bd0bb1cae26d94fa57baa22234cf4885e0b0370350428b4f410061c7b9c9b736  instabox-linux-amd64
+ab5c22799e1c9643092725d94bf61ad7d1e66c555f11d8175329412032f4db1f  instabox-linux-arm64
+a9ddb3cae366f33915ffa00af093932969802820cd4ddd6e03394912bc7a65bd  instabox-windows-amd64.exe
+085f8c38eb75e33800506d832ef94d268ca92cf2dce9ee657d707f7c9e34caf5  instabox-windows-arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instabox",
-  "version": "0.8.60",
+  "version": "0.8.62",
   "description": "A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest",
   "type": "module",
   "bin": {

package/skills/instabox/SKILL.md

@@ -161,7 +161,7 @@ Every `webhooks` subcommand takes `--json` (or `-o json`).
 
 When the user asks to run their CI on instabox, set up `runs-on: instabox-medium` in their repo, end to end. Each job then runs on a fresh Ubuntu 24.04 box (like `ubuntu-latest`) that is deleted when the job ends.
 
-1. Get OWNER/REPO: `gh repo view --json owner,name,visibility --jq '.owner.login+"/"+.name+" "+.visibility'`. Jobs of a public repository are refused; say so and stop if it's public. Then run `instabox ci` (with `--org ORG` for a workspace): if it says GitHub Actions jobs aren't open on this account yet, use the CLI way below instead.
+1. Get OWNER/REPO: `gh repo view --json owner,name,visibility --jq '.owner.login+"/"+.name+" "+.visibility'`. If it's public, tell the user that pull requests from forks will run on their workspace too, on their plan, and that GitHub's **Require approval for all external contributors** (the repository's **Settings** > **Actions** > **General**) makes each one wait for their approval. Then run `instabox ci` (with `--org ORG` for a workspace): if it says GitHub Actions jobs aren't open on this account yet, use the CLI way below instead.
 2. Send the user the App link, https://dashboard.instabox.sh/auth/github-app/install (for a workspace other than their personal one, add `?org=ORG_ID` from `instabox workspace ls`; linking takes an owner or admin of it). Ask them to install the App on OWNER, give it access to REPO and link it to the workspace, and wait until they say it's done. You can't do this step for them.
 3. Change `runs-on:` of the jobs to move to `instabox-medium` (4 vCPU / 8 GiB), or `instabox-small` (2 / 4) or `instabox-large` (8 / 16) where the plan has them (the free plan runs `instabox-medium` only; any other `instabox` label, `instabox` alone included, is refused). Leave the steps alone; the jobs' secrets stay GitHub Actions secrets, as the box gets none of the user's instabox secrets.
 4. Show the user the diff and push only with their OK.
@@ -207,5 +207,5 @@ instabox feedback --json --type bug --component cli --area exec \
 
 - Forgotten boxes pause themselves after 30 idle minutes. Delete a box with `instabox rm --yes NAME` once its work is done. `rm`, `snapshot rm`, `secrets rm`, `vault rm` and `keys rm` ask y/N first and, off a terminal with no answer, delete nothing and fail, so pass `--yes` (`-y`).
 - When the user asks for a new box, create one, with a name `instabox ls` does not already show. Offer an existing box only when they want to continue earlier work in it.
-- `instabox usage` shows storage use and limits. A quota error means delete or stop something; do not retry the same create in a loop.
+- `instabox usage` shows storage use and limits, this month's cost in USD and the credit balance (`--json`: `.cost.costUSD`, `.cost.creditsUSD`). A quota error means delete or stop something; do not retry the same create in a loop.
 - `no_capacity` (`create` exits 75, with or without `--fail-fast`; `run` exits 75 with `--fail-fast`, otherwise 125; a permanent one that is not `retryable` exits 1) is different: no host has room right now and nothing was kept. It is retryable: retry the same command with backoff (about 15 s, 30 s, 60 s, then every few minutes), or try another size (`--vcpus/--mem-mib`) or template.