instabox 0.8.61 → 0.8.62

package/cli/SHA256SUMS

@@ -1,6 +1,6 @@
-a9a8ab04a0bb3ede7d00fe6cca696553fc3ccb4886d94fba2a1701c7acfa1131  instabox-darwin-amd64
-dd40795958ccd6b8472503b436c8fe993c838f48212187e60fb56e38b1398f0b  instabox-darwin-arm64
-a859c61e5a06e0738d7b8d0691ce0a4a73927614e265fd746d717608bd3a1c32  instabox-linux-amd64
-bdd07fabcf7ee90d1745b6fbaae6ef0379ae60b8f4dfc55cf50184a81c828025  instabox-linux-arm64
-b40136fe62d9968dff66950c847e3ed48371ab7c71149420b6a85181cdbd5a7b  instabox-windows-amd64.exe
-16402b27ae3a667fc63f5b09bf7b809873e948801a5fa0b1f6d3a8db6a1a1c4f  instabox-windows-arm64.exe
+24fc2d87984a11940e1d6f38351cd48650f37a43af7126ad5ff419b71c302634  instabox-darwin-amd64
+30f5bd65c393689a8ba10d0bfb2c20ab2bb8b2e6d28c6f13042804eb37d48cc3  instabox-darwin-arm64
+bd0bb1cae26d94fa57baa22234cf4885e0b0370350428b4f410061c7b9c9b736  instabox-linux-amd64
+ab5c22799e1c9643092725d94bf61ad7d1e66c555f11d8175329412032f4db1f  instabox-linux-arm64
+a9ddb3cae366f33915ffa00af093932969802820cd4ddd6e03394912bc7a65bd  instabox-windows-amd64.exe
+085f8c38eb75e33800506d832ef94d268ca92cf2dce9ee657d707f7c9e34caf5  instabox-windows-arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instabox",
-  "version": "0.8.61",
+  "version": "0.8.62",
   "description": "A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest",
   "type": "module",
   "bin": {

package/skills/instabox/SKILL.md

@@ -161,7 +161,7 @@ Every `webhooks` subcommand takes `--json` (or `-o json`).
 
 When the user asks to run their CI on instabox, set up `runs-on: instabox-medium` in their repo, end to end. Each job then runs on a fresh Ubuntu 24.04 box (like `ubuntu-latest`) that is deleted when the job ends.
 
-1. Get OWNER/REPO: `gh repo view --json owner,name,visibility --jq '.owner.login+"/"+.name+" "+.visibility'`. Jobs of a public repository are refused; say so and stop if it's public. Then run `instabox ci` (with `--org ORG` for a workspace): if it says GitHub Actions jobs aren't open on this account yet, use the CLI way below instead.
+1. Get OWNER/REPO: `gh repo view --json owner,name,visibility --jq '.owner.login+"/"+.name+" "+.visibility'`. If it's public, tell the user that pull requests from forks will run on their workspace too, on their plan, and that GitHub's **Require approval for all external contributors** (the repository's **Settings** > **Actions** > **General**) makes each one wait for their approval. Then run `instabox ci` (with `--org ORG` for a workspace): if it says GitHub Actions jobs aren't open on this account yet, use the CLI way below instead.
 2. Send the user the App link, https://dashboard.instabox.sh/auth/github-app/install (for a workspace other than their personal one, add `?org=ORG_ID` from `instabox workspace ls`; linking takes an owner or admin of it). Ask them to install the App on OWNER, give it access to REPO and link it to the workspace, and wait until they say it's done. You can't do this step for them.
 3. Change `runs-on:` of the jobs to move to `instabox-medium` (4 vCPU / 8 GiB), or `instabox-small` (2 / 4) or `instabox-large` (8 / 16) where the plan has them (the free plan runs `instabox-medium` only; any other `instabox` label, `instabox` alone included, is refused). Leave the steps alone; the jobs' secrets stay GitHub Actions secrets, as the box gets none of the user's instabox secrets.
 4. Show the user the diff and push only with their OK.