instabox 0.8.61 → 0.8.63

package/cli/SHA256SUMS

@@ -1,6 +1,6 @@
-a9a8ab04a0bb3ede7d00fe6cca696553fc3ccb4886d94fba2a1701c7acfa1131  instabox-darwin-amd64
-dd40795958ccd6b8472503b436c8fe993c838f48212187e60fb56e38b1398f0b  instabox-darwin-arm64
-a859c61e5a06e0738d7b8d0691ce0a4a73927614e265fd746d717608bd3a1c32  instabox-linux-amd64
-bdd07fabcf7ee90d1745b6fbaae6ef0379ae60b8f4dfc55cf50184a81c828025  instabox-linux-arm64
-b40136fe62d9968dff66950c847e3ed48371ab7c71149420b6a85181cdbd5a7b  instabox-windows-amd64.exe
-16402b27ae3a667fc63f5b09bf7b809873e948801a5fa0b1f6d3a8db6a1a1c4f  instabox-windows-arm64.exe
+aded5fc340f2d1829d973bf1b8cd30025a445d0c722006a0e079c933e6e314e2  instabox-darwin-amd64
+c53d42d6622e535813d3cb89b46008c21fb0ef9771fb5dfae7fa709a7231d626  instabox-darwin-arm64
+ad6f4ef3b0b3338442ecb2a7c4dbee32074521e40065556a89b695872fbb5276  instabox-linux-amd64
+f1450029a4e198dd5a0e031ffd8acfd94fb9e263a2fa8370651588fe3ba19f61  instabox-linux-arm64
+080c350073b336f09e3f0e92491fceeb8bee30cb73d23fc51acd35d46f598bcd  instabox-windows-amd64.exe
+b6d19a962d0c7dc96fda6f5142f7eba1cc72f69867e0cbd0afc8f6d02da8e1c2  instabox-windows-arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instabox",
-  "version": "0.8.61",
+  "version": "0.8.63",
   "description": "A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest",
   "type": "module",
   "bin": {

package/skills/instabox/SKILL.md

@@ -161,7 +161,7 @@ Every `webhooks` subcommand takes `--json` (or `-o json`).
 
 When the user asks to run their CI on instabox, set up `runs-on: instabox-medium` in their repo, end to end. Each job then runs on a fresh Ubuntu 24.04 box (like `ubuntu-latest`) that is deleted when the job ends.
 
-1. Get OWNER/REPO: `gh repo view --json owner,name,visibility --jq '.owner.login+"/"+.name+" "+.visibility'`. Jobs of a public repository are refused; say so and stop if it's public. Then run `instabox ci` (with `--org ORG` for a workspace): if it says GitHub Actions jobs aren't open on this account yet, use the CLI way below instead.
+1. Get OWNER/REPO: `gh repo view --json owner,name,visibility --jq '.owner.login+"/"+.name+" "+.visibility'`. If it's public, tell the user that pull requests from forks will run on their workspace too, on their plan, and that GitHub's **Require approval for all external contributors** (the repository's **Settings** > **Actions** > **General**) makes each one wait for their approval. Then run `instabox ci` (with `--org ORG` for a workspace): if it says GitHub Actions jobs aren't open on this account yet, use the CLI way below instead.
 2. Send the user the App link, https://dashboard.instabox.sh/auth/github-app/install (for a workspace other than their personal one, add `?org=ORG_ID` from `instabox workspace ls`; linking takes an owner or admin of it). Ask them to install the App on OWNER, give it access to REPO and link it to the workspace, and wait until they say it's done. You can't do this step for them.
 3. Change `runs-on:` of the jobs to move to `instabox-medium` (4 vCPU / 8 GiB), or `instabox-small` (2 / 4) or `instabox-large` (8 / 16) where the plan has them (the free plan runs `instabox-medium` only; any other `instabox` label, `instabox` alone included, is refused). Leave the steps alone; the jobs' secrets stay GitHub Actions secrets, as the box gets none of the user's instabox secrets.
 4. Show the user the diff and push only with their OK.