@boxes-dev/dvb 0.2.28 → 0.2.29

package/dist/bin/dvb.cjs

@@ -33,14 +33,39 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// ../core/src/profile.ts
+var DEVBOX_PROFILE_ENV, RESERVED_PROFILES, sanitizeProfile, normalizeDevboxProfile, resolveDevboxProfile;
+var init_profile = __esm({
+  "../core/src/profile.ts"() {
+    "use strict";
+    DEVBOX_PROFILE_ENV = "DEVBOX_PROFILE";
+    RESERVED_PROFILES = /* @__PURE__ */ new Set(["default", "prod", "production"]);
+    sanitizeProfile = (value) => {
+      const lower = value.toLowerCase();
+      const replaced = lower.replace(/[^a-z0-9_-]+/g, "-");
+      return replaced.replace(/^-+/, "").replace(/-+$/, "");
+    };
+    normalizeDevboxProfile = (value) => {
+      const trimmed = value?.trim() ?? "";
+      if (!trimmed) return null;
+      const normalized = sanitizeProfile(trimmed);
+      if (!normalized) return null;
+      if (RESERVED_PROFILES.has(normalized)) return null;
+      return normalized;
+    };
+    resolveDevboxProfile = (env2 = process.env) => normalizeDevboxProfile(env2[DEVBOX_PROFILE_ENV]);
+  }
+});
+
 // ../core/src/config.ts
-var import_promises, import_node_os, import_node_path, DEFAULT_SPRITES_API_URL, resolveEmbeddedSpritesApiUrl, resolveSpritesApiUrl, resolveDevboxDir, resolveConfigPath, ensureDevboxDir, writeJsonAtomic, loadConfig, saveConfig;
+var import_promises, import_node_os, import_node_path, DEFAULT_SPRITES_API_URL, resolveEmbeddedSpritesApiUrl, resolveSpritesApiUrl, resolveDevboxDir, resolveDevboxProjectsDir, resolveDevboxProjectDir, resolveConfigPath, ensureDevboxDir, writeJsonAtomic, loadConfig, saveConfig;
 var init_config = __esm({
   "../core/src/config.ts"() {
     "use strict";
     import_promises = __toESM(require("node:fs/promises"), 1);
     import_node_os = __toESM(require("node:os"), 1);
     import_node_path = __toESM(require("node:path"), 1);
+    init_profile();
     DEFAULT_SPRITES_API_URL = "https://api.sprites.dev";
     resolveEmbeddedSpritesApiUrl = () => {
       if (true) {
@@ -50,7 +75,13 @@ var init_config = __esm({
       return trimmed.length > 0 ? trimmed : null;
     };
     resolveSpritesApiUrl = (config) => config?.spritesApiUrl ?? resolveEmbeddedSpritesApiUrl() ?? DEFAULT_SPRITES_API_URL;
-    resolveDevboxDir = (homeDir = import_node_os.default.homedir()) => import_node_path.default.join(homeDir, ".devbox");
+    resolveDevboxDir = (homeDir = import_node_os.default.homedir()) => (() => {
+      const profile = resolveDevboxProfile();
+      const base = import_node_path.default.join(homeDir, ".devbox");
+      return profile ? import_node_path.default.join(homeDir, `.devbox-${profile}`) : base;
+    })();
+    resolveDevboxProjectsDir = (homeDir = import_node_os.default.homedir()) => import_node_path.default.join(resolveDevboxDir(homeDir), "projects");
+    resolveDevboxProjectDir = (projectId, homeDir = import_node_os.default.homedir()) => import_node_path.default.join(resolveDevboxProjectsDir(homeDir), projectId);
     resolveConfigPath = (homeDir) => import_node_path.default.join(resolveDevboxDir(homeDir), "config.json");
     ensureDevboxDir = async (homeDir) => {
       const dir = resolveDevboxDir(homeDir);
@@ -150,6 +181,7 @@ var init_paths = __esm({
   "../core/src/paths.ts"() {
     "use strict";
     import_node_path2 = __toESM(require("node:path"), 1);
+    init_profile();
     DEVBOX_SOCKET_ENV = "DEVBOX_SOCKET_PATH";
     getUid = () => {
       if (typeof process.getuid === "function") return process.getuid();
@@ -164,15 +196,17 @@ var init_paths = __esm({
           source: "env"
         };
       }
+      const profile = resolveDevboxProfile(env2);
       if (platform === "linux" && env2.XDG_RUNTIME_DIR) {
+        const runtimeDir2 = profile ? import_node_path2.default.join(env2.XDG_RUNTIME_DIR, `devbox-${profile}`) : env2.XDG_RUNTIME_DIR;
         return {
-          socketPath: import_node_path2.default.join(env2.XDG_RUNTIME_DIR, "devboxd.sock"),
-          runtimeDir: env2.XDG_RUNTIME_DIR,
+          socketPath: import_node_path2.default.join(runtimeDir2, "devboxd.sock"),
+          runtimeDir: runtimeDir2,
           source: "xdg"
         };
       }
       const uid = getUid();
-      const runtimeDir = `/tmp/devbox-${uid}`;
+      const runtimeDir = profile ? `/tmp/devbox-${uid}-${profile}` : `/tmp/devbox-${uid}`;
       return {
         socketPath: import_node_path2.default.join(runtimeDir, "devboxd.sock"),
         runtimeDir,
@@ -183,17 +217,16 @@ var init_paths = __esm({
 });
 
 // ../core/src/secrets.ts
-var import_promises2, import_node_os2, import_node_path3, resolveDevboxDir2, resolveSecretsPath, ensureDevboxDir2, readFileSecrets, writeFileSecrets, FileSecretStore, createSecretStore;
+var import_promises2, import_node_path3, resolveSecretsPath, ensureDevboxDir2, readFileSecrets, writeFileSecrets, FileSecretStore, createSecretStore;
 var init_secrets = __esm({
   "../core/src/secrets.ts"() {
     "use strict";
     import_promises2 = __toESM(require("node:fs/promises"), 1);
-    import_node_os2 = __toESM(require("node:os"), 1);
     import_node_path3 = __toESM(require("node:path"), 1);
-    resolveDevboxDir2 = (homeDir = import_node_os2.default.homedir()) => import_node_path3.default.join(homeDir, ".devbox");
-    resolveSecretsPath = (homeDir) => import_node_path3.default.join(resolveDevboxDir2(homeDir), "secrets.json");
+    init_config();
+    resolveSecretsPath = (homeDir) => import_node_path3.default.join(resolveDevboxDir(homeDir), "secrets.json");
     ensureDevboxDir2 = async (homeDir) => {
-      const dir = resolveDevboxDir2(homeDir);
+      const dir = resolveDevboxDir(homeDir);
       await import_promises2.default.mkdir(dir, { recursive: true, mode: 448 });
       try {
         await import_promises2.default.chmod(dir, 448);
@@ -313,15 +346,14 @@ var init_secrets = __esm({
 });
 
 // ../core/src/registry.ts
-var import_promises3, import_node_os3, import_node_path4, resolveDevboxDir3, resolveRegistryPath, createEmptyRegistry, loadRegistry, resolveAlias;
+var import_promises3, import_node_path4, resolveRegistryPath, createEmptyRegistry, loadRegistry, resolveAlias;
 var init_registry = __esm({
   "../core/src/registry.ts"() {
     "use strict";
     import_promises3 = __toESM(require("node:fs/promises"), 1);
-    import_node_os3 = __toESM(require("node:os"), 1);
     import_node_path4 = __toESM(require("node:path"), 1);
-    resolveDevboxDir3 = (homeDir = import_node_os3.default.homedir()) => import_node_path4.default.join(homeDir, ".devbox");
-    resolveRegistryPath = (homeDir) => import_node_path4.default.join(resolveDevboxDir3(homeDir), "registry.json");
+    init_config();
+    resolveRegistryPath = (homeDir) => import_node_path4.default.join(resolveDevboxDir(homeDir), "registry.json");
     createEmptyRegistry = () => ({
       version: 1,
       aliases: {},
@@ -345,11 +377,10 @@ var init_registry = __esm({
 });
 
 // ../core/src/repo.ts
-var import_node_crypto, stripGitSuffix, normalizeGitRemoteUrl, hashString, fingerprintFromOrigin, fingerprintFromRootCommit;
+var stripGitSuffix, normalizeGitRemoteUrl;
 var init_repo = __esm({
   "../core/src/repo.ts"() {
     "use strict";
-    import_node_crypto = require("node:crypto");
     stripGitSuffix = (value) => {
       let trimmed = value.trim();
       if (trimmed.endsWith(".git")) {
@@ -373,11 +404,11 @@ var init_repo = __esm({
       try {
         const url = new URL(trimmed);
         const host = url.hostname.toLowerCase();
-        const path24 = stripGitSuffix(url.pathname);
-        if (!host || !path24) {
+        const path25 = stripGitSuffix(url.pathname);
+        if (!host || !path25) {
           throw new Error(`Unrecognized git URL: ${input}`);
         }
-        return `${host}/${path24}`;
+        return `${host}/${path25}`;
       } catch {
       }
       if (trimmed.includes(":")) {
@@ -388,18 +419,15 @@ var init_repo = __esm({
       }
       return stripGitSuffix(trimmed);
     };
-    hashString = (value) => (0, import_node_crypto.createHash)("sha256").update(value).digest("hex");
-    fingerprintFromOrigin = (originUrl) => hashString(normalizeGitRemoteUrl(originUrl));
-    fingerprintFromRootCommit = (rootCommit, salt) => hashString(`${rootCommit}:${salt}`);
   }
 });
 
 // ../core/src/sprites.ts
-var import_node_crypto2, import_node_util, import_ws, SpritesApiError, logger, USE_INTERNAL_SERVICE_API, INTERNAL_SERVICE_SIGNAL_TIMEOUT_SECONDS, toWebSocketErrorInfo, toWsUrl, shellQuote, requestJson, listSprites, requestNdjson, writeFile, normalizeServiceRecord, readFile, openExecSocket, attachExecSocket, openProxySocket, listExecSessions, listServices, internalServicesRequest, createCheckpointInternal, listServicesInternal, getServiceInternal, createServiceInternal, startServiceInternal, stopServiceInternal, execCommand, createSpritesClient;
+var import_node_crypto, import_node_util, import_ws, SpritesApiError, logger, USE_INTERNAL_SERVICE_API, INTERNAL_SERVICE_SIGNAL_TIMEOUT_SECONDS, toWebSocketErrorInfo, toWsUrl, shellQuote, requestJson, listSprites, requestNdjson, writeFile, normalizeServiceRecord, readFile, openExecSocket, attachExecSocket, openProxySocket, listExecSessions, listServices, internalServicesRequest, createCheckpointInternal, listServicesInternal, getServiceInternal, createServiceInternal, startServiceInternal, stopServiceInternal, execCommand, createSpritesClient;
 var init_sprites = __esm({
   "../core/src/sprites.ts"() {
     "use strict";
-    import_node_crypto2 = require("node:crypto");
+    import_node_crypto = require("node:crypto");
     import_node_util = require("node:util");
     import_ws = __toESM(require("ws"), 1);
     init_logger();
@@ -408,11 +436,11 @@ var init_sprites = __esm({
       method;
       path;
       body;
-      constructor(status, method, path24, body) {
-        super(`Sprites API error ${status} ${method} ${path24}: ${body}`);
+      constructor(status, method, path25, body) {
+        super(`Sprites API error ${status} ${method} ${path25}: ${body}`);
         this.status = status;
         this.method = method;
-        this.path = path24;
+        this.path = path25;
         this.body = body;
       }
     };
@@ -457,15 +485,15 @@ var init_sprites = __esm({
       }
       return { message: String(event) };
     };
-    toWsUrl = (apiBaseUrl, path24) => {
+    toWsUrl = (apiBaseUrl, path25) => {
       const base = new URL(apiBaseUrl);
       const protocol = base.protocol === "https:" ? "wss:" : "ws:";
-      return new URL(path24, `${protocol}//${base.host}`);
+      return new URL(path25, `${protocol}//${base.host}`);
     };
     shellQuote = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
-    requestJson = async (apiBaseUrl, token, method, path24, body) => {
-      const requestId = (0, import_node_crypto2.randomUUID)();
-      const url = new URL(path24, apiBaseUrl);
+    requestJson = async (apiBaseUrl, token, method, path25, body) => {
+      const requestId = (0, import_node_crypto.randomUUID)();
+      const url = new URL(path25, apiBaseUrl);
       const headers = {
         authorization: `Bearer ${token}`,
         "x-request-id": requestId
@@ -477,18 +505,18 @@ var init_sprites = __esm({
       if (body) {
         init.body = JSON.stringify(body);
       }
-      logger.info("sprites_request", { requestId, method, path: path24 });
+      logger.info("sprites_request", { requestId, method, path: path25 });
       const response = await fetch(url, init);
       const text = await response.text();
       logger.info("sprites_response", {
         requestId,
         method,
-        path: path24,
+        path: path25,
         status: response.status
       });
       if (!response.ok) {
         const snippet = text.trim().slice(0, 200);
-        throw new SpritesApiError(response.status, method, path24, snippet);
+        throw new SpritesApiError(response.status, method, path25, snippet);
       }
       if (!text) return null;
       try {
@@ -508,8 +536,8 @@ var init_sprites = __esm({
       if (options?.prefix) {
         params.set("prefix", options.prefix);
       }
-      const path24 = `/v1/sprites${params.size ? `?${params.toString()}` : ""}`;
-      const payload = await requestJson(apiBaseUrl, token, "GET", path24);
+      const path25 = `/v1/sprites${params.size ? `?${params.toString()}` : ""}`;
+      const payload = await requestJson(apiBaseUrl, token, "GET", path25);
       const record = payload && typeof payload === "object" ? payload : null;
       const rawSprites = Array.isArray(record?.sprites) ? record?.sprites : Array.isArray(payload) ? payload : [];
       const sprites = rawSprites.filter(
@@ -535,9 +563,9 @@ var init_sprites = __esm({
       }
       return response;
     };
-    requestNdjson = async (apiBaseUrl, token, method, path24, body) => {
-      const requestId = (0, import_node_crypto2.randomUUID)();
-      const url = new URL(path24, apiBaseUrl);
+    requestNdjson = async (apiBaseUrl, token, method, path25, body) => {
+      const requestId = (0, import_node_crypto.randomUUID)();
+      const url = new URL(path25, apiBaseUrl);
       const headers = {
         authorization: `Bearer ${token}`,
         "x-request-id": requestId
@@ -549,18 +577,18 @@ var init_sprites = __esm({
       if (body) {
         init.body = JSON.stringify(body);
       }
-      logger.info("sprites_request", { requestId, method, path: path24 });
+      logger.info("sprites_request", { requestId, method, path: path25 });
       const response = await fetch(url, init);
       logger.info("sprites_response", {
         requestId,
         method,
-        path: path24,
+        path: path25,
         status: response.status
       });
       const text = await response.text();
       if (!response.ok) {
         const snippet = text.trim().slice(0, 200);
-        throw new SpritesApiError(response.status, method, path24, snippet);
+        throw new SpritesApiError(response.status, method, path25, snippet);
       }
       const lines = text.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0);
       const events = [];
@@ -589,14 +617,14 @@ var init_sprites = __esm({
       return events;
     };
     writeFile = async (apiBaseUrl, token, name, remotePath, data) => {
-      const requestId = (0, import_node_crypto2.randomUUID)();
-      const path24 = `/v1/sprites/${name}/fs/write`;
-      const url = new URL(path24, apiBaseUrl);
+      const requestId = (0, import_node_crypto.randomUUID)();
+      const path25 = `/v1/sprites/${name}/fs/write`;
+      const url = new URL(path25, apiBaseUrl);
       url.searchParams.set("path", remotePath);
       url.searchParams.set("mkdir", "true");
       logger.info("sprites_fs_write", {
         requestId,
-        path: path24,
+        path: path25,
         name,
         remotePath,
         size: data.length
@@ -612,7 +640,7 @@ var init_sprites = __esm({
       });
       logger.info("sprites_fs_write_response", {
         requestId,
-        path: path24,
+        path: path25,
         status: response.status
       });
       if (!response.ok) {
@@ -648,16 +676,16 @@ var init_sprites = __esm({
       return service;
     };
     readFile = async (apiBaseUrl, token, name, options) => {
-      const requestId = (0, import_node_crypto2.randomUUID)();
-      const path24 = `/v1/sprites/${name}/fs/read`;
-      const url = new URL(path24, apiBaseUrl);
+      const requestId = (0, import_node_crypto.randomUUID)();
+      const path25 = `/v1/sprites/${name}/fs/read`;
+      const url = new URL(path25, apiBaseUrl);
       url.searchParams.set("path", options.path);
       if (options.workingDir) {
         url.searchParams.set("workingDir", options.workingDir);
       }
       logger.info("sprites_fs_read", {
         requestId,
-        path: path24,
+        path: path25,
         name,
         remotePath: options.path,
         workingDir: options.workingDir
@@ -671,12 +699,12 @@ var init_sprites = __esm({
       });
       logger.info("sprites_fs_read_response", {
         requestId,
-        path: path24,
+        path: path25,
         status: response.status
       });
       if (!response.ok) {
         const snippet = (await response.text()).trim().slice(0, 200);
-        throw new SpritesApiError(response.status, "GET", path24, snippet);
+        throw new SpritesApiError(response.status, "GET", path25, snippet);
       }
       const buffer = await response.arrayBuffer();
       return new Uint8Array(buffer);
@@ -759,7 +787,7 @@ var init_sprites = __esm({
       return services;
     };
     internalServicesRequest = async (apiBaseUrl, token, name, command) => {
-      const requestId = (0, import_node_crypto2.randomUUID)();
+      const requestId = (0, import_node_crypto.randomUUID)();
       const result = await execCommand(
         apiBaseUrl,
         token,
@@ -904,8 +932,8 @@ var init_sprites = __esm({
       return [];
     };
     execCommand = async (apiBaseUrl, token, name, cmd, requestId) => {
-      const path24 = `/v1/sprites/${name}/exec`;
-      const url = toWsUrl(apiBaseUrl, path24);
+      const path25 = `/v1/sprites/${name}/exec`;
+      const url = toWsUrl(apiBaseUrl, path25);
       cmd.forEach((part) => url.searchParams.append("cmd", part));
       url.searchParams.set("tty", "false");
       url.searchParams.set("stdin", "false");
@@ -938,7 +966,7 @@ var init_sprites = __esm({
             const status = response.statusCode ?? 0;
             logger.warn("sprites_exec_unexpected_response", {
               requestId,
-              path: path24,
+              path: path25,
               status,
               headers: response.headers,
               bodySnippet: snippet ? snippet.slice(0, 800) : void 0
@@ -952,7 +980,7 @@ var init_sprites = __esm({
         const finish = (code2) => {
           if (resolved) return;
           resolved = true;
-          logger.info("sprites_exec_response", { requestId, path: path24, status: code2 });
+          logger.info("sprites_exec_response", { requestId, path: path25, status: code2 });
           resolve({
             exitCode: code2,
             stdout: Buffer.concat(stdout).toString("utf8"),
@@ -1002,7 +1030,7 @@ var init_sprites = __esm({
           const errorMessage = errorInfo.details && errorInfo.details !== errorInfo.message ? `${errorInfo.message} (${errorInfo.details})` : errorInfo.message;
           logger.warn("sprites_exec_error", {
             requestId,
-            path: path24,
+            path: path25,
             errorMessage,
             errorName: errorInfo.name,
             errorCode: errorInfo.code,
@@ -1064,7 +1092,7 @@ var init_sprites = __esm({
       },
       readFile: async (name, options) => readFile(apiBaseUrl, token, name, options),
       exec: async (name, cmd) => {
-        const requestId = (0, import_node_crypto2.randomUUID)();
+        const requestId = (0, import_node_crypto.randomUUID)();
         logger.info("sprites_exec", {
           requestId,
           name,
@@ -1457,6 +1485,7 @@ var init_strings = __esm({
 // ../core/src/index.ts
 var init_src = __esm({
   "../core/src/index.ts"() {
+    init_profile();
     init_config();
     init_logger();
     init_paths();
@@ -1633,12 +1662,12 @@ function validateDeploymentUrl(deploymentUrl) {
   }
 }
 function isSimpleObject(value) {
-  const isObject3 = typeof value === "object";
+  const isObject5 = typeof value === "object";
   const prototype = Object.getPrototypeOf(value);
   const isSimple = prototype === null || prototype === Object.prototype || // Objects generated from other contexts (e.g. across Node.js `vm` modules) will not satisfy the previous
   // conditions but are still simple objects.
   prototype?.constructor?.name === "Object";
-  return isObject3 && isSimple;
+  return isObject5 && isSimple;
 }
 var init_common = __esm({
   "../../node_modules/convex/dist/esm/common/index.js"() {
@@ -3306,12 +3335,12 @@ function createApi(pathParts = []) {
             `API path is expected to be of the form \`api.moduleName.functionName\`. Found: \`${found}\``
           );
         }
-        const path24 = pathParts.slice(0, -1).join("/");
+        const path25 = pathParts.slice(0, -1).join("/");
         const exportName = pathParts[pathParts.length - 1];
         if (exportName === "default") {
-          return path24;
+          return path25;
         } else {
-          return path24 + ":" + exportName;
+          return path25 + ":" + exportName;
         }
       } else if (prop === Symbol.toStringTag) {
         return "FunctionReference";
@@ -6520,16 +6549,16 @@ var init_simple_client_node = __esm({
     });
     require_node_gyp_build = __commonJS2({
       "../common/temp/node_modules/.pnpm/node-gyp-build@4.8.4/node_modules/node-gyp-build/node-gyp-build.js"(exports2, module2) {
-        var fs23 = __require("fs");
-        var path24 = __require("path");
-        var os12 = __require("os");
+        var fs25 = __require("fs");
+        var path25 = __require("path");
+        var os11 = __require("os");
         var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
         var vars = process.config && process.config.variables || {};
         var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
         var abi = process.versions.modules;
         var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-        var arch = process.env.npm_config_arch || os12.arch();
-        var platform = process.env.npm_config_platform || os12.platform();
+        var arch = process.env.npm_config_arch || os11.arch();
+        var platform = process.env.npm_config_platform || os11.platform();
         var libc = process.env.LIBC || (isAlpine(platform) ? "musl" : "glibc");
         var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
         var uv = (process.versions.uv || "").split(".")[0];
@@ -6538,21 +6567,21 @@ var init_simple_client_node = __esm({
           return runtimeRequire(load2.resolve(dir));
         }
         load2.resolve = load2.path = function(dir) {
-          dir = path24.resolve(dir || ".");
+          dir = path25.resolve(dir || ".");
           try {
-            var name = runtimeRequire(path24.join(dir, "package.json")).name.toUpperCase().replace(/-/g, "_");
+            var name = runtimeRequire(path25.join(dir, "package.json")).name.toUpperCase().replace(/-/g, "_");
             if (process.env[name + "_PREBUILD"]) dir = process.env[name + "_PREBUILD"];
           } catch (err) {
           }
           if (!prebuildsOnly) {
-            var release = getFirst(path24.join(dir, "build/Release"), matchBuild);
+            var release = getFirst(path25.join(dir, "build/Release"), matchBuild);
             if (release) return release;
-            var debug = getFirst(path24.join(dir, "build/Debug"), matchBuild);
+            var debug = getFirst(path25.join(dir, "build/Debug"), matchBuild);
             if (debug) return debug;
           }
           var prebuild = resolve(dir);
           if (prebuild) return prebuild;
-          var nearby = resolve(path24.dirname(process.execPath));
+          var nearby = resolve(path25.dirname(process.execPath));
           if (nearby) return nearby;
           var target = [
             "platform=" + platform,
@@ -6569,26 +6598,26 @@ var init_simple_client_node = __esm({
           ].filter(Boolean).join(" ");
           throw new Error("No native build was found for " + target + "\n    loaded from: " + dir + "\n");
           function resolve(dir2) {
-            var tuples = readdirSync(path24.join(dir2, "prebuilds")).map(parseTuple);
+            var tuples = readdirSync(path25.join(dir2, "prebuilds")).map(parseTuple);
             var tuple = tuples.filter(matchTuple(platform, arch)).sort(compareTuples)[0];
             if (!tuple) return;
-            var prebuilds = path24.join(dir2, "prebuilds", tuple.name);
+            var prebuilds = path25.join(dir2, "prebuilds", tuple.name);
             var parsed = readdirSync(prebuilds).map(parseTags);
             var candidates = parsed.filter(matchTags(runtime, abi));
             var winner = candidates.sort(compareTags(runtime))[0];
-            if (winner) return path24.join(prebuilds, winner.file);
+            if (winner) return path25.join(prebuilds, winner.file);
           }
         };
         function readdirSync(dir) {
           try {
-            return fs23.readdirSync(dir);
+            return fs25.readdirSync(dir);
           } catch (err) {
             return [];
           }
         }
         function getFirst(dir, filter) {
           var files = readdirSync(dir).filter(filter);
-          return files[0] && path24.join(dir, files[0]);
+          return files[0] && path25.join(dir, files[0]);
         }
         function matchBuild(name) {
           return /\.node$/.test(name);
@@ -6675,7 +6704,7 @@ var init_simple_client_node = __esm({
           return typeof window !== "undefined" && window.process && window.process.type === "renderer";
         }
         function isAlpine(platform2) {
-          return platform2 === "linux" && fs23.existsSync("/etc/alpine-release");
+          return platform2 === "linux" && fs25.existsSync("/etc/alpine-release");
         }
         load2.parseTags = parseTags;
         load2.matchTags = matchTags;
@@ -8881,7 +8910,7 @@ var init_simple_client_node = __esm({
         var http3 = __require("http");
         var net3 = __require("net");
         var tls = __require("tls");
-        var { randomBytes, createHash: createHash3 } = __require("crypto");
+        var { randomBytes, createHash: createHash2 } = __require("crypto");
         var { Duplex, Readable } = __require("stream");
         var { URL: URL2 } = __require("url");
         var PerMessageDeflate = require_permessage_deflate();
@@ -9538,7 +9567,7 @@ var init_simple_client_node = __esm({
               abortHandshake(websocket, socket, "Invalid Upgrade header");
               return;
             }
-            const digest = createHash3("sha1").update(key + GUID).digest("base64");
+            const digest = createHash2("sha1").update(key + GUID).digest("base64");
             if (res.headers["sec-websocket-accept"] !== digest) {
               abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
               return;
@@ -9803,7 +9832,7 @@ var init_simple_client_node = __esm({
         var EventEmitter = __require("events");
         var http3 = __require("http");
         var { Duplex } = __require("stream");
-        var { createHash: createHash3 } = __require("crypto");
+        var { createHash: createHash2 } = __require("crypto");
         var extension = require_extension();
         var PerMessageDeflate = require_permessage_deflate();
         var subprotocol = require_subprotocol();
@@ -10098,7 +10127,7 @@ var init_simple_client_node = __esm({
               );
             }
             if (this._state > RUNNING) return abortHandshake(socket, 503);
-            const digest = createHash3("sha1").update(key + GUID).digest("base64");
+            const digest = createHash2("sha1").update(key + GUID).digest("base64");
             const headers = [
               "HTTP/1.1 101 Switching Protocols",
               "Upgrade: websocket",
@@ -10657,11 +10686,11 @@ var init_server = __esm({
 });
 
 // ../daemon/src/spritesRegistry.ts
-var import_node_crypto3, import_node_fs, import_promises4, registryGet, registryReplace, registryUpsert, registryUsage, registryRemove, logger4, TOKEN_REFRESH_BUFFER_MS, clientCache, migrationPromise, migrationCompleted, trimEnv, resolveConvexUrl, resolveControlPlaneUrl, requireConvexConfig, decodeJwtPayload, parseTokenExpiresAt, shouldRefreshToken, isUnauthorizedError, clearControlPlaneSession, handleUnauthorized, refreshSession, loadControlPlaneToken, getClient, spritePortsList, logRequest, logResponse, parseTimestamp, pickEarlier, pickLater, mergeBoxes, mergeProjects, mergeRegistry, getRegistryFromConvex, replaceRegistry, migrateLocalRegistry, backfillInitStatus, fetchRegistry, upsertRegistry, recordRegistryUsage, removeRegistryEntry, subscribeSpritePorts;
+var import_node_crypto2, import_node_fs, import_promises4, registryGet, registryReplace, registryUpsert, registryUsage, registryRemove, logger4, TOKEN_REFRESH_BUFFER_MS, clientCache, migrationPromise, migrationCompleted, trimEnv, resolveConvexUrl, resolveControlPlaneUrl, requireConvexConfig, decodeJwtPayload, parseTokenExpiresAt, shouldRefreshToken, isUnauthorizedError, clearControlPlaneSession, handleUnauthorized, refreshSession, loadControlPlaneToken, getClient, spritePortsList, logRequest, logResponse, parseTimestamp, pickEarlier, pickLater, mergeBoxes, mergeProjects, mergeRegistry, getRegistryFromConvex, replaceRegistry, migrateLocalRegistry, backfillInitStatus, fetchRegistry, upsertRegistry, recordRegistryUsage, removeRegistryEntry, subscribeSpritePorts;
 var init_spritesRegistry = __esm({
   "../daemon/src/spritesRegistry.ts"() {
     "use strict";
-    import_node_crypto3 = require("node:crypto");
+    import_node_crypto2 = require("node:crypto");
     import_node_fs = require("node:fs");
     import_promises4 = __toESM(require("node:fs/promises"), 1);
     init_index_node();
@@ -10760,7 +10789,7 @@ var init_spritesRegistry = __esm({
           "Control plane URL is required. Rebuild with CONVEX_SITE_URL/CONVEX_DEPLOYMENT/VITE_CONVEX_URL set."
         );
       }
-      const requestId = (0, import_node_crypto3.randomUUID)();
+      const requestId = (0, import_node_crypto2.randomUUID)();
       const url = new URL("/auth/refresh", baseUrl);
       logger4.info("control_plane_request", {
         requestId,
@@ -10855,7 +10884,7 @@ var init_spritesRegistry = __esm({
     };
     spritePortsList = makeFunctionReference("spriteDaemonPorts:listForSprite");
     logRequest = (method, fn) => {
-      const requestId = (0, import_node_crypto3.randomUUID)();
+      const requestId = (0, import_node_crypto2.randomUUID)();
       logger4.info("convex_request", { requestId, method, path: fn });
       return requestId;
     };
@@ -11090,11 +11119,11 @@ var init_spritesRegistry = __esm({
 });
 
 // ../daemon/src/ports.ts
-var import_node_crypto4, import_node_net, logger5, MAX_PORT2, MAX_PORT_SHIFT, MIN_UNPRIVILEGED_PORT, AUTO_FORWARD_BLOCKED_PORTS, nextCandidatePort, isRetryableListenError, isIpv6LoopbackAvailable, listenOnPort, PortManager;
+var import_node_crypto3, import_node_net, logger5, MAX_PORT2, MAX_PORT_SHIFT, MIN_UNPRIVILEGED_PORT, AUTO_FORWARD_BLOCKED_PORTS, nextCandidatePort, isRetryableListenError, isIpv6LoopbackAvailable, listenOnPort, PortManager;
 var init_ports2 = __esm({
   "../daemon/src/ports.ts"() {
     "use strict";
-    import_node_crypto4 = require("node:crypto");
+    import_node_crypto3 = require("node:crypto");
     import_node_net = __toESM(require("node:net"), 1);
     init_src();
     init_spritesRegistry();
@@ -11507,7 +11536,7 @@ var init_ports2 = __esm({
         }
       }
       async handleProxyConnection(box, remotePort, socket, forward) {
-        const connectionId = (0, import_node_crypto4.randomUUID)();
+        const connectionId = (0, import_node_crypto3.randomUUID)();
         const client = await this.getSpritesClient();
         if (!client) {
           socket.destroy();
@@ -11648,13 +11677,13 @@ __export(src_exports, {
   runDaemon: () => runDaemon,
   startDaemon: () => startDaemon
 });
-var import_node_http, import_promises5, import_node_fs2, import_node_crypto5, import_node_net2, import_node_path5, logger6, startedAt, DAEMON_API_VERSION, DAEMON_FEATURES, allowShutdown, buildBoxSummaries, readBody, readRequestPath, writeJson, handleRequestError, isSocketAlive, ensureRuntimeDir, startDaemon, runDaemon;
+var import_node_http, import_promises5, import_node_fs2, import_node_crypto4, import_node_net2, import_node_path5, logger6, startedAt, DAEMON_API_VERSION, DAEMON_FEATURES, allowShutdown, buildBoxSummaries, readBody, readRequestPath, writeJson, handleRequestError, isSocketAlive, ensureRuntimeDir, startDaemon, runDaemon;
 var init_src2 = __esm({
   "../daemon/src/index.ts"() {
     import_node_http = require("node:http");
     import_promises5 = __toESM(require("node:fs/promises"));
     import_node_fs2 = require("node:fs");
-    import_node_crypto5 = require("node:crypto");
+    import_node_crypto4 = require("node:crypto");
     import_node_net2 = __toESM(require("node:net"));
     import_node_path5 = __toESM(require("node:path"));
     init_src();
@@ -11798,17 +11827,17 @@ var init_src2 = __esm({
         logger6.warn("ports_registry_load_failed", { error: String(error) });
       });
       const server = (0, import_node_http.createServer)((req, res) => {
-        const requestId = req.headers["x-request-id"] ?? (0, import_node_crypto5.randomUUID)();
-        const path24 = readRequestPath(req);
+        const requestId = req.headers["x-request-id"] ?? (0, import_node_crypto4.randomUUID)();
+        const path25 = readRequestPath(req);
         res.on("finish", () => {
           logger6.info("daemon_request", {
             requestId,
             method: req.method,
-            path: path24,
+            path: path25,
             status: res.statusCode
           });
         });
-        if (path24 === "/health") {
+        if (path25 === "/health") {
           writeJson(res, 200, {
             ok: true,
             pid: process.pid,
@@ -11817,7 +11846,7 @@ var init_src2 = __esm({
           });
           return;
         }
-        if (path24 === "/version") {
+        if (path25 === "/version") {
           writeJson(res, 200, {
             name: "dvbd",
             version: "0.0.0",
@@ -11826,7 +11855,7 @@ var init_src2 = __esm({
           });
           return;
         }
-        if (path24 === "/boxes") {
+        if (path25 === "/boxes") {
           void buildBoxSummaries().then((boxes) => {
             writeJson(res, 200, { boxes });
           }).catch((error) => {
@@ -11834,7 +11863,7 @@ var init_src2 = __esm({
           });
           return;
         }
-        if (path24 === "/registry/project" && req.method === "GET") {
+        if (path25 === "/registry/project" && req.method === "GET") {
           const url = new URL(req.url ?? "", "http://localhost");
           const fingerprint = url.searchParams.get("fingerprint") ?? "";
           void fetchRegistry().then((registry) => {
@@ -11845,7 +11874,7 @@ var init_src2 = __esm({
           });
           return;
         }
-        if (path24 === "/registry/alias" && req.method === "GET") {
+        if (path25 === "/registry/alias" && req.method === "GET") {
           const url = new URL(req.url ?? "", "http://localhost");
           const alias = url.searchParams.get("alias") ?? "";
           void fetchRegistry().then((registry) => {
@@ -11856,7 +11885,7 @@ var init_src2 = __esm({
           });
           return;
         }
-        if (path24 === "/registry/upsert" && req.method === "POST") {
+        if (path25 === "/registry/upsert" && req.method === "POST") {
           void readBody(req).then(async (payload) => {
             const project = payload?.project;
             const box = payload?.box;
@@ -11881,7 +11910,7 @@ var init_src2 = __esm({
           });
           return;
         }
-        if (path24 === "/registry/usage" && req.method === "POST") {
+        if (path25 === "/registry/usage" && req.method === "POST") {
           void readBody(req).then(async (payload) => {
             const canonical = typeof payload?.canonical === "string" ? payload.canonical : "";
             if (!canonical) {
@@ -11896,7 +11925,7 @@ var init_src2 = __esm({
           });
           return;
         }
-        if (path24 === "/registry/remove" && req.method === "POST") {
+        if (path25 === "/registry/remove" && req.method === "POST") {
           void readBody(req).then(async (payload) => {
             const canonical = typeof payload?.canonical === "string" ? payload.canonical : "";
             if (!canonical) {
@@ -11911,12 +11940,12 @@ var init_src2 = __esm({
           });
           return;
         }
-        if (path24 === "/ports" && req.method === "GET") {
+        if (path25 === "/ports" && req.method === "GET") {
           const snapshot = portManager.listPorts();
           writeJson(res, 200, snapshot);
           return;
         }
-        if (path24 === "/ports/clear" && req.method === "POST") {
+        if (path25 === "/ports/clear" && req.method === "POST") {
           void readBody(req).then((payload) => {
             const box = typeof payload?.box === "string" ? payload.box : void 0;
             if (!box) {
@@ -11930,7 +11959,7 @@ var init_src2 = __esm({
           });
           return;
         }
-        if (path24 === "/ports/reload" && req.method === "POST") {
+        if (path25 === "/ports/reload" && req.method === "POST") {
           void readBody(req).then(async (payload) => {
             const box = typeof payload?.box === "string" ? payload.box : void 0;
             if (!box) {
@@ -11944,7 +11973,7 @@ var init_src2 = __esm({
           });
           return;
         }
-        if (path24 === "/ports/policy" && req.method === "POST") {
+        if (path25 === "/ports/policy" && req.method === "POST") {
           void readBody(req).then((payload) => {
             const box = typeof payload?.box === "string" ? payload.box : void 0;
             const policy = payload?.policy === "auto" || payload?.policy === "disabled" ? payload.policy : null;
@@ -11961,7 +11990,7 @@ var init_src2 = __esm({
           });
           return;
         }
-        if (path24 === "/ports/forward" && req.method === "POST") {
+        if (path25 === "/ports/forward" && req.method === "POST") {
           void readBody(req).then(async (payload) => {
             const box = typeof payload?.box === "string" ? payload.box : void 0;
             const port = typeof payload?.port === "number" ? payload.port : void 0;
@@ -11981,7 +12010,7 @@ var init_src2 = __esm({
           });
           return;
         }
-        if (path24 === "/ports/stop" && req.method === "POST") {
+        if (path25 === "/ports/stop" && req.method === "POST") {
           void readBody(req).then((payload) => {
             const box = typeof payload?.box === "string" ? payload.box : void 0;
             const port = typeof payload?.port === "number" ? payload.port : void 0;
@@ -11996,7 +12025,7 @@ var init_src2 = __esm({
           });
           return;
         }
-        if (path24 === "/shutdown" && req.method === "POST" && allowShutdown()) {
+        if (path25 === "/shutdown" && req.method === "POST" && allowShutdown()) {
           writeJson(res, 202, { ok: true });
           void close();
           return;
@@ -12069,12 +12098,12 @@ var init_logger2 = __esm({
 });
 
 // src/devbox/controlPlane.ts
-var import_node_http2, import_node_crypto6, import_node_child_process, resolveControlPlaneUrl2, resolveConvexUrl2, openBrowser, requestJson2, startCallbackServer, getControlPlaneUrl, getConvexUrl, signInWithBrowser, spriteTokenGet, spriteTokenSet, spriteDaemonReleaseGet, spriteDaemonTokenIssue, spriteDaemonSessionSummariesList, spriteDaemonSessionsList, withConvexClient, fetchSpriteToken, storeSpriteToken, fetchSpriteDaemonRelease, issueSpriteDaemonToken, listSpriteDaemonSessionSummaries, listSpriteDaemonSessions, signOutControlPlane, refreshControlPlaneSession;
+var import_node_http2, import_node_crypto5, import_node_child_process, resolveControlPlaneUrl2, resolveConvexUrl2, openBrowser, requestJson2, startCallbackServer, getControlPlaneUrl, getConvexUrl, signInWithBrowser, spriteTokenGet, spriteTokenSet, spriteDaemonReleaseGet, spriteDaemonTokenIssue, spriteDaemonSessionSummariesList, spriteDaemonSessionsList, withConvexClient, fetchSpriteToken, storeSpriteToken, fetchSpriteDaemonRelease, issueSpriteDaemonToken, listSpriteDaemonSessionSummaries, listSpriteDaemonSessions, signOutControlPlane, refreshControlPlaneSession;
 var init_controlPlane = __esm({
   "src/devbox/controlPlane.ts"() {
     "use strict";
     import_node_http2 = __toESM(require("node:http"), 1);
-    import_node_crypto6 = require("node:crypto");
+    import_node_crypto5 = require("node:crypto");
     import_node_child_process = require("node:child_process");
     init_index_node();
     init_server();
@@ -12122,9 +12151,9 @@ var init_controlPlane = __esm({
         console.log(url);
       }
     };
-    requestJson2 = async (baseUrl, method, path24, body, token) => {
-      const requestId = (0, import_node_crypto6.randomUUID)();
-      const url = new URL(path24, baseUrl);
+    requestJson2 = async (baseUrl, method, path25, body, token) => {
+      const requestId = (0, import_node_crypto5.randomUUID)();
+      const url = new URL(path25, baseUrl);
       const headers = {
         "x-request-id": requestId
       };
@@ -12311,7 +12340,7 @@ var init_controlPlane = __esm({
       });
     };
     listSpriteDaemonSessionSummaries = async (token, spriteName) => {
-      const requestId = (0, import_node_crypto6.randomUUID)();
+      const requestId = (0, import_node_crypto5.randomUUID)();
       logger7.info("control_plane_query", {
         requestId,
         action: "spriteDaemonSessionSummaries:listForSprite",
@@ -12339,7 +12368,7 @@ var init_controlPlane = __esm({
       }
     };
     listSpriteDaemonSessions = async (token, spriteName) => {
-      const requestId = (0, import_node_crypto6.randomUUID)();
+      const requestId = (0, import_node_crypto5.randomUUID)();
       logger7.info("control_plane_query", {
         requestId,
         action: "spriteDaemonSessions:listForSprite",
@@ -12397,14 +12426,14 @@ var init_controlPlane = __esm({
 });
 
 // src/devbox/daemonClient.ts
-var import_node_http3, import_node_path6, import_node_child_process2, import_node_crypto7, import_promises6, DAEMON_TIMEOUT_MS, DaemonConnectionError, isConnectionError, requestJson3, requireDaemonFeatures, resolveDaemonCommand, spawnDaemon, waitForHealth, listAlternateSocketPaths, pruneDuplicateDaemons, ensureDaemonRunning, waitForSocketGone, stopDaemon;
+var import_node_http3, import_node_path6, import_node_child_process2, import_node_crypto6, import_promises6, DAEMON_TIMEOUT_MS, DaemonConnectionError, isConnectionError, requestJson3, requireDaemonFeatures, resolveDaemonCommand, spawnDaemon, waitForHealth, listAlternateSocketPaths, pruneDuplicateDaemons, ensureDaemonRunning, waitForSocketGone, stopDaemon;
 var init_daemonClient = __esm({
   "src/devbox/daemonClient.ts"() {
     "use strict";
     import_node_http3 = __toESM(require("node:http"), 1);
     import_node_path6 = __toESM(require("node:path"), 1);
     import_node_child_process2 = require("node:child_process");
-    import_node_crypto7 = require("node:crypto");
+    import_node_crypto6 = require("node:crypto");
     import_promises6 = require("node:fs/promises");
     init_src();
     init_controlPlane();
@@ -12431,7 +12460,7 @@ var init_daemonClient = __esm({
       return code2 === "ENOENT" || code2 === "ECONNREFUSED" || code2 === "EPIPE" || code2 === "ENOTFOUND";
     };
     requestJson3 = async (socketPath, method, requestPath, timeoutMs, body) => {
-      const requestId = (0, import_node_crypto7.randomUUID)();
+      const requestId = (0, import_node_crypto6.randomUUID)();
       logger7.info("daemon_request", {
         requestId,
         method,
@@ -12598,7 +12627,7 @@ var init_daemonClient = __esm({
       candidates.add(fallback2);
       const homeDir = process.env.HOME?.trim();
       if (homeDir) {
-        candidates.add(import_node_path6.default.join(homeDir, ".devbox", "run", "devboxd.sock"));
+        candidates.add(import_node_path6.default.join(resolveDevboxDir(homeDir), "run", "devboxd.sock"));
       }
       candidates.delete(primary);
       return [...candidates];
@@ -12689,11 +12718,11 @@ var init_daemonClient = __esm({
 });
 
 // src/devbox/auth.ts
-var import_node_crypto8, import_promises7, promptForValue, computeSyncHash, TOKEN_REFRESH_BUFFER_MS2, decodeJwtPayload2, parseTokenExpiresAt2, shouldRefreshToken2, isUnauthorizedError2, clearControlPlaneSession2, updateControlPlaneSession, refreshControlPlaneToken, tokenInstructions, promptForSpritesToken, ensureControlPlaneToken, ensureSpritesToken;
+var import_node_crypto7, import_promises7, promptForValue, computeSyncHash, TOKEN_REFRESH_BUFFER_MS2, decodeJwtPayload2, parseTokenExpiresAt2, shouldRefreshToken2, isUnauthorizedError2, clearControlPlaneSession2, updateControlPlaneSession, refreshControlPlaneToken, tokenInstructions, promptForSpritesToken, ensureControlPlaneToken, ensureSpritesToken;
 var init_auth = __esm({
   "src/devbox/auth.ts"() {
     "use strict";
-    import_node_crypto8 = require("node:crypto");
+    import_node_crypto7 = require("node:crypto");
     import_promises7 = __toESM(require("node:readline/promises"), 1);
     init_logger2();
     init_controlPlane();
@@ -12711,7 +12740,7 @@ var init_auth = __esm({
     };
     computeSyncHash = (token, controlPlaneToken) => {
       if (!controlPlaneToken) return null;
-      return (0, import_node_crypto8.createHash)("sha256").update(`${controlPlaneToken}:${token}`).digest("hex");
+      return (0, import_node_crypto7.createHash)("sha256").update(`${controlPlaneToken}:${token}`).digest("hex");
     };
     TOKEN_REFRESH_BUFFER_MS2 = 5 * 60 * 1e3;
     decodeJwtPayload2 = (token) => {
@@ -13497,7 +13526,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     return min;
   }
   if (import_node_process.default.platform === "win32") {
-    const osRelease = import_node_os4.default.release().split(".");
+    const osRelease = import_node_os2.default.release().split(".");
     if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
       return Number(osRelease[2]) >= 14931 ? 3 : 2;
     }
@@ -13556,11 +13585,11 @@ function createSupportsColor(stream, options = {}) {
   });
   return translateLevel(level);
 }
-var import_node_process, import_node_os4, import_node_tty, env, flagForceColor, supportsColor, supports_color_default;
+var import_node_process, import_node_os2, import_node_tty, env, flagForceColor, supportsColor, supports_color_default;
 var init_supports_color = __esm({
   "../../node_modules/chalk/source/vendor/supports-color/index.js"() {
     import_node_process = __toESM(require("node:process"), 1);
-    import_node_os4 = __toESM(require("node:os"), 1);
+    import_node_os2 = __toESM(require("node:os"), 1);
     import_node_tty = __toESM(require("node:tty"), 1);
     ({ env } = import_node_process.default);
     if (hasFlag("no-color") || hasFlag("no-colors") || hasFlag("color=false") || hasFlag("color=never")) {
@@ -17542,17 +17571,17 @@ var init_t = __esm({
 });
 
 // src/devbox/completions/cache.ts
-var import_promises8, import_node_os5, import_node_path7, resolveCacheDir, resolveCompletionsDir, resolveCompletionCachePath, ensureDir, writeJsonAtomic2, createEmptyCache, loadCompletionCache, saveCompletionCache, dedupeSessionEntries, mergeSessionEntries, updateCompletionCacheSessions, updateCompletionCacheSessionsFromMap, updateCompletionCacheSessionsFromViews, updateCompletionCacheAlias;
+var import_promises8, import_node_os3, import_node_path7, resolveCacheDir, resolveCompletionsDir, resolveCompletionCachePath, ensureDir, writeJsonAtomic2, createEmptyCache, loadCompletionCache, saveCompletionCache, dedupeSessionEntries, mergeSessionEntries, updateCompletionCacheSessions, updateCompletionCacheSessionsFromMap, updateCompletionCacheSessionsFromViews, updateCompletionCacheAlias;
 var init_cache = __esm({
   "src/devbox/completions/cache.ts"() {
     "use strict";
     import_promises8 = __toESM(require("node:fs/promises"), 1);
-    import_node_os5 = __toESM(require("node:os"), 1);
+    import_node_os3 = __toESM(require("node:os"), 1);
     import_node_path7 = __toESM(require("node:path"), 1);
     init_src();
-    resolveCacheDir = (homeDir = import_node_os5.default.homedir()) => import_node_path7.default.join(resolveDevboxDir(homeDir), "cache");
-    resolveCompletionsDir = (homeDir = import_node_os5.default.homedir()) => import_node_path7.default.join(resolveDevboxDir(homeDir), "completions");
-    resolveCompletionCachePath = (homeDir = import_node_os5.default.homedir()) => import_node_path7.default.join(resolveCacheDir(homeDir), "completions.json");
+    resolveCacheDir = (homeDir = import_node_os3.default.homedir()) => import_node_path7.default.join(resolveDevboxDir(homeDir), "cache");
+    resolveCompletionsDir = (homeDir = import_node_os3.default.homedir()) => import_node_path7.default.join(resolveDevboxDir(homeDir), "completions");
+    resolveCompletionCachePath = (homeDir = import_node_os3.default.homedir()) => import_node_path7.default.join(resolveCacheDir(homeDir), "completions.json");
     ensureDir = async (dir) => {
       await import_promises8.default.mkdir(dir, { recursive: true, mode: 448 });
       try {
@@ -17656,12 +17685,12 @@ var init_cache = __esm({
 });
 
 // src/devbox/completions/index.ts
-var import_promises9, import_node_os6, import_node_path8, import_promises10, SESSION_TTL_MS, REMOTE_ATTEMPT_INTERVAL_MS, REMOTE_TIMEOUT_MS, PRIME_SESSION_LIMIT, ALIAS_TTL_MS, ALIAS_ATTEMPT_INTERVAL_MS, RC_BEGIN, RC_END, SUPPORTED_SHELLS, normalizeShell, resolveShellFromEnv, nowIso, isStale, readTextFile, writeTextFile, captureConsole, createCompletionRoot, parseCompletionContext, createSpriteAuth, fetchWithTimeout, fetchRemoteSessionMap, shouldAttemptRemote, mergeAliasMaps, refreshAliasesFromDaemonIfNeeded, refreshRemoteSessionsIfNeeded, primeCompletionCache, loadCompletionData, resolveShellPaths, buildRcBlock, updateRcFile, removeRcBlock, generateCompletionScript, installCompletions, uninstallCompletions, detectStatusForShell, resolveCompletionStatus, maybeAutoUpdateCompletions, promptYesNo, maybeOfferCompletionsInstall, usage, parseCompletionsArgs, runCompletions, runComplete, recordCompletionAliases, recordCompletionSessionsFromMap, recordCompletionSessionsFromViews;
+var import_promises9, import_node_os4, import_node_path8, import_promises10, SESSION_TTL_MS, REMOTE_ATTEMPT_INTERVAL_MS, REMOTE_TIMEOUT_MS, PRIME_SESSION_LIMIT, ALIAS_TTL_MS, ALIAS_ATTEMPT_INTERVAL_MS, resolveCliName, rcMarkers, SUPPORTED_SHELLS, normalizeShell, resolveShellFromEnv, nowIso, isStale, readTextFile, writeTextFile, captureConsole, createCompletionRoot, parseCompletionContext, createSpriteAuth, fetchWithTimeout, fetchRemoteSessionMap, shouldAttemptRemote, mergeAliasMaps, refreshAliasesFromDaemonIfNeeded, refreshRemoteSessionsIfNeeded, primeCompletionCache, loadCompletionData, resolveShellPaths, buildRcBlock, updateRcFile, removeRcBlock, generateCompletionScript, installCompletions, uninstallCompletions, detectStatusForShell, resolveCompletionStatus, maybeAutoUpdateCompletions, promptYesNo, maybeOfferCompletionsInstall, usage, parseCompletionsArgs, runCompletions, runComplete, recordCompletionAliases, recordCompletionSessionsFromMap, recordCompletionSessionsFromViews;
 var init_completions = __esm({
   "src/devbox/completions/index.ts"() {
     "use strict";
     import_promises9 = __toESM(require("node:fs/promises"), 1);
-    import_node_os6 = __toESM(require("node:os"), 1);
+    import_node_os4 = __toESM(require("node:os"), 1);
     import_node_path8 = __toESM(require("node:path"), 1);
     import_promises10 = __toESM(require("node:readline/promises"), 1);
     init_t();
@@ -17674,8 +17703,16 @@ var init_completions = __esm({
     PRIME_SESSION_LIMIT = 5;
     ALIAS_TTL_MS = 6e4;
     ALIAS_ATTEMPT_INTERVAL_MS = 3e4;
-    RC_BEGIN = "# >>> dvb completions >>>";
-    RC_END = "# <<< dvb completions <<<";
+    resolveCliName = () => {
+      const raw = process.env.DEVBOX_CLI_NAME?.trim();
+      if (!raw) return "dvb";
+      const normalized = raw.replace(/[^A-Za-z0-9_-]+/g, "").slice(0, 32);
+      return normalized.length > 0 ? normalized : "dvb";
+    };
+    rcMarkers = (cliName) => ({
+      begin: `# >>> ${cliName} completions >>>`,
+      end: `# <<< ${cliName} completions <<<`
+    });
     SUPPORTED_SHELLS = ["bash", "zsh", "fish"];
     normalizeShell = (value) => {
       if (!value) return null;
@@ -18117,31 +18154,37 @@ var init_completions = __esm({
       };
     };
     resolveShellPaths = (shell) => {
-      const home = import_node_os6.default.homedir();
+      const cliName = resolveCliName();
+      const home = import_node_os4.default.homedir();
       if (shell === "fish") {
         const configHome = process.env.XDG_CONFIG_HOME ?? import_node_path8.default.join(home, ".config");
         return {
-          scriptPath: import_node_path8.default.join(configHome, "fish", "completions", "dvb.fish"),
+          scriptPath: import_node_path8.default.join(
+            configHome,
+            "fish",
+            "completions",
+            `${cliName}.fish`
+          ),
           rcPath: void 0
         };
       }
       const completionsDir = resolveCompletionsDir(home);
-      const scriptPath = shell === "zsh" ? import_node_path8.default.join(completionsDir, "dvb.zsh") : import_node_path8.default.join(completionsDir, "dvb.bash");
+      const scriptPath = shell === "zsh" ? import_node_path8.default.join(completionsDir, `${cliName}.zsh`) : import_node_path8.default.join(completionsDir, `${cliName}.bash`);
       const rcPath = shell === "zsh" ? import_node_path8.default.join(process.env.ZDOTDIR ?? home, ".zshrc") : import_node_path8.default.join(home, ".bashrc");
       return { scriptPath, rcPath };
     };
-    buildRcBlock = (scriptPath) => [
-      RC_BEGIN,
+    buildRcBlock = (scriptPath, markers) => [
+      markers.begin,
       `if [ -f "${scriptPath}" ]; then`,
       `  source "${scriptPath}"`,
       "fi",
-      RC_END
+      markers.end
     ].join("\n");
-    updateRcFile = async (rcPath, block) => {
+    updateRcFile = async (rcPath, block, markers) => {
       const existing = await readTextFile(rcPath) ?? "";
-      if (existing.includes(RC_BEGIN) && existing.includes(RC_END)) {
+      if (existing.includes(markers.begin) && existing.includes(markers.end)) {
         const updated = existing.replace(
-          new RegExp(`${RC_BEGIN}[\\s\\S]*?${RC_END}`, "m"),
+          new RegExp(`${markers.begin}[\\s\\S]*?${markers.end}`, "m"),
           block
         );
         await writeTextFile(rcPath, updated);
@@ -18151,17 +18194,20 @@ var init_completions = __esm({
       await writeTextFile(rcPath, `${existing}${suffix}${block}
 `);
     };
-    removeRcBlock = async (rcPath) => {
+    removeRcBlock = async (rcPath, markers) => {
       const existing = await readTextFile(rcPath);
       if (!existing) return;
-      if (!existing.includes(RC_BEGIN) || !existing.includes(RC_END)) return;
+      if (!existing.includes(markers.begin) || !existing.includes(markers.end)) {
+        return;
+      }
       const updated = existing.replace(
-        new RegExp(`\\n?${RC_BEGIN}[\\s\\S]*?${RC_END}\\n?`, "m"),
+        new RegExp(`\\n?${markers.begin}[\\s\\S]*?${markers.end}\\n?`, "m"),
         "\n"
       );
       await writeTextFile(rcPath, updated.trimEnd() + "\n");
     };
     generateCompletionScript = (shell) => {
+      const cliName = resolveCliName();
       const root = createCompletionRoot({
         boxes: [],
         boxSessionNames: [],
@@ -18169,15 +18215,17 @@ var init_completions = __esm({
         sessionRefs: []
       });
       return captureConsole(() => {
-        root.setup("dvb", "dvb", shell);
+        root.setup(cliName, cliName, shell);
       });
     };
     installCompletions = async (shell) => {
+      const cliName = resolveCliName();
+      const markers = rcMarkers(cliName);
       const { scriptPath, rcPath } = resolveShellPaths(shell);
       const script = generateCompletionScript(shell);
       await writeTextFile(scriptPath, script);
       if (rcPath) {
-        await updateRcFile(rcPath, buildRcBlock(scriptPath));
+        await updateRcFile(rcPath, buildRcBlock(scriptPath, markers), markers);
       }
       try {
         await primeCompletionCache();
@@ -18195,13 +18243,15 @@ var init_completions = __esm({
       return { scriptPath, rcPath };
     };
     uninstallCompletions = async (shell) => {
+      const cliName = resolveCliName();
+      const markers = rcMarkers(cliName);
       const { scriptPath, rcPath } = resolveShellPaths(shell);
       try {
         await import_promises9.default.unlink(scriptPath);
       } catch {
       }
       if (rcPath) {
-        await removeRcBlock(rcPath);
+        await removeRcBlock(rcPath, markers);
       }
       const cache = await loadCompletionCache();
       if (cache.install?.shell === shell) {
@@ -18211,13 +18261,15 @@ var init_completions = __esm({
       return { scriptPath, rcPath };
     };
     detectStatusForShell = async (shell) => {
+      const cliName = resolveCliName();
+      const markers = rcMarkers(cliName);
       const { scriptPath, rcPath } = resolveShellPaths(shell);
       const scriptExists = Boolean(await readTextFile(scriptPath));
       let rcConfigured = scriptExists;
       if (rcPath) {
         const rcContents = await readTextFile(rcPath);
         rcConfigured = Boolean(
-          rcContents?.includes(RC_BEGIN) && rcContents?.includes(RC_END)
+          rcContents?.includes(markers.begin) && rcContents?.includes(markers.end)
         );
       }
       const status = { shell, scriptPath, scriptExists, rcConfigured };
@@ -18282,11 +18334,12 @@ var init_completions = __esm({
       }
     };
     usage = () => {
+      const cliName = resolveCliName();
       console.log("Usage:");
-      console.log("  dvb completions status");
-      console.log("  dvb completions install [--shell <bash|zsh|fish>]");
-      console.log("  dvb completions uninstall [--shell <bash|zsh|fish>]");
-      console.log("  dvb completions generate <bash|zsh|fish>");
+      console.log(`  ${cliName} completions status`);
+      console.log(`  ${cliName} completions install [--shell <bash|zsh|fish>]`);
+      console.log(`  ${cliName} completions uninstall [--shell <bash|zsh|fish>]`);
+      console.log(`  ${cliName} completions generate <bash|zsh|fish>`);
     };
     parseCompletionsArgs = (args) => {
       const parsed = {
@@ -18730,12 +18783,12 @@ var init_sessionUtils = __esm({
 });
 
 // src/devbox/commands/connect.ts
-var import_node_child_process3, import_node_crypto9, import_node_path9, import_node_readline, import_promises12, DEFAULT_TTY_COLS, DEFAULT_TTY_ROWS, openBrowser2, warnSetupStatus, resolveTtyEnv, formatEnvExports, parseEnvSize, readStreamSize, resolveTtySize, resolveSessionEnv, parseReachabilityState, runCommand, checkReachability, watchReachabilityWithScutil, watchReachabilityWithNotifyutil, waitForNetworkOnline, parseConnectArgs, parseConnectTarget, buildLoggingCommand, CONNECT_SHELL, confirmNewSession, promptRenameSession, HEARTBEAT_INTERVAL_MS, HEARTBEAT_TIMEOUT_MS, INPUT_PROBE_TIMEOUT_MS, WS_OPEN_STATE, streamExecSession, runConnect;
+var import_node_child_process3, import_node_crypto8, import_node_path9, import_node_readline, import_promises12, DEFAULT_TTY_COLS, DEFAULT_TTY_ROWS, openBrowser2, warnSetupStatus, resolveTtyEnv, formatEnvExports, parseEnvSize, readStreamSize, resolveTtySize, resolveSessionEnv, parseReachabilityState, runCommand, checkReachability, watchReachabilityWithScutil, watchReachabilityWithNotifyutil, waitForNetworkOnline, parseConnectArgs, parseConnectTarget, buildLoggingCommand, CONNECT_SHELL, confirmNewSession, promptRenameSession, HEARTBEAT_INTERVAL_MS, HEARTBEAT_TIMEOUT_MS, INPUT_PROBE_TIMEOUT_MS, WS_OPEN_STATE, streamExecSession, runConnect;
 var init_connect = __esm({
   "src/devbox/commands/connect.ts"() {
     "use strict";
     import_node_child_process3 = require("node:child_process");
-    import_node_crypto9 = require("node:crypto");
+    import_node_crypto8 = require("node:crypto");
     import_node_path9 = require("node:path");
     import_node_readline = require("node:readline");
     import_promises12 = __toESM(require("node:readline/promises"), 1);
@@ -19760,7 +19813,7 @@ var init_connect = __esm({
         const weztermPane = process.env.WEZTERM_PANE?.trim() || "";
         const weztermSocket = process.env.WEZTERM_UNIX_SOCKET?.trim() || "";
         const weztermSessionId = weztermPane ? `wezterm:${weztermPane}${weztermSocket ? `:${(0, import_node_path9.basename)(weztermSocket)}` : ""}` : "";
-        const terminalSessionId = process.env.DEVBOX_TERM_SESSION_ID?.trim() || weztermSessionId || process.env.TERM_SESSION_ID?.trim() || process.env.ITERM_SESSION_ID?.trim() || `dvb-${(0, import_node_crypto9.randomUUID)()}`;
+        const terminalSessionId = process.env.DEVBOX_TERM_SESSION_ID?.trim() || weztermSessionId || process.env.TERM_SESSION_ID?.trim() || process.env.ITERM_SESSION_ID?.trim() || `dvb-${(0, import_node_crypto8.randomUUID)()}`;
         const execCommand2 = (() => {
           const sessionEnv = resolveSessionEnv(terminalSessionId);
           const ttyEnv = isTty ? resolveTtyEnv(terminalSessionId) : null;
@@ -20092,17 +20145,65 @@ var init_daemon = __esm({
 });
 
 // src/devbox/commands/destroy.ts
-var import_promises13, parseDestroyArgs, confirmDestroy, runDestroy;
+var import_promises13, import_promises14, import_node_os5, import_node_path10, isObject, readCanonicalFromJson, cleanupLocalProjectDirsForBox, parseDestroyArgs, confirmDestroy, runDestroy;
 var init_destroy = __esm({
   "src/devbox/commands/destroy.ts"() {
     "use strict";
     import_promises13 = __toESM(require("node:readline/promises"), 1);
-    init_src();
+    import_promises14 = __toESM(require("node:fs/promises"), 1);
+    import_node_os5 = __toESM(require("node:os"), 1);
+    import_node_path10 = __toESM(require("node:path"), 1);
     init_src();
     init_daemonClient();
     init_auth();
     init_statusLine();
     init_boxSelect();
+    isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+    readCanonicalFromJson = async (filePath) => {
+      try {
+        const raw = await import_promises14.default.readFile(filePath, "utf8");
+        const parsed = JSON.parse(raw);
+        if (!isObject(parsed)) return null;
+        const canonical = parsed.canonical;
+        if (typeof canonical !== "string") return null;
+        const trimmed = canonical.trim();
+        return trimmed.length > 0 ? trimmed : null;
+      } catch {
+        return null;
+      }
+    };
+    cleanupLocalProjectDirsForBox = async ({
+      canonical,
+      homeDir
+    }) => {
+      const projectsDir = resolveDevboxProjectsDir(homeDir);
+      let entries = [];
+      try {
+        const dirents = await import_promises14.default.readdir(projectsDir, { withFileTypes: true });
+        entries = dirents.map((entry) => ({
+          name: entry.name,
+          isDir: entry.isDirectory()
+        }));
+      } catch {
+        return { removed: 0 };
+      }
+      let removed = 0;
+      for (const entry of entries) {
+        if (!entry.isDir) continue;
+        const projectDir = import_node_path10.default.join(projectsDir, entry.name);
+        const markerCanonical = await readCanonicalFromJson(
+          import_node_path10.default.join(projectDir, "box.json")
+        );
+        const stateCanonical = markerCanonical ?? await readCanonicalFromJson(import_node_path10.default.join(projectDir, "init-state.json"));
+        if (stateCanonical !== canonical) continue;
+        try {
+          await import_promises14.default.rm(projectDir, { recursive: true, force: true });
+          removed += 1;
+        } catch {
+        }
+      }
+      return { removed };
+    };
     parseDestroyArgs = (args) => {
       const parsed = { force: false, json: false };
       for (let i2 = 0; i2 < args.length; i2 += 1) {
@@ -20232,6 +20333,12 @@ var init_destroy = __esm({
             "dvbd failed to clear local state. Restart dvbd and retry."
           );
         }
+        status.stage("Cleaning local project state");
+        try {
+          const homeDir = process.env.HOME ?? import_node_os5.default.homedir();
+          await cleanupLocalProjectDirsForBox({ canonical, homeDir });
+        } catch {
+        }
         status.stop();
         if (parsed.json) {
           console.log(JSON.stringify({ ok: true, canonical }, null, 2));
@@ -20252,11 +20359,11 @@ var init_destroy = __esm({
 });
 
 // src/devbox/commands/agent.ts
-var import_promises14, resolveSummaryLabel, agentLabel, usageForAgent, parseAgentArgs, parseClaudeTerminalSessionId, decideResumeSelection, resolveCanonical, loadResumeSessions, promptForSession, buildResumeCommand, buildStartCommand, runAgent, runCodex, runClaude;
+var import_promises15, resolveSummaryLabel, agentLabel, usageForAgent, parseAgentArgs, parseClaudeTerminalSessionId, decideResumeSelection, resolveCanonical, loadResumeSessions, promptForSession, buildResumeCommand, buildStartCommand, runAgent, runCodex, runClaude;
 var init_agent = __esm({
   "src/devbox/commands/agent.ts"() {
     "use strict";
-    import_promises14 = __toESM(require("node:readline/promises"), 1);
+    import_promises15 = __toESM(require("node:readline/promises"), 1);
     init_src();
     init_auth();
     init_controlPlane();
@@ -20429,7 +20536,7 @@ var init_agent = __esm({
         console.log(`  ${line}`);
       }
       console.log("");
-      const rl = import_promises14.default.createInterface({
+      const rl = import_promises15.default.createInterface({
         input: process.stdin,
         output: process.stdout
       });
@@ -21702,12 +21809,14 @@ var init_args = __esm({
 });
 
 // src/devbox/commands/init/repo.ts
-var import_node_child_process4, import_node_path10, buildSpawnEnv, runCommand2, runCommandRaw, findRepoRoot, readRepoOrigin, readRootCommit, resolveGitCommonDir, readHeadState, readNullSeparatedPaths, readWorktreeState, confirmCopyWorktree, readGlobalGitConfigFiles, mapGlobalGitConfigDestinations;
+var import_node_crypto9, import_node_child_process4, import_node_path11, import_promises16, buildSpawnEnv, runCommand2, runCommandRaw, findRepoRoot, readRepoOrigin, isObject2, readLegacyRepoFingerprint, readLocalGitConfigValue, writeLocalGitConfigValue, ensureRepoProjectId, resolveGitCommonDir, readHeadState, readNullSeparatedPaths, readWorktreeState, confirmCopyWorktree, readGlobalGitConfigFiles, mapGlobalGitConfigDestinations;
 var init_repo2 = __esm({
   "src/devbox/commands/init/repo.ts"() {
     "use strict";
+    import_node_crypto9 = require("node:crypto");
     import_node_child_process4 = require("node:child_process");
-    import_node_path10 = __toESM(require("node:path"), 1);
+    import_node_path11 = __toESM(require("node:path"), 1);
+    import_promises16 = __toESM(require("node:fs/promises"), 1);
     init_dist2();
     buildSpawnEnv = (options) => {
       if (!options?.env) return process.env;
@@ -21767,15 +21876,62 @@ var init_repo2 = __esm({
         return null;
       }
     };
-    readRootCommit = async (cwd) => runCommand2(cwd, "git", ["rev-list", "--max-parents=0", "HEAD"]);
+    isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+    readLegacyRepoFingerprint = async (repoRoot) => {
+      const legacyDir = import_node_path11.default.join(repoRoot, ".devbox");
+      const candidates = [
+        import_node_path11.default.join(legacyDir, "box.json"),
+        import_node_path11.default.join(legacyDir, "init-state.json")
+      ];
+      for (const filePath of candidates) {
+        try {
+          const raw = await import_promises16.default.readFile(filePath, "utf8");
+          const parsed = JSON.parse(raw);
+          if (!isObject2(parsed)) continue;
+          const fingerprint = parsed.fingerprint;
+          if (typeof fingerprint !== "string") continue;
+          const trimmed = fingerprint.trim();
+          if (trimmed.length === 0) continue;
+          return trimmed;
+        } catch {
+        }
+      }
+      return null;
+    };
+    readLocalGitConfigValue = async (repoRoot, key) => {
+      try {
+        const value = await runCommand2(repoRoot, "git", [
+          "config",
+          "--local",
+          "--get",
+          key
+        ]);
+        const trimmed = value.trim();
+        return trimmed.length > 0 ? trimmed : null;
+      } catch {
+        return null;
+      }
+    };
+    writeLocalGitConfigValue = async (repoRoot, key, value) => {
+      await runCommand2(repoRoot, "git", ["config", "--local", key, value]);
+    };
+    ensureRepoProjectId = async (repoRoot) => {
+      const key = "devbox.projectId";
+      const existing = await readLocalGitConfigValue(repoRoot, key);
+      if (existing) return existing;
+      const legacyFingerprint = await readLegacyRepoFingerprint(repoRoot);
+      const created = legacyFingerprint ?? (0, import_node_crypto9.randomUUID)();
+      await writeLocalGitConfigValue(repoRoot, key, created);
+      return created;
+    };
     resolveGitCommonDir = async (repoRoot) => {
       const gitDir = await runCommand2(repoRoot, "git", ["rev-parse", "--git-dir"]);
       const commonDir = await runCommand2(repoRoot, "git", [
         "rev-parse",
         "--git-common-dir"
       ]);
-      const resolvedGitDir = import_node_path10.default.isAbsolute(gitDir) ? gitDir : import_node_path10.default.resolve(repoRoot, gitDir);
-      const resolvedCommonDir = import_node_path10.default.isAbsolute(commonDir) ? commonDir : import_node_path10.default.resolve(repoRoot, commonDir);
+      const resolvedGitDir = import_node_path11.default.isAbsolute(gitDir) ? gitDir : import_node_path11.default.resolve(repoRoot, gitDir);
+      const resolvedCommonDir = import_node_path11.default.isAbsolute(commonDir) ? commonDir : import_node_path11.default.resolve(repoRoot, commonDir);
       return { gitDir: resolvedGitDir, commonDir: resolvedCommonDir };
     };
     readHeadState = async (repoRoot) => {
@@ -21859,10 +22015,10 @@ var init_repo2 = __esm({
     mapGlobalGitConfigDestinations = (sources, homeDir) => {
       const mapped = [];
       for (const source of sources) {
-        if (!import_node_path10.default.isAbsolute(source)) continue;
-        if (source === homeDir || source.startsWith(`${homeDir}${import_node_path10.default.sep}`)) {
-          const relative = import_node_path10.default.relative(homeDir, source);
-          const dest = import_node_path10.default.posix.join("/home/sprite", ...relative.split(import_node_path10.default.sep));
+        if (!import_node_path11.default.isAbsolute(source)) continue;
+        if (source === homeDir || source.startsWith(`${homeDir}${import_node_path11.default.sep}`)) {
+          const relative = import_node_path11.default.relative(homeDir, source);
+          const dest = import_node_path11.default.posix.join("/home/sprite", ...relative.split(import_node_path11.default.sep));
           mapped.push({ source, dest });
         }
       }
@@ -21872,12 +22028,12 @@ var init_repo2 = __esm({
 });
 
 // src/devbox/commands/init/packaging.ts
-var import_node_path11, import_promises15, macCopyfileDisabledEnv, runTar, createGitMetaArchive, writePatch, createFileListArchive;
+var import_node_path12, import_promises17, macCopyfileDisabledEnv, runTar, createGitMetaArchive, writePatch, createFileListArchive;
 var init_packaging = __esm({
   "src/devbox/commands/init/packaging.ts"() {
     "use strict";
-    import_node_path11 = __toESM(require("node:path"), 1);
-    import_promises15 = __toESM(require("node:fs/promises"), 1);
+    import_node_path12 = __toESM(require("node:path"), 1);
+    import_promises17 = __toESM(require("node:fs/promises"), 1);
     init_repo2();
     macCopyfileDisabledEnv = process.platform === "darwin" ? { COPYFILE_DISABLE: "1" } : void 0;
     runTar = async (cwd, args) => runCommand2(
@@ -21890,7 +22046,7 @@ var init_packaging = __esm({
       const entries = [];
       const pushIfExists = async (entry) => {
         try {
-          await import_promises15.default.stat(import_node_path11.default.join(gitCommonDir, entry));
+          await import_promises17.default.stat(import_node_path12.default.join(gitCommonDir, entry));
           entries.push(entry);
         } catch {
         }
@@ -21899,25 +22055,25 @@ var init_packaging = __esm({
       await pushIfExists("packed-refs");
       await pushIfExists("logs");
       await pushIfExists("config");
-      await pushIfExists(import_node_path11.default.join("info", "exclude"));
-      await pushIfExists(import_node_path11.default.join("info", "attributes"));
-      await pushIfExists(import_node_path11.default.join("info", "sparse-checkout"));
+      await pushIfExists(import_node_path12.default.join("info", "exclude"));
+      await pushIfExists(import_node_path12.default.join("info", "attributes"));
+      await pushIfExists(import_node_path12.default.join("info", "sparse-checkout"));
       await pushIfExists("modules");
       try {
-        const hooksDir = import_node_path11.default.join(gitCommonDir, "hooks");
-        const hookEntries = await import_promises15.default.readdir(hooksDir);
+        const hooksDir = import_node_path12.default.join(gitCommonDir, "hooks");
+        const hookEntries = await import_promises17.default.readdir(hooksDir);
         for (const entry of hookEntries) {
           if (entry.endsWith(".sample")) continue;
-          const fullPath = import_node_path11.default.join(hooksDir, entry);
-          const stat = await import_promises15.default.stat(fullPath);
+          const fullPath = import_node_path12.default.join(hooksDir, entry);
+          const stat = await import_promises17.default.stat(fullPath);
           if (stat.isFile()) {
-            entries.push(import_node_path11.default.join("hooks", entry));
+            entries.push(import_node_path12.default.join("hooks", entry));
           }
         }
       } catch {
       }
       if (entries.length === 0) return false;
-      await import_promises15.default.writeFile(listPath, `${entries.join("\n")}
+      await import_promises17.default.writeFile(listPath, `${entries.join("\n")}
 `, "utf8");
       await runTar(gitCommonDir, [
         "-czf",
@@ -21932,7 +22088,7 @@ var init_packaging = __esm({
     writePatch = async (repoRoot, args, destPath) => {
       const output = await runCommandRaw(repoRoot, "git", args);
       if (!output.trim()) return false;
-      await import_promises15.default.writeFile(destPath, output, "utf8");
+      await import_promises17.default.writeFile(destPath, output, "utf8");
       return true;
     };
     createFileListArchive = async (repoRoot, files, archivePath, listPath) => {
@@ -21940,13 +22096,13 @@ var init_packaging = __esm({
       const existing = [];
       for (const file of files) {
         try {
-          await import_promises15.default.lstat(import_node_path11.default.join(repoRoot, file));
+          await import_promises17.default.lstat(import_node_path12.default.join(repoRoot, file));
           existing.push(file);
         } catch {
         }
       }
       if (existing.length === 0) return false;
-      await import_promises15.default.writeFile(listPath, `${existing.join("\n")}
+      await import_promises17.default.writeFile(listPath, `${existing.join("\n")}
 `, "utf8");
       await runTar(repoRoot, ["-czf", archivePath, "-C", repoRoot, "-T", listPath]);
       return true;
@@ -21955,29 +22111,39 @@ var init_packaging = __esm({
 });
 
 // src/devbox/commands/init/registry.ts
-var import_node_path12, import_promises16, readRepoMarker, writeRepoMarker, buildCodexConfig, ensureDevboxToml;
+var import_node_path13, import_promises18, readRepoMarker, writeRepoMarker, buildCodexConfig;
 var init_registry2 = __esm({
   "src/devbox/commands/init/registry.ts"() {
     "use strict";
-    import_node_path12 = __toESM(require("node:path"), 1);
-    import_promises16 = __toESM(require("node:fs/promises"), 1);
-    readRepoMarker = async (repoRoot) => {
-      const markerPath = import_node_path12.default.join(repoRoot, ".devbox", "box.json");
+    import_node_path13 = __toESM(require("node:path"), 1);
+    import_promises18 = __toESM(require("node:fs/promises"), 1);
+    readRepoMarker = async (projectDir) => {
+      const markerPath = import_node_path13.default.join(projectDir, "box.json");
       try {
-        const raw = await import_promises16.default.readFile(markerPath, "utf8");
+        const raw = await import_promises18.default.readFile(markerPath, "utf8");
         return JSON.parse(raw);
       } catch {
         return null;
       }
     };
-    writeRepoMarker = async (repoRoot, data) => {
-      const dir = import_node_path12.default.join(repoRoot, ".devbox");
-      await import_promises16.default.mkdir(dir, { recursive: true });
-      const markerPath = import_node_path12.default.join(dir, "box.json");
-      await import_promises16.default.writeFile(markerPath, JSON.stringify(data, null, 2), "utf8");
+    writeRepoMarker = async (projectDir, data) => {
+      await import_promises18.default.mkdir(projectDir, { recursive: true, mode: 448 });
+      try {
+        await import_promises18.default.chmod(projectDir, 448);
+      } catch {
+      }
+      const markerPath = import_node_path13.default.join(projectDir, "box.json");
+      await import_promises18.default.writeFile(markerPath, JSON.stringify(data, null, 2), {
+        encoding: "utf8",
+        mode: 384
+      });
+      try {
+        await import_promises18.default.chmod(markerPath, 384);
+      } catch {
+      }
     };
     buildCodexConfig = (repoName) => {
-      const repoPath = import_node_path12.default.posix.join("/home/sprite", repoName);
+      const repoPath = import_node_path13.default.posix.join("/home/sprite", repoName);
       const lines = [
         'approval_policy = "never"',
         "",
@@ -21994,41 +22160,26 @@ var init_registry2 = __esm({
       ];
       return lines.join("\n");
     };
-    ensureDevboxToml = async (repoRoot, projectName, slug) => {
-      const filePath = import_node_path12.default.join(repoRoot, "devbox.toml");
-      try {
-        await import_promises16.default.access(filePath);
-        return;
-      } catch {
-      }
-      const content = [
-        "[project]",
-        `name = ${JSON.stringify(projectName)}`,
-        `slug = ${JSON.stringify(slug)}`,
-        ""
-      ].join("\n");
-      await import_promises16.default.writeFile(filePath, content, { encoding: "utf8", flag: "wx" });
-    };
   }
 });
 
 // src/devbox/commands/init/scripts.ts
-var import_promises17, import_node_path13, resolveScriptsDir, loadInitScript;
+var import_promises19, import_node_path14, resolveScriptsDir, loadInitScript;
 var init_scripts = __esm({
   "src/devbox/commands/init/scripts.ts"() {
     "use strict";
-    import_promises17 = __toESM(require("node:fs/promises"), 1);
-    import_node_path13 = __toESM(require("node:path"), 1);
+    import_promises19 = __toESM(require("node:fs/promises"), 1);
+    import_node_path14 = __toESM(require("node:path"), 1);
     resolveScriptsDir = () => {
       const binPath = process.argv[1];
       if (binPath) {
-        return import_node_path13.default.resolve(import_node_path13.default.dirname(binPath), "..", "scripts");
+        return import_node_path14.default.resolve(import_node_path14.default.dirname(binPath), "..", "scripts");
       }
-      return import_node_path13.default.resolve(process.cwd(), "scripts");
+      return import_node_path14.default.resolve(process.cwd(), "scripts");
     };
     loadInitScript = async (name) => {
-      const scriptPath = import_node_path13.default.join(resolveScriptsDir(), name);
-      return await import_promises17.default.readFile(scriptPath, "utf8");
+      const scriptPath = import_node_path14.default.join(resolveScriptsDir(), name);
+      return await import_promises19.default.readFile(scriptPath, "utf8");
     };
   }
 });
@@ -22112,21 +22263,21 @@ var init_remote = __esm({
       });
       return result;
     };
-    writeRemoteFile = async (client, canonical, path24, content, stage) => {
+    writeRemoteFile = async (client, canonical, path25, content, stage) => {
       const requestId = (0, import_node_crypto10.randomUUID)();
       logger8.info("sprites_request", {
         requestId,
         method: "writeFile",
-        path: path24,
+        path: path25,
         box: canonical,
         stage
       });
       const buffer = typeof content === "string" ? Buffer.from(content, "utf8") : content;
-      await client.writeFile(canonical, path24, buffer);
+      await client.writeFile(canonical, path25, buffer);
       logger8.info("sprites_response", {
         requestId,
         method: "writeFile",
-        path: path24,
+        path: path25,
         status: "ok",
         box: canonical,
         stage
@@ -22846,12 +22997,12 @@ chmod 755 ${WEZTERM_MUX_RUNNER_PATH}`,
 });
 
 // src/wezterm/installOptions.ts
-var import_node_child_process5, import_promises18, WEZTERM_DARWIN_BIN_PATH, WEZTERM_GITHUB_TIMEOUT_MS, runCommand3, parseWeztermVersion, resolveLocalWeztermVersion, resolveWeztermAssetUrl, resolveWeztermInstallOptions;
+var import_node_child_process5, import_promises20, WEZTERM_DARWIN_BIN_PATH, WEZTERM_GITHUB_TIMEOUT_MS, runCommand3, parseWeztermVersion, resolveLocalWeztermVersion, resolveWeztermAssetUrl, resolveWeztermInstallOptions;
 var init_installOptions = __esm({
   "src/wezterm/installOptions.ts"() {
     "use strict";
     import_node_child_process5 = require("node:child_process");
-    import_promises18 = __toESM(require("node:fs/promises"), 1);
+    import_promises20 = __toESM(require("node:fs/promises"), 1);
     WEZTERM_DARWIN_BIN_PATH = "/Applications/WezTerm.app/Contents/MacOS/wezterm";
     WEZTERM_GITHUB_TIMEOUT_MS = 5e3;
     runCommand3 = async (cmd, args) => new Promise((resolve) => {
@@ -22899,7 +23050,7 @@ var init_installOptions = __esm({
         if (!command) continue;
         if (command.includes("/")) {
           try {
-            await import_promises18.default.access(command);
+            await import_promises20.default.access(command);
           } catch {
             continue;
           }
@@ -23060,12 +23211,12 @@ var init_ensureMux = __esm({
 });
 
 // src/devbox/commands/init/state.ts
-var import_node_path14, import_promises19, INIT_STEP_KEYS, initStatePath, isObject, readInitState, writeInitState;
+var import_node_path15, import_promises21, INIT_STEP_KEYS, initStatePath, isObject3, readInitState, writeInitState;
 var init_state = __esm({
   "src/devbox/commands/init/state.ts"() {
     "use strict";
-    import_node_path14 = __toESM(require("node:path"), 1);
-    import_promises19 = __toESM(require("node:fs/promises"), 1);
+    import_node_path15 = __toESM(require("node:path"), 1);
+    import_promises21 = __toESM(require("node:fs/promises"), 1);
     INIT_STEP_KEYS = [
       "spritesCreated",
       "registrySynced",
@@ -23090,27 +23241,34 @@ var init_state = __esm({
       "weztermMuxServiceEnsured",
       "codexApplied"
     ];
-    initStatePath = (repoRoot) => import_node_path14.default.join(repoRoot, ".devbox", "init-state.json");
-    isObject = (value) => typeof value === "object" && value !== null;
-    readInitState = async (repoRoot) => {
+    initStatePath = (projectDir) => import_node_path15.default.join(projectDir, "init-state.json");
+    isObject3 = (value) => typeof value === "object" && value !== null;
+    readInitState = async (projectDir) => {
       try {
-        const raw = await import_promises19.default.readFile(initStatePath(repoRoot), "utf8");
+        const raw = await import_promises21.default.readFile(initStatePath(projectDir), "utf8");
         const parsed = JSON.parse(raw);
-        if (!isObject(parsed)) return null;
+        if (!isObject3(parsed)) return null;
         if (parsed.version !== 1) return null;
         return parsed;
       } catch {
         return null;
       }
     };
-    writeInitState = async (repoRoot, state) => {
-      const dir = import_node_path14.default.join(repoRoot, ".devbox");
-      await import_promises19.default.mkdir(dir, { recursive: true });
-      await import_promises19.default.writeFile(
-        initStatePath(repoRoot),
-        JSON.stringify(state, null, 2),
-        "utf8"
-      );
+    writeInitState = async (projectDir, state) => {
+      await import_promises21.default.mkdir(projectDir, { recursive: true, mode: 448 });
+      try {
+        await import_promises21.default.chmod(projectDir, 448);
+      } catch {
+      }
+      const statePath = initStatePath(projectDir);
+      await import_promises21.default.writeFile(statePath, JSON.stringify(state, null, 2), {
+        encoding: "utf8",
+        mode: 384
+      });
+      try {
+        await import_promises21.default.chmod(statePath, 384);
+      } catch {
+      }
     };
   }
 });
@@ -23136,7 +23294,7 @@ var init_ssh = __esm({
       }
       return trimmed.replace(/^\/+/, "");
     };
-    buildSshUrl = (host, path24) => `git@${host}:${stripGitSuffix2(path24)}.git`;
+    buildSshUrl = (host, path25) => `git@${host}:${stripGitSuffix2(path25)}.git`;
     buildSettingsUrl = (host) => {
       const lower = host.toLowerCase();
       if (lower.includes("gitlab")) {
@@ -23149,12 +23307,12 @@ var init_ssh = __esm({
       const withoutUser = trimmed.startsWith("git@") ? trimmed.slice("git@".length) : trimmed;
       const [host, pathPart] = withoutUser.split(":");
       if (!host || !pathPart) return null;
-      const path24 = stripGitSuffix2(pathPart);
+      const path25 = stripGitSuffix2(pathPart);
       return {
         host: host.toLowerCase(),
-        path: path24,
+        path: path25,
         protocol: "ssh",
-        sshUrl: buildSshUrl(host, path24),
+        sshUrl: buildSshUrl(host, path25),
         settingsUrl: buildSettingsUrl(host)
       };
     };
@@ -23171,13 +23329,13 @@ var init_ssh = __esm({
         try {
           const url = new URL(trimmed);
           const host = url.hostname;
-          const path24 = stripGitSuffix2(url.pathname);
-          if (!host || !path24) return null;
+          const path25 = stripGitSuffix2(url.pathname);
+          if (!host || !path25) return null;
           return {
             host: host.toLowerCase(),
-            path: path24,
+            path: path25,
             protocol: "ssh",
-            sshUrl: buildSshUrl(host, path24),
+            sshUrl: buildSshUrl(host, path25),
             settingsUrl: buildSettingsUrl(host)
           };
         } catch {
@@ -23188,13 +23346,13 @@ var init_ssh = __esm({
         try {
           const url = new URL(trimmed);
           const host = url.hostname;
-          const path24 = stripGitSuffix2(url.pathname);
-          if (!host || !path24) return null;
+          const path25 = stripGitSuffix2(url.pathname);
+          if (!host || !path25) return null;
           return {
             host: host.toLowerCase(),
-            path: path24,
+            path: path25,
             protocol: "https",
-            sshUrl: buildSshUrl(host, path24),
+            sshUrl: buildSshUrl(host, path25),
             settingsUrl: buildSettingsUrl(host)
           };
         } catch {
@@ -23416,19 +23574,19 @@ ${sshResult.stderr}`.trim();
 });
 
 // src/devbox/commands/mountSsh.ts
-var import_node_child_process7, import_promises20, import_node_os7, import_node_path15, DEVBOX_SSH_DIR, MOUNT_KEY_PATH, MOUNT_PUBLIC_KEY_PATH, KNOWN_HOSTS_PATH, REMOTE_SSH_DIR, REMOTE_AUTH_KEYS, REMOTE_SSHD_CONFIG, SSHD_SERVICE_NAME, runCommand4, ensureDevboxSshDir, ensureKnownHostsFile, ensureLocalMountKey, readLocalMountPublicKey, buildSshdConfig, ensureRemoteMountAccess, ensureSshdService;
+var import_node_child_process7, import_promises22, import_node_os6, import_node_path16, DEVBOX_SSH_DIR, MOUNT_KEY_PATH, MOUNT_PUBLIC_KEY_PATH, KNOWN_HOSTS_PATH, REMOTE_SSH_DIR, REMOTE_AUTH_KEYS, REMOTE_SSHD_CONFIG, SSHD_SERVICE_NAME, runCommand4, ensureDevboxSshDir, ensureKnownHostsFile, ensureLocalMountKey, readLocalMountPublicKey, buildSshdConfig, ensureRemoteMountAccess, ensureSshdService;
 var init_mountSsh = __esm({
   "src/devbox/commands/mountSsh.ts"() {
     "use strict";
     import_node_child_process7 = require("node:child_process");
-    import_promises20 = __toESM(require("node:fs/promises"), 1);
-    import_node_os7 = __toESM(require("node:os"), 1);
-    import_node_path15 = __toESM(require("node:path"), 1);
+    import_promises22 = __toESM(require("node:fs/promises"), 1);
+    import_node_os6 = __toESM(require("node:os"), 1);
+    import_node_path16 = __toESM(require("node:path"), 1);
     init_src();
-    DEVBOX_SSH_DIR = import_node_path15.default.join(resolveDevboxDir(), "ssh");
-    MOUNT_KEY_PATH = import_node_path15.default.join(DEVBOX_SSH_DIR, "mount_ed25519");
+    DEVBOX_SSH_DIR = import_node_path16.default.join(resolveDevboxDir(), "ssh");
+    MOUNT_KEY_PATH = import_node_path16.default.join(DEVBOX_SSH_DIR, "mount_ed25519");
     MOUNT_PUBLIC_KEY_PATH = `${MOUNT_KEY_PATH}.pub`;
-    KNOWN_HOSTS_PATH = import_node_path15.default.join(DEVBOX_SSH_DIR, "known_hosts");
+    KNOWN_HOSTS_PATH = import_node_path16.default.join(DEVBOX_SSH_DIR, "known_hosts");
     REMOTE_SSH_DIR = "/home/sprite/.devbox/ssh";
     REMOTE_AUTH_KEYS = `${REMOTE_SSH_DIR}/authorized_keys`;
     REMOTE_SSHD_CONFIG = `${REMOTE_SSH_DIR}/sshd_config`;
@@ -23442,24 +23600,24 @@ var init_mountSsh = __esm({
       child.on("exit", (code2) => resolve(code2 ?? 0));
     });
     ensureDevboxSshDir = async () => {
-      await import_promises20.default.mkdir(DEVBOX_SSH_DIR, { recursive: true, mode: 448 });
+      await import_promises22.default.mkdir(DEVBOX_SSH_DIR, { recursive: true, mode: 448 });
     };
     ensureKnownHostsFile = async () => {
       await ensureDevboxSshDir();
-      await import_promises20.default.writeFile(KNOWN_HOSTS_PATH, "", { flag: "a" });
+      await import_promises22.default.writeFile(KNOWN_HOSTS_PATH, "", { flag: "a" });
       return KNOWN_HOSTS_PATH;
     };
     ensureLocalMountKey = async () => {
       await ensureDevboxSshDir();
       try {
-        await import_promises20.default.access(MOUNT_KEY_PATH);
-        await import_promises20.default.access(MOUNT_PUBLIC_KEY_PATH);
+        await import_promises22.default.access(MOUNT_KEY_PATH);
+        await import_promises22.default.access(MOUNT_PUBLIC_KEY_PATH);
         return {
           privateKeyPath: MOUNT_KEY_PATH,
           publicKeyPath: MOUNT_PUBLIC_KEY_PATH
         };
       } catch {
-        const comment = `devbox-mount@${import_node_os7.default.hostname()}`;
+        const comment = `devbox-mount@${import_node_os6.default.hostname()}`;
         const exitCode = await runCommand4("ssh-keygen", [
           "-t",
           "ed25519",
@@ -23480,7 +23638,7 @@ var init_mountSsh = __esm({
       };
     };
     readLocalMountPublicKey = async () => {
-      const raw = await import_promises20.default.readFile(MOUNT_PUBLIC_KEY_PATH, "utf8");
+      const raw = await import_promises22.default.readFile(MOUNT_PUBLIC_KEY_PATH, "utf8");
       const trimmed = raw.trim();
       if (!trimmed) {
         throw new Error("Mount public key is empty.");
@@ -23620,23 +23778,23 @@ var init_template = __esm({
 });
 
 // src/devbox/commands/init/codex/prompts.ts
-var import_promises21, import_node_path16, resolvePromptsDir, readPromptTemplate, loadPrompt, loadLocalEnvSecretsScanPrompt, loadLocalExternalScanPrompt, loadLocalExtraArtifactsScanPrompt, loadLocalServicesScanPrompt;
+var import_promises23, import_node_path17, resolvePromptsDir, readPromptTemplate, loadPrompt, loadLocalEnvSecretsScanPrompt, loadLocalExternalScanPrompt, loadLocalExtraArtifactsScanPrompt, loadLocalServicesScanPrompt;
 var init_prompts = __esm({
   "src/devbox/commands/init/codex/prompts.ts"() {
     "use strict";
-    import_promises21 = __toESM(require("node:fs/promises"), 1);
-    import_node_path16 = __toESM(require("node:path"), 1);
+    import_promises23 = __toESM(require("node:fs/promises"), 1);
+    import_node_path17 = __toESM(require("node:path"), 1);
     init_template();
     resolvePromptsDir = () => {
       const binPath = process.argv[1];
       if (binPath) {
-        return import_node_path16.default.resolve(import_node_path16.default.dirname(binPath), "..", "prompts");
+        return import_node_path17.default.resolve(import_node_path17.default.dirname(binPath), "..", "prompts");
       }
-      return import_node_path16.default.resolve(process.cwd(), "prompts");
+      return import_node_path17.default.resolve(process.cwd(), "prompts");
     };
     readPromptTemplate = async (name) => {
-      const promptPath = import_node_path16.default.join(resolvePromptsDir(), name);
-      const raw = await import_promises21.default.readFile(promptPath, "utf8");
+      const promptPath = import_node_path17.default.join(resolvePromptsDir(), name);
+      const raw = await import_promises23.default.readFile(promptPath, "utf8");
       return raw;
     };
     loadPrompt = async (name, vars = {}) => renderTemplate(await readPromptTemplate(name), vars).trim();
@@ -24152,75 +24310,75 @@ fi`
 });
 
 // src/devbox/commands/init/codex/plan.ts
-var import_node_path17, import_promises22, resolveSchemaPath, writeSetupEnvSecretsSchema, writeSetupExternalSchema, writeSetupExtraArtifactsSchema, writeServicesSchema, isObject2, isSetupPlan, isSetupEnvSecretsPlan, isSetupExternalPlan, isSetupExtraArtifactsPlan, isServicesPlan, readSetupPlan, readSetupEnvSecretsPlan, readSetupExternalPlan, readSetupExtraArtifactsPlan, readServicesPlan, writeSetupPlan, mergeSetupScans, writeServicesPlan;
+var import_node_path18, import_promises24, resolveSchemaPath, writeSetupEnvSecretsSchema, writeSetupExternalSchema, writeSetupExtraArtifactsSchema, writeServicesSchema, isObject4, isSetupPlan, isSetupEnvSecretsPlan, isSetupExternalPlan, isSetupExtraArtifactsPlan, isServicesPlan, readSetupPlan, readSetupEnvSecretsPlan, readSetupExternalPlan, readSetupExtraArtifactsPlan, readServicesPlan, writeSetupPlan, mergeSetupScans, writeServicesPlan;
 var init_plan = __esm({
   "src/devbox/commands/init/codex/plan.ts"() {
     "use strict";
-    import_node_path17 = __toESM(require("node:path"), 1);
-    import_promises22 = __toESM(require("node:fs/promises"), 1);
+    import_node_path18 = __toESM(require("node:path"), 1);
+    import_promises24 = __toESM(require("node:fs/promises"), 1);
     resolveSchemaPath = (fileName) => {
       const binPath = process.argv[1];
       if (binPath) {
-        return import_node_path17.default.resolve(
-          import_node_path17.default.dirname(binPath),
+        return import_node_path18.default.resolve(
+          import_node_path18.default.dirname(binPath),
           "..",
           "codex",
           fileName
         );
       }
-      return import_node_path17.default.resolve(process.cwd(), "codex", fileName);
+      return import_node_path18.default.resolve(process.cwd(), "codex", fileName);
     };
     writeSetupEnvSecretsSchema = async (dir) => {
       const sourceSchemaPath = resolveSchemaPath("setup-env-secrets-schema.json");
-      const schemaContents = await import_promises22.default.readFile(sourceSchemaPath, "utf8");
-      const schemaPath = import_node_path17.default.join(dir, "setup-env-secrets-schema.json");
-      await import_promises22.default.writeFile(schemaPath, schemaContents, "utf8");
+      const schemaContents = await import_promises24.default.readFile(sourceSchemaPath, "utf8");
+      const schemaPath = import_node_path18.default.join(dir, "setup-env-secrets-schema.json");
+      await import_promises24.default.writeFile(schemaPath, schemaContents, "utf8");
       return schemaPath;
     };
     writeSetupExternalSchema = async (dir) => {
       const sourceSchemaPath = resolveSchemaPath("setup-external-schema.json");
-      const schemaContents = await import_promises22.default.readFile(sourceSchemaPath, "utf8");
-      const schemaPath = import_node_path17.default.join(dir, "setup-external-schema.json");
-      await import_promises22.default.writeFile(schemaPath, schemaContents, "utf8");
+      const schemaContents = await import_promises24.default.readFile(sourceSchemaPath, "utf8");
+      const schemaPath = import_node_path18.default.join(dir, "setup-external-schema.json");
+      await import_promises24.default.writeFile(schemaPath, schemaContents, "utf8");
       return schemaPath;
     };
     writeSetupExtraArtifactsSchema = async (dir) => {
       const sourceSchemaPath = resolveSchemaPath("setup-extra-artifacts-schema.json");
-      const schemaContents = await import_promises22.default.readFile(sourceSchemaPath, "utf8");
-      const schemaPath = import_node_path17.default.join(dir, "setup-extra-artifacts-schema.json");
-      await import_promises22.default.writeFile(schemaPath, schemaContents, "utf8");
+      const schemaContents = await import_promises24.default.readFile(sourceSchemaPath, "utf8");
+      const schemaPath = import_node_path18.default.join(dir, "setup-extra-artifacts-schema.json");
+      await import_promises24.default.writeFile(schemaPath, schemaContents, "utf8");
       return schemaPath;
     };
     writeServicesSchema = async (dir) => {
       const sourceSchemaPath = resolveSchemaPath("services-schema.json");
-      const schemaContents = await import_promises22.default.readFile(sourceSchemaPath, "utf8");
-      const schemaPath = import_node_path17.default.join(dir, "services-schema.json");
-      await import_promises22.default.writeFile(schemaPath, schemaContents, "utf8");
+      const schemaContents = await import_promises24.default.readFile(sourceSchemaPath, "utf8");
+      const schemaPath = import_node_path18.default.join(dir, "services-schema.json");
+      await import_promises24.default.writeFile(schemaPath, schemaContents, "utf8");
       return schemaPath;
     };
-    isObject2 = (value) => typeof value === "object" && value !== null;
+    isObject4 = (value) => typeof value === "object" && value !== null;
     isSetupPlan = (value) => {
-      if (!isObject2(value)) return false;
+      if (!isObject4(value)) return false;
       return typeof value.schemaVersion === "number" && Array.isArray(value.envFiles) && Array.isArray(value.secretFiles) && Array.isArray(value.extraArtifacts) && Array.isArray(value.externalDependencies) && Array.isArray(value.externalConfigs);
     };
     isSetupEnvSecretsPlan = (value) => {
-      if (!isObject2(value)) return false;
+      if (!isObject4(value)) return false;
       return typeof value.schemaVersion === "number" && typeof value.scanFullyCompleted === "boolean" && Array.isArray(value.envFiles) && Array.isArray(value.secretFiles);
     };
     isSetupExternalPlan = (value) => {
-      if (!isObject2(value)) return false;
+      if (!isObject4(value)) return false;
       return typeof value.schemaVersion === "number" && typeof value.scanFullyCompleted === "boolean" && Array.isArray(value.externalDependencies) && Array.isArray(value.externalConfigs);
     };
     isSetupExtraArtifactsPlan = (value) => {
-      if (!isObject2(value)) return false;
+      if (!isObject4(value)) return false;
       return typeof value.schemaVersion === "number" && typeof value.scanFullyCompleted === "boolean" && Array.isArray(value.extraArtifacts);
     };
     isServicesPlan = (value) => {
-      if (!isObject2(value)) return false;
+      if (!isObject4(value)) return false;
       return typeof value.schemaVersion === "number" && typeof value.scanFullyCompleted === "boolean" && Array.isArray(value.appEntrypoints) && Array.isArray(value.backgroundServices);
     };
     readSetupPlan = async (setupPath) => {
-      const raw = await import_promises22.default.readFile(setupPath, "utf8");
+      const raw = await import_promises24.default.readFile(setupPath, "utf8");
       const parsed = JSON.parse(raw);
       if (!isSetupPlan(parsed)) {
         throw new Error(`Invalid setup plan: ${setupPath}`);
@@ -24228,7 +24386,7 @@ var init_plan = __esm({
       return parsed;
     };
     readSetupEnvSecretsPlan = async (scanPath) => {
-      const raw = await import_promises22.default.readFile(scanPath, "utf8");
+      const raw = await import_promises24.default.readFile(scanPath, "utf8");
       const parsed = JSON.parse(raw);
       if (!isSetupEnvSecretsPlan(parsed)) {
         throw new Error(`Invalid env/secrets scan: ${scanPath}`);
@@ -24236,7 +24394,7 @@ var init_plan = __esm({
       return parsed;
     };
     readSetupExternalPlan = async (scanPath) => {
-      const raw = await import_promises22.default.readFile(scanPath, "utf8");
+      const raw = await import_promises24.default.readFile(scanPath, "utf8");
       const parsed = JSON.parse(raw);
       if (!isSetupExternalPlan(parsed)) {
         throw new Error(`Invalid external scan: ${scanPath}`);
@@ -24244,7 +24402,7 @@ var init_plan = __esm({
       return parsed;
     };
     readSetupExtraArtifactsPlan = async (scanPath) => {
-      const raw = await import_promises22.default.readFile(scanPath, "utf8");
+      const raw = await import_promises24.default.readFile(scanPath, "utf8");
       const parsed = JSON.parse(raw);
       if (!isSetupExtraArtifactsPlan(parsed)) {
         throw new Error(`Invalid extra artifacts scan: ${scanPath}`);
@@ -24252,7 +24410,7 @@ var init_plan = __esm({
       return parsed;
     };
     readServicesPlan = async (servicesPath) => {
-      const raw = await import_promises22.default.readFile(servicesPath, "utf8");
+      const raw = await import_promises24.default.readFile(servicesPath, "utf8");
       const parsed = JSON.parse(raw);
       if (!isServicesPlan(parsed)) {
         throw new Error(`Invalid services plan: ${servicesPath}`);
@@ -24260,7 +24418,7 @@ var init_plan = __esm({
       return parsed;
     };
     writeSetupPlan = async (setupPath, plan) => {
-      await import_promises22.default.writeFile(setupPath, JSON.stringify(plan, null, 2), "utf8");
+      await import_promises24.default.writeFile(setupPath, JSON.stringify(plan, null, 2), "utf8");
     };
     mergeSetupScans = ({
       envSecrets,
@@ -24308,7 +24466,7 @@ var init_plan = __esm({
       };
     };
     writeServicesPlan = async (servicesPath, plan) => {
-      await import_promises22.default.writeFile(servicesPath, JSON.stringify(plan, null, 2), "utf8");
+      await import_promises24.default.writeFile(servicesPath, JSON.stringify(plan, null, 2), "utf8");
     };
   }
 });
@@ -24453,14 +24611,14 @@ ${bottom}
 });
 
 // src/devbox/commands/init/codex/local.ts
-var import_node_child_process9, import_node_fs3, import_promises23, import_node_path18, stripAnsi3, extractBoldText2, runCodexExec, runLocalSetupEnvSecretsScan, runLocalSetupExternalScan, runLocalSetupExtraArtifactsScan, runLocalServicesScan, toPosixPath, toRepoRelativePath, countSecretVars, buildEnvFileHint, buildExternalDependencyLabel, promptForPlanApproval, promptForServicesApproval;
+var import_node_child_process9, import_node_fs3, import_promises25, import_node_path19, stripAnsi3, extractBoldText2, runCodexExec, runLocalSetupEnvSecretsScan, runLocalSetupExternalScan, runLocalSetupExtraArtifactsScan, runLocalServicesScan, toPosixPath, toRepoRelativePath, countSecretVars, buildEnvFileHint, buildExternalDependencyLabel, promptForPlanApproval, promptForServicesApproval;
 var init_local = __esm({
   "src/devbox/commands/init/codex/local.ts"() {
     "use strict";
     import_node_child_process9 = require("node:child_process");
     import_node_fs3 = require("node:fs");
-    import_promises23 = __toESM(require("node:fs/promises"), 1);
-    import_node_path18 = __toESM(require("node:path"), 1);
+    import_promises25 = __toESM(require("node:fs/promises"), 1);
+    import_node_path19 = __toESM(require("node:path"), 1);
     init_dist2();
     init_prompts();
     init_clack();
@@ -24476,11 +24634,11 @@ var init_local = __esm({
       let stderrStream = null;
       try {
         if (stdoutLogPath) {
-          await import_promises23.default.mkdir(import_node_path18.default.dirname(stdoutLogPath), { recursive: true });
+          await import_promises25.default.mkdir(import_node_path19.default.dirname(stdoutLogPath), { recursive: true });
           stdoutStream = (0, import_node_fs3.createWriteStream)(stdoutLogPath, { flags: "a" });
         }
         if (stderrLogPath) {
-          await import_promises23.default.mkdir(import_node_path18.default.dirname(stderrLogPath), { recursive: true });
+          await import_promises25.default.mkdir(import_node_path19.default.dirname(stderrLogPath), { recursive: true });
           stderrStream = (0, import_node_fs3.createWriteStream)(stderrLogPath, { flags: "a" });
         }
       } catch {
@@ -24556,34 +24714,39 @@ var init_local = __esm({
     };
     runLocalSetupEnvSecretsScan = async ({
       cwd,
+      logDir,
       schemaPath,
       outputPath,
       onProgress
     }) => {
       const localScanPrompt = await loadLocalEnvSecretsScanPrompt();
       const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-      const logDir = import_node_path18.default.join(cwd, ".devbox", "logs");
-      const stdoutLogPath = import_node_path18.default.join(
+      const stdoutLogPath = import_node_path19.default.join(
         logDir,
         `codex-local-setup-env-secrets-scan-${stamp}.jsonl`
       );
-      const stderrLogPath = import_node_path18.default.join(
+      const stderrLogPath = import_node_path19.default.join(
         logDir,
         `codex-local-setup-env-secrets-scan-${stamp}.stderr.log`
       );
-      const metaLogPath = import_node_path18.default.join(
+      const metaLogPath = import_node_path19.default.join(
         logDir,
         `codex-local-setup-env-secrets-scan-${stamp}.meta.json`
       );
-      await import_promises23.default.mkdir(logDir, { recursive: true });
-      await import_promises23.default.mkdir(import_node_path18.default.dirname(outputPath), { recursive: true });
-      await import_promises23.default.writeFile(
+      await import_promises25.default.mkdir(logDir, { recursive: true, mode: 448 });
+      try {
+        await import_promises25.default.chmod(logDir, 448);
+      } catch {
+      }
+      await import_promises25.default.mkdir(import_node_path19.default.dirname(outputPath), { recursive: true });
+      await import_promises25.default.writeFile(
         metaLogPath,
         JSON.stringify(
           {
             kind: "local-setup-env-secrets-scan",
             createdAt: (/* @__PURE__ */ new Date()).toISOString(),
             cwd,
+            logDir,
             schemaPath,
             outputPath,
             prompt: localScanPrompt
@@ -24607,6 +24770,7 @@ var init_local = __esm({
     };
     runLocalSetupExternalScan = async ({
       cwd,
+      logDir,
       schemaPath,
       outputPath,
       homeDir,
@@ -24614,28 +24778,32 @@ var init_local = __esm({
     }) => {
       const localScanPrompt = await loadLocalExternalScanPrompt();
       const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-      const logDir = import_node_path18.default.join(cwd, ".devbox", "logs");
-      const stdoutLogPath = import_node_path18.default.join(
+      const stdoutLogPath = import_node_path19.default.join(
         logDir,
         `codex-local-setup-external-scan-${stamp}.jsonl`
       );
-      const stderrLogPath = import_node_path18.default.join(
+      const stderrLogPath = import_node_path19.default.join(
         logDir,
         `codex-local-setup-external-scan-${stamp}.stderr.log`
       );
-      const metaLogPath = import_node_path18.default.join(
+      const metaLogPath = import_node_path19.default.join(
         logDir,
         `codex-local-setup-external-scan-${stamp}.meta.json`
       );
-      await import_promises23.default.mkdir(logDir, { recursive: true });
-      await import_promises23.default.mkdir(import_node_path18.default.dirname(outputPath), { recursive: true });
-      await import_promises23.default.writeFile(
+      await import_promises25.default.mkdir(logDir, { recursive: true, mode: 448 });
+      try {
+        await import_promises25.default.chmod(logDir, 448);
+      } catch {
+      }
+      await import_promises25.default.mkdir(import_node_path19.default.dirname(outputPath), { recursive: true });
+      await import_promises25.default.writeFile(
         metaLogPath,
         JSON.stringify(
           {
             kind: "local-setup-external-scan",
             createdAt: (/* @__PURE__ */ new Date()).toISOString(),
             cwd,
+            logDir,
             schemaPath,
             outputPath,
             prompt: localScanPrompt
@@ -24660,34 +24828,39 @@ var init_local = __esm({
     };
     runLocalSetupExtraArtifactsScan = async ({
       cwd,
+      logDir,
       schemaPath,
       outputPath,
       onProgress
     }) => {
       const localScanPrompt = await loadLocalExtraArtifactsScanPrompt();
       const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-      const logDir = import_node_path18.default.join(cwd, ".devbox", "logs");
-      const stdoutLogPath = import_node_path18.default.join(
+      const stdoutLogPath = import_node_path19.default.join(
         logDir,
         `codex-local-setup-extra-artifacts-scan-${stamp}.jsonl`
       );
-      const stderrLogPath = import_node_path18.default.join(
+      const stderrLogPath = import_node_path19.default.join(
         logDir,
         `codex-local-setup-extra-artifacts-scan-${stamp}.stderr.log`
       );
-      const metaLogPath = import_node_path18.default.join(
+      const metaLogPath = import_node_path19.default.join(
         logDir,
         `codex-local-setup-extra-artifacts-scan-${stamp}.meta.json`
       );
-      await import_promises23.default.mkdir(logDir, { recursive: true });
-      await import_promises23.default.mkdir(import_node_path18.default.dirname(outputPath), { recursive: true });
-      await import_promises23.default.writeFile(
+      await import_promises25.default.mkdir(logDir, { recursive: true, mode: 448 });
+      try {
+        await import_promises25.default.chmod(logDir, 448);
+      } catch {
+      }
+      await import_promises25.default.mkdir(import_node_path19.default.dirname(outputPath), { recursive: true });
+      await import_promises25.default.writeFile(
         metaLogPath,
         JSON.stringify(
           {
             kind: "local-setup-extra-artifacts-scan",
             createdAt: (/* @__PURE__ */ new Date()).toISOString(),
             cwd,
+            logDir,
             schemaPath,
             outputPath,
             prompt: localScanPrompt
@@ -24711,6 +24884,7 @@ var init_local = __esm({
     };
     runLocalServicesScan = async ({
       cwd,
+      logDir,
       schemaPath,
       outputPath,
       homeDir,
@@ -24718,27 +24892,31 @@ var init_local = __esm({
     }) => {
       const servicesScanPrompt = await loadLocalServicesScanPrompt();
       const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-      const logDir = import_node_path18.default.join(cwd, ".devbox", "logs");
-      const stdoutLogPath = import_node_path18.default.join(
+      const stdoutLogPath = import_node_path19.default.join(
         logDir,
         `codex-local-services-scan-${stamp}.jsonl`
       );
-      const stderrLogPath = import_node_path18.default.join(
+      const stderrLogPath = import_node_path19.default.join(
         logDir,
         `codex-local-services-scan-${stamp}.stderr.log`
       );
-      const metaLogPath = import_node_path18.default.join(
+      const metaLogPath = import_node_path19.default.join(
         logDir,
         `codex-local-services-scan-${stamp}.meta.json`
       );
-      await import_promises23.default.mkdir(logDir, { recursive: true });
-      await import_promises23.default.writeFile(
+      await import_promises25.default.mkdir(logDir, { recursive: true, mode: 448 });
+      try {
+        await import_promises25.default.chmod(logDir, 448);
+      } catch {
+      }
+      await import_promises25.default.writeFile(
         metaLogPath,
         JSON.stringify(
           {
             kind: "local-services-scan",
             createdAt: (/* @__PURE__ */ new Date()).toISOString(),
             cwd,
+            logDir,
             schemaPath,
             outputPath,
             prompt: servicesScanPrompt
@@ -24761,10 +24939,10 @@ var init_local = __esm({
       ];
       await runCodexExec(cwd, args, onProgress, { stdoutLogPath, stderrLogPath });
     };
-    toPosixPath = (value) => value.split(import_node_path18.default.sep).join(import_node_path18.default.posix.sep);
+    toPosixPath = (value) => value.split(import_node_path19.default.sep).join(import_node_path19.default.posix.sep);
     toRepoRelativePath = (repoRoot, filePath) => {
-      const resolved = import_node_path18.default.isAbsolute(filePath) ? filePath : import_node_path18.default.resolve(repoRoot, filePath);
-      const relative = import_node_path18.default.relative(repoRoot, resolved) || filePath;
+      const resolved = import_node_path19.default.isAbsolute(filePath) ? filePath : import_node_path19.default.resolve(repoRoot, filePath);
+      const relative = import_node_path19.default.relative(repoRoot, resolved) || filePath;
       return toPosixPath(relative);
     };
     countSecretVars = (vars) => vars.reduce((count, entry) => count + (entry.isSecret ? 1 : 0), 0);
@@ -24927,38 +25105,38 @@ ${usageText}`;
 });
 
 // src/devbox/commands/init/codex/artifacts.ts
-var import_promises24, import_node_path19, import_node_os8, macCopyfileDisabledEnv2, isWithinRepo, normalizeExternalPath, expandHomePath, buildArtifactEntry, buildEntries, copyArtifact, createSetupArtifacts;
+var import_promises26, import_node_path20, import_node_os7, macCopyfileDisabledEnv2, isWithinRepo, normalizeExternalPath, expandHomePath, buildArtifactEntry, buildEntries, copyArtifact, createSetupArtifacts;
 var init_artifacts = __esm({
   "src/devbox/commands/init/codex/artifacts.ts"() {
     "use strict";
-    import_promises24 = __toESM(require("node:fs/promises"), 1);
-    import_node_path19 = __toESM(require("node:path"), 1);
-    import_node_os8 = __toESM(require("node:os"), 1);
+    import_promises26 = __toESM(require("node:fs/promises"), 1);
+    import_node_path20 = __toESM(require("node:path"), 1);
+    import_node_os7 = __toESM(require("node:os"), 1);
     init_repo2();
     macCopyfileDisabledEnv2 = process.platform === "darwin" ? { COPYFILE_DISABLE: "1" } : void 0;
     isWithinRepo = (repoRoot, candidate) => {
-      const relative = import_node_path19.default.relative(repoRoot, candidate);
-      return relative && !relative.startsWith("..") && !import_node_path19.default.isAbsolute(relative);
+      const relative = import_node_path20.default.relative(repoRoot, candidate);
+      return relative && !relative.startsWith("..") && !import_node_path20.default.isAbsolute(relative);
     };
     normalizeExternalPath = (value) => value.replace(/^([A-Za-z]:)?[\\/]+/, "");
     expandHomePath = (value, homeDir) => {
       if (!value.startsWith("~")) return value;
-      const home = homeDir ?? import_node_os8.default.homedir();
+      const home = homeDir ?? import_node_os7.default.homedir();
       if (!home) return value;
       if (value === "~") return home;
       if (value.startsWith("~/") || value.startsWith("~\\")) {
-        return import_node_path19.default.join(home, value.slice(2));
+        return import_node_path20.default.join(home, value.slice(2));
       }
       return value;
     };
     buildArtifactEntry = (repoRoot, kind, name, artifactPath, homeDir, description, vars, usage2) => {
       const expanded = expandHomePath(artifactPath, homeDir);
-      const resolved = import_node_path19.default.isAbsolute(expanded) ? expanded : import_node_path19.default.resolve(repoRoot, expanded);
+      const resolved = import_node_path20.default.isAbsolute(expanded) ? expanded : import_node_path20.default.resolve(repoRoot, expanded);
       const base = {
         kind,
         name,
         sourcePath: resolved,
-        bundlePath: isWithinRepo(repoRoot, resolved) ? import_node_path19.default.join("repo", import_node_path19.default.relative(repoRoot, resolved)) : import_node_path19.default.join("external", normalizeExternalPath(import_node_path19.default.resolve(resolved)))
+        bundlePath: isWithinRepo(repoRoot, resolved) ? import_node_path20.default.join("repo", import_node_path20.default.relative(repoRoot, resolved)) : import_node_path20.default.join("external", normalizeExternalPath(import_node_path20.default.resolve(resolved)))
       };
       if (description !== void 0) {
         base.description = description;
@@ -25026,14 +25204,14 @@ var init_artifacts = __esm({
       return entries;
     };
     copyArtifact = async (entry, bundleRoot) => {
-      const destPath = import_node_path19.default.join(bundleRoot, entry.bundlePath);
-      const stat = await import_promises24.default.lstat(entry.sourcePath);
-      await import_promises24.default.mkdir(import_node_path19.default.dirname(destPath), { recursive: true });
+      const destPath = import_node_path20.default.join(bundleRoot, entry.bundlePath);
+      const stat = await import_promises26.default.lstat(entry.sourcePath);
+      await import_promises26.default.mkdir(import_node_path20.default.dirname(destPath), { recursive: true });
       if (stat.isDirectory()) {
-        await import_promises24.default.cp(entry.sourcePath, destPath, { recursive: true });
+        await import_promises26.default.cp(entry.sourcePath, destPath, { recursive: true });
         return;
       }
-      await import_promises24.default.cp(entry.sourcePath, destPath, { recursive: false });
+      await import_promises26.default.cp(entry.sourcePath, destPath, { recursive: false });
     };
     createSetupArtifacts = async ({
       repoRoot,
@@ -25044,8 +25222,8 @@ var init_artifacts = __esm({
     }) => {
       const entries = buildEntries(repoRoot, plan, homeDir);
       if (entries.length === 0) return null;
-      const bundleRoot = import_node_path19.default.join(tempDir, "setup-artifacts");
-      await import_promises24.default.mkdir(bundleRoot, { recursive: true });
+      const bundleRoot = import_node_path20.default.join(tempDir, "setup-artifacts");
+      await import_promises26.default.mkdir(bundleRoot, { recursive: true });
       for (const entry of entries) {
         await copyArtifact(entry, bundleRoot);
       }
@@ -25060,19 +25238,19 @@ var init_artifacts = __esm({
           usage: entry.usage ?? null
         }))
       };
-      const manifestPath = import_node_path19.default.join(tempDir, "setup-artifacts.json");
-      await import_promises24.default.writeFile(manifestPath, JSON.stringify(manifest, null, 2), "utf8");
-      const bundlePath = import_node_path19.default.join(tempDir, "setup-artifacts.tgz");
+      const manifestPath = import_node_path20.default.join(tempDir, "setup-artifacts.json");
+      await import_promises26.default.writeFile(manifestPath, JSON.stringify(manifest, null, 2), "utf8");
+      const bundlePath = import_node_path20.default.join(tempDir, "setup-artifacts.tgz");
       await runCommand2(
         bundleRoot,
         "tar",
         ["-czf", bundlePath, "-C", bundleRoot, "."],
         macCopyfileDisabledEnv2 ? { env: macCopyfileDisabledEnv2 } : void 0
       );
-      const finalBundle = import_node_path19.default.join(outputDir, "setup-artifacts.tgz");
-      const finalManifest = import_node_path19.default.join(outputDir, "setup-artifacts.json");
-      await import_promises24.default.copyFile(bundlePath, finalBundle);
-      await import_promises24.default.copyFile(manifestPath, finalManifest);
+      const finalBundle = import_node_path20.default.join(outputDir, "setup-artifacts.tgz");
+      const finalManifest = import_node_path20.default.join(outputDir, "setup-artifacts.json");
+      await import_promises26.default.copyFile(bundlePath, finalBundle);
+      await import_promises26.default.copyFile(manifestPath, finalManifest);
       return {
         bundlePath: finalBundle,
         manifestPath: finalManifest,
@@ -25083,13 +25261,13 @@ var init_artifacts = __esm({
 });
 
 // src/devbox/commands/init/codex/index.ts
-var import_node_path20, import_promises25, import_node_os9, resolveLocalCodexRoot, readLocalCodexAuthCache, syncLocalCodexAuthCacheToSprite, uploadSetupPlan, runRemoteCodexSetup;
+var import_node_path21, import_promises27, import_node_os8, resolveLocalCodexRoot, readLocalCodexAuthCache, syncLocalCodexAuthCacheToSprite, uploadSetupPlan, runRemoteCodexSetup;
 var init_codex = __esm({
   "src/devbox/commands/init/codex/index.ts"() {
     "use strict";
-    import_node_path20 = __toESM(require("node:path"), 1);
-    import_promises25 = __toESM(require("node:fs/promises"), 1);
-    import_node_os9 = require("node:os");
+    import_node_path21 = __toESM(require("node:path"), 1);
+    import_promises27 = __toESM(require("node:fs/promises"), 1);
+    import_node_os8 = require("node:os");
     init_dist2();
     init_src();
     init_daemonClient();
@@ -25100,12 +25278,12 @@ var init_codex = __esm({
     init_artifacts();
     resolveLocalCodexRoot = () => {
       const configured = (process.env.CODEX_HOME ?? "").trim();
-      return configured || import_node_path20.default.join((0, import_node_os9.homedir)(), ".codex");
+      return configured || import_node_path21.default.join((0, import_node_os8.homedir)(), ".codex");
     };
     readLocalCodexAuthCache = async () => {
-      const authPath = import_node_path20.default.join(resolveLocalCodexRoot(), "auth.json");
+      const authPath = import_node_path21.default.join(resolveLocalCodexRoot(), "auth.json");
       try {
-        return await import_promises25.default.readFile(authPath);
+        return await import_promises27.default.readFile(authPath);
       } catch {
         return null;
       }
@@ -25178,7 +25356,7 @@ var init_codex = __esm({
         "-o",
         "pipefail",
         "-c",
-        `mkdir -p ${shellQuote3(import_node_path20.default.posix.dirname(remoteSetupPath))}`
+        `mkdir -p ${shellQuote3(import_node_path21.default.posix.dirname(remoteSetupPath))}`
       ]);
       if (setupDirResult.exitCode !== 0) {
         throw new Error(
@@ -25188,19 +25366,19 @@ var init_codex = __esm({
       await client.writeFile(
         canonical,
         remoteSetupPath,
-        await import_promises25.default.readFile(localSetupPath)
+        await import_promises27.default.readFile(localSetupPath)
       );
       if (localArtifactsBundlePath && localArtifactsManifestPath && remoteArtifactsBundlePath && remoteArtifactsManifestPath) {
         status.stage("Uploading setup artifacts");
         await client.writeFile(
           canonical,
           remoteArtifactsBundlePath,
-          await import_promises25.default.readFile(localArtifactsBundlePath)
+          await import_promises27.default.readFile(localArtifactsBundlePath)
         );
         await client.writeFile(
           canonical,
           remoteArtifactsManifestPath,
-          await import_promises25.default.readFile(localArtifactsManifestPath)
+          await import_promises27.default.readFile(localArtifactsManifestPath)
         );
       }
     };
@@ -26396,14 +26574,13 @@ var init_progress = __esm({
 });
 
 // src/devbox/commands/init/index.ts
-var import_node_crypto12, import_node_path21, import_promises26, import_node_os10, resolveInitStatus, mergeLocalPaths, buildServicesTomlUpdates, extractCheckpointId, writeRemoteServicesToml, enableRemoteServices, throwInitCanceled, promptBeforeOpenBrowser, toPosixPath2, toRepoRelativePath2, isOutsideRepoPath, ensureWorkdirOwnership, ensureGitSafeDirectory, runInit;
+var import_node_path22, import_promises28, import_node_os9, resolveInitStatus, mergeLocalPaths, ensurePrivateDir, migrateLegacyRepoDevboxDir, buildServicesTomlUpdates, extractCheckpointId, writeRemoteServicesToml, enableRemoteServices, throwInitCanceled, promptBeforeOpenBrowser, toPosixPath2, toRepoRelativePath2, isOutsideRepoPath, ensureWorkdirOwnership, ensureGitSafeDirectory, runInit;
 var init_init = __esm({
   "src/devbox/commands/init/index.ts"() {
     "use strict";
-    import_node_crypto12 = require("node:crypto");
-    import_node_path21 = __toESM(require("node:path"), 1);
-    import_promises26 = __toESM(require("node:fs/promises"), 1);
-    import_node_os10 = __toESM(require("node:os"), 1);
+    import_node_path22 = __toESM(require("node:path"), 1);
+    import_promises28 = __toESM(require("node:fs/promises"), 1);
+    import_node_os9 = __toESM(require("node:os"), 1);
     init_dist2();
     init_src();
     init_src();
@@ -26435,6 +26612,49 @@ var init_init = __esm({
       merged.add(repoRoot);
       return [...merged];
     };
+    ensurePrivateDir = async (dir) => {
+      await import_promises28.default.mkdir(dir, { recursive: true, mode: 448 });
+      try {
+        await import_promises28.default.chmod(dir, 448);
+      } catch {
+      }
+    };
+    migrateLegacyRepoDevboxDir = async ({
+      repoRoot,
+      projectDir
+    }) => {
+      const legacyDir = import_node_path22.default.join(repoRoot, ".devbox");
+      try {
+        const stat = await import_promises28.default.stat(legacyDir);
+        if (!stat.isDirectory()) return;
+      } catch {
+        return;
+      }
+      await ensurePrivateDir(projectDir);
+      const entries = [
+        "box.json",
+        "init-state.json",
+        "setup.json",
+        "services.json",
+        "setup-artifacts.tgz",
+        "setup-artifacts.json",
+        "scans",
+        "logs"
+      ];
+      for (const entry of entries) {
+        const src = import_node_path22.default.join(legacyDir, entry);
+        const dest = import_node_path22.default.join(projectDir, entry);
+        try {
+          await import_promises28.default.access(dest);
+          continue;
+        } catch {
+        }
+        try {
+          await import_promises28.default.cp(src, dest, { recursive: true });
+        } catch {
+        }
+      }
+    };
     buildServicesTomlUpdates = (services) => {
       const updates = {};
       for (const service of services) {
@@ -26500,7 +26720,7 @@ var init_init = __esm({
       const merged = mergeServicesToml(baseContent, updates);
       await client.writeFile(
         canonical,
-        import_node_path21.default.posix.join(workdir.replace(/\/$/, ""), "devbox.toml"),
+        import_node_path22.default.posix.join(workdir.replace(/\/$/, ""), "devbox.toml"),
         Buffer.from(merged)
       );
     };
@@ -26563,13 +26783,13 @@ var init_init = __esm({
       }
       return true;
     };
-    toPosixPath2 = (value) => value.split(import_node_path21.default.sep).join(import_node_path21.default.posix.sep);
+    toPosixPath2 = (value) => value.split(import_node_path22.default.sep).join(import_node_path22.default.posix.sep);
     toRepoRelativePath2 = (repoRoot, filePath) => {
-      const resolved = import_node_path21.default.isAbsolute(filePath) ? filePath : import_node_path21.default.resolve(repoRoot, filePath);
-      const relative = import_node_path21.default.relative(repoRoot, resolved) || filePath;
+      const resolved = import_node_path22.default.isAbsolute(filePath) ? filePath : import_node_path22.default.resolve(repoRoot, filePath);
+      const relative = import_node_path22.default.relative(repoRoot, resolved) || filePath;
       return toPosixPath2(relative);
     };
-    isOutsideRepoPath = (relativePath) => relativePath === ".." || relativePath.startsWith(`..${import_node_path21.default.posix.sep}`);
+    isOutsideRepoPath = (relativePath) => relativePath === ".." || relativePath.startsWith(`..${import_node_path22.default.posix.sep}`);
     ensureWorkdirOwnership = async ({
       client,
       canonical,
@@ -26690,27 +26910,29 @@ var init_init = __esm({
           fn: async () => {
             const cwd = process.cwd();
             const repoRoot2 = await findRepoRoot(cwd);
-            const repoName2 = import_node_path21.default.basename(repoRoot2);
+            const repoName2 = import_node_path22.default.basename(repoRoot2);
             const slug2 = slugify(repoName2);
-            const localHomeDir2 = process.env.HOME ?? import_node_os10.default.homedir();
-            const repoMarker2 = await readRepoMarker(repoRoot2);
+            const localHomeDir2 = process.env.HOME ?? import_node_os9.default.homedir();
+            const projectId2 = await ensureRepoProjectId(repoRoot2);
+            const projectDir2 = resolveDevboxProjectDir(projectId2, localHomeDir2);
+            await migrateLegacyRepoDevboxDir({ repoRoot: repoRoot2, projectDir: projectDir2 });
+            const repoMarker2 = await readRepoMarker(projectDir2);
             const origin2 = await readRepoOrigin(repoRoot2);
             const normalizedOrigin2 = origin2 ? normalizeGitRemoteUrl(origin2) : null;
-            const fingerprint2 = origin2 ? fingerprintFromOrigin(origin2) : repoMarker2?.fingerprint ?? fingerprintFromRootCommit(
-              await readRootCommit(repoRoot2),
-              (0, import_node_crypto12.randomUUID)()
-            );
-            let initState2 = await readInitState(repoRoot2);
+            const fingerprint2 = projectId2;
+            let initState2 = await readInitState(projectDir2);
             const initFingerprintMismatch2 = Boolean(initState2?.fingerprint) && initState2?.fingerprint !== fingerprint2;
             if (!initFingerprintMismatch2 && initState2?.complete && !initState2.steps.codexApplied) {
               initState2 = { ...initState2, complete: false };
-              await writeInitState(repoRoot2, initState2);
+              await writeInitState(projectDir2, initState2);
             }
             return {
               repoRoot: repoRoot2,
               repoName: repoName2,
               slug: slug2,
               localHomeDir: localHomeDir2,
+              projectId: projectId2,
+              projectDir: projectDir2,
               repoMarker: repoMarker2,
               origin: origin2,
               normalizedOrigin: normalizedOrigin2,
@@ -26725,6 +26947,8 @@ var init_init = __esm({
           repoName,
           slug,
           localHomeDir,
+          projectId,
+          projectDir,
           repoMarker,
           origin,
           normalizedOrigin,
@@ -26761,6 +26985,8 @@ var init_init = __esm({
           const recommendsInit = !registryProject && (!initState || initFingerprintMismatch);
           const recommendsForce = !recommendsResume && (!initState || initFingerprintMismatch) && Boolean(registryProject?.initStatus && registryProject.initStatus !== "complete");
           const lines = [];
+          const markerPath = import_node_path22.default.join(projectDir, "box.json");
+          const checkpointPath = import_node_path22.default.join(projectDir, "init-state.json");
           lines.push("INIT STATUS");
           lines.push("");
           lines.push("Repo");
@@ -26768,20 +26994,21 @@ var init_init = __esm({
           lines.push(
             `  origin: ${normalizedOrigin ?? origin ?? "(none)"}`
           );
-          lines.push(`  fingerprint: ${fingerprint}`);
+          lines.push(`  projectId (git config devbox.projectId): ${projectId}`);
+          lines.push(`  local state dir: ${projectDir}`);
           lines.push("");
           lines.push("Local state");
           if (repoMarker?.canonical) {
             lines.push(
-              `  box marker (.devbox/box.json): present (alias: ${repoMarker.alias ?? "(none)"}, box: ${repoMarker.canonical})`
+              `  box marker (${markerPath}): present (alias: ${repoMarker.alias ?? "(none)"}, box: ${repoMarker.canonical})`
             );
           } else {
-            lines.push("  box marker (.devbox/box.json): missing");
+            lines.push(`  box marker (${markerPath}): missing`);
           }
           if (initState) {
-            const completeText = initFingerprintMismatch ? `${String(Boolean(initState.complete))} (fingerprint mismatch)` : String(Boolean(initState.complete));
+            const completeText = initFingerprintMismatch ? `${String(Boolean(initState.complete))} (projectId mismatch)` : String(Boolean(initState.complete));
             lines.push(
-              `  init checkpoint (.devbox/init-state.json): present (updated: ${initState.updatedAt}, complete: ${completeText})`
+              `  init checkpoint (${checkpointPath}): present (updated: ${initState.updatedAt}, complete: ${completeText})`
             );
             if (initState.canonical || initState.alias || initState.workdir) {
               lines.push(
@@ -26809,7 +27036,7 @@ var init_init = __esm({
               lines.push(`    ${key}: ${steps[key] ? "yes" : "no"}`);
             }
           } else {
-            lines.push("  init checkpoint (.devbox/init-state.json): missing");
+            lines.push(`  init checkpoint (${checkpointPath}): missing`);
           }
           lines.push("");
           lines.push("Registry");
@@ -26887,7 +27114,10 @@ var init_init = __esm({
         if (parsed.resume) {
           if (initFingerprintMismatch) {
             throw new Error(
-              "Init state does not match this repo. Remove .devbox/init-state.json and run `dvb init` again."
+              `Init state does not match this repo. Remove ${import_node_path22.default.join(
+                projectDir,
+                "init-state.json"
+              )} and run \`dvb init\` again.`
             );
           }
           if (!initState) {
@@ -26938,7 +27168,7 @@ var init_init = __esm({
             },
             updatedAt: (/* @__PURE__ */ new Date()).toISOString()
           };
-          await writeInitState(repoRoot, initState);
+          await writeInitState(projectDir, initState);
         };
         const recordCodexCheckpoint = async ({
           client: client2,
@@ -27005,27 +27235,29 @@ var init_init = __esm({
           if (!repoMarker?.canonical) {
             throw new Error("Repo is not initialized. Run `dvb init` first.");
           }
-          const setupDir2 = import_node_path21.default.join(repoRoot, ".devbox");
-          const setupPath2 = import_node_path21.default.join(setupDir2, "setup.json");
-          const servicesPath2 = import_node_path21.default.join(setupDir2, "services.json");
+          const setupDir2 = projectDir;
+          const setupPath2 = import_node_path22.default.join(setupDir2, "setup.json");
+          const servicesPath2 = import_node_path22.default.join(setupDir2, "services.json");
           try {
-            await import_promises26.default.access(setupPath2);
+            await import_promises28.default.access(setupPath2);
           } catch {
-            throw new Error("Missing .devbox/setup.json. Run `dvb init` first.");
+            throw new Error(
+              `Missing setup plan (${setupPath2}). Run \`dvb init\` first.`
+            );
           }
-          const localArtifactsBundlePath = import_node_path21.default.join(
+          const localArtifactsBundlePath = import_node_path22.default.join(
             setupDir2,
             "setup-artifacts.tgz"
           );
-          const localArtifactsManifestPath = import_node_path21.default.join(
+          const localArtifactsManifestPath = import_node_path22.default.join(
             setupDir2,
             "setup-artifacts.json"
           );
           let artifactsBundlePath = null;
           let artifactsManifestPath = null;
           try {
-            await import_promises26.default.access(localArtifactsBundlePath);
-            await import_promises26.default.access(localArtifactsManifestPath);
+            await import_promises28.default.access(localArtifactsBundlePath);
+            await import_promises28.default.access(localArtifactsManifestPath);
             artifactsBundlePath = localArtifactsBundlePath;
             artifactsManifestPath = localArtifactsManifestPath;
           } catch {
@@ -27074,17 +27306,17 @@ var init_init = __esm({
             }
           } catch {
           }
-          const remoteSetupPath2 = import_node_path21.default.posix.join(
+          const remoteSetupPath2 = import_node_path22.default.posix.join(
             expandedWorkdir2,
             ".devbox",
             "setup.json"
           );
-          const remoteArtifactsBundlePath2 = import_node_path21.default.posix.join(
+          const remoteArtifactsBundlePath2 = import_node_path22.default.posix.join(
             expandedWorkdir2,
             ".devbox",
             "setup-artifacts.tgz"
           );
-          const remoteArtifactsManifestPath2 = import_node_path21.default.posix.join(
+          const remoteArtifactsManifestPath2 = import_node_path22.default.posix.join(
             expandedWorkdir2,
             ".devbox",
             "setup-artifacts.json"
@@ -27278,17 +27510,17 @@ var init_init = __esm({
         const canonicalHint = parsed.name ?? initState?.canonical ?? existingEntry?.canonical;
         const workdir = `~/${slug}`;
         const expandedWorkdir = expandHome2(workdir);
-        const remoteSetupPath = import_node_path21.default.posix.join(
+        const remoteSetupPath = import_node_path22.default.posix.join(
           expandedWorkdir,
           ".devbox",
           "setup.json"
         );
-        const remoteArtifactsBundlePath = import_node_path21.default.posix.join(
+        const remoteArtifactsBundlePath = import_node_path22.default.posix.join(
           expandedWorkdir,
           ".devbox",
           "setup-artifacts.tgz"
         );
-        const remoteArtifactsManifestPath = import_node_path21.default.posix.join(
+        const remoteArtifactsManifestPath = import_node_path22.default.posix.join(
           expandedWorkdir,
           ".devbox",
           "setup-artifacts.json"
@@ -27317,7 +27549,7 @@ var init_init = __esm({
             return { config: config2, client: client2, controlPlaneToken: controlPlaneToken2 };
           }
         });
-        const username = import_node_os10.default.userInfo().username;
+        const username = import_node_os9.default.userInfo().username;
         let canonical = (shouldResume && initState?.canonical ? initState.canonical : null) ?? canonicalHint ?? `${username}-${slug}`;
         const createSprite = async (name) => {
           try {
@@ -27531,13 +27763,14 @@ var init_init = __esm({
             }
           }
         });
-        const setupDir = import_node_path21.default.join(repoRoot, ".devbox");
-        const setupPath = import_node_path21.default.join(setupDir, "setup.json");
-        const servicesPath = import_node_path21.default.join(setupDir, "services.json");
-        const scansDir = import_node_path21.default.join(setupDir, "scans");
-        const setupEnvSecretsScanPath = import_node_path21.default.join(scansDir, "setup-env-secrets.json");
-        const setupExternalScanPath = import_node_path21.default.join(scansDir, "setup-external.json");
-        const setupExtraArtifactsScanPath = import_node_path21.default.join(
+        const setupDir = projectDir;
+        const setupPath = import_node_path22.default.join(setupDir, "setup.json");
+        const servicesPath = import_node_path22.default.join(setupDir, "services.json");
+        const scansDir = import_node_path22.default.join(setupDir, "scans");
+        const logDir = import_node_path22.default.join(setupDir, "logs");
+        const setupEnvSecretsScanPath = import_node_path22.default.join(scansDir, "setup-env-secrets.json");
+        const setupExternalScanPath = import_node_path22.default.join(scansDir, "setup-external.json");
+        const setupExtraArtifactsScanPath = import_node_path22.default.join(
           scansDir,
           "setup-extra-artifacts.json"
         );
@@ -27551,11 +27784,15 @@ var init_init = __esm({
         const skipCodexApply = nonInteractive || shouldResume && initState?.steps.codexApplied;
         let approvedPlan = null;
         let approvedServices = null;
-        const setupTempDir = await import_promises26.default.mkdtemp(
-          import_node_path21.default.join(import_node_os10.default.tmpdir(), "devbox-setup-")
+        const setupTempDir = await import_promises28.default.mkdtemp(
+          import_node_path22.default.join(import_node_os9.default.tmpdir(), "devbox-setup-")
         );
         try {
-          await import_promises26.default.mkdir(setupDir, { recursive: true });
+          await import_promises28.default.mkdir(setupDir, { recursive: true, mode: 448 });
+          try {
+            await import_promises28.default.chmod(setupDir, 448);
+          } catch {
+          }
           const tryReadSetupPlan = async () => {
             try {
               return await readSetupPlan(setupPath);
@@ -27665,7 +27902,7 @@ var init_init = __esm({
                 throw new Error("Services schema path missing.");
               }
               if (needsSetupScan) {
-                await import_promises26.default.mkdir(scansDir, { recursive: true });
+                await import_promises28.default.mkdir(scansDir, { recursive: true });
               }
               const runCodexScanWithImmediateRetry = async ({
                 run: run3,
@@ -27679,7 +27916,7 @@ var init_init = __esm({
                   let out = await read();
                   if (shouldRetry(out)) {
                     update("retrying");
-                    await import_promises26.default.rm(outputPath, { force: true });
+                    await import_promises28.default.rm(outputPath, { force: true });
                     await run3();
                     out = await read();
                   }
@@ -27693,6 +27930,7 @@ var init_init = __esm({
               const envSecretsPromise = !needsSetupScan ? Promise.resolve(null) : !needsEnvSecretsScan ? Promise.resolve(envSecretsScan) : runCodexScanWithImmediateRetry({
                 run: async () => await runLocalSetupEnvSecretsScan({
                   cwd: repoRoot,
+                  logDir,
                   schemaPath: envSecretsSchemaPath,
                   outputPath: setupEnvSecretsScanPath,
                   onProgress: updateEnvSecrets
@@ -27709,6 +27947,7 @@ var init_init = __esm({
               const externalPromise = !needsSetupScan ? Promise.resolve(null) : !needsExternalScan ? Promise.resolve(externalScan) : runCodexScanWithImmediateRetry({
                 run: async () => await runLocalSetupExternalScan({
                   cwd: repoRoot,
+                  logDir,
                   schemaPath: externalSchemaPath,
                   outputPath: setupExternalScanPath,
                   homeDir: localHomeDir,
@@ -27726,6 +27965,7 @@ var init_init = __esm({
               const extraArtifactsPromise = !needsSetupScan ? Promise.resolve(null) : !needsExtraArtifactsScan ? Promise.resolve(extraArtifactsScan) : runCodexScanWithImmediateRetry({
                 run: async () => await runLocalSetupExtraArtifactsScan({
                   cwd: repoRoot,
+                  logDir,
                   schemaPath: extraArtifactsSchemaPath,
                   outputPath: setupExtraArtifactsScanPath,
                   onProgress: updateExtraArtifacts
@@ -27741,6 +27981,7 @@ var init_init = __esm({
               const servicesPromise = !needsServicesScan ? Promise.resolve(servicesPlan) : runCodexScanWithImmediateRetry({
                 run: async () => await runLocalServicesScan({
                   cwd: repoRoot,
+                  logDir,
                   schemaPath: servicesSchemaPath,
                   outputPath: servicesPath,
                   homeDir: localHomeDir,
@@ -27934,12 +28175,12 @@ var init_init = __esm({
             const readPathInfo = async (candidatePath) => {
               const cached = statCache.get(candidatePath);
               if (cached) return cached;
-              const resolved = import_node_path21.default.isAbsolute(candidatePath) ? candidatePath : import_node_path21.default.resolve(repoRoot, candidatePath);
+              const resolved = import_node_path22.default.isAbsolute(candidatePath) ? candidatePath : import_node_path22.default.resolve(repoRoot, candidatePath);
               const relative = toRepoRelativePath2(repoRoot, candidatePath);
               const outsideRepo = isOutsideRepoPath(relative);
               let isDirectory = false;
               try {
-                const stat = await import_promises26.default.stat(resolved);
+                const stat = await import_promises28.default.stat(resolved);
                 isDirectory = stat.isDirectory();
               } catch {
                 isDirectory = false;
@@ -28122,7 +28363,7 @@ var init_init = __esm({
             });
           }
         } finally {
-          await import_promises26.default.rm(setupTempDir, { recursive: true, force: true });
+          await import_promises28.default.rm(setupTempDir, { recursive: true, force: true });
         }
         const skipProvision = shouldResume && initState?.steps.workdirProvisioned;
         if (skipProvision && !skipSetupUpload) {
@@ -28137,8 +28378,8 @@ var init_init = __esm({
                 remoteSetupPath,
                 localArtifactsBundlePath: setupArtifacts?.bundlePath ?? null,
                 localArtifactsManifestPath: setupArtifacts?.manifestPath ?? null,
-                remoteArtifactsBundlePath: setupArtifacts ? import_node_path21.default.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.tgz") : null,
-                remoteArtifactsManifestPath: setupArtifacts ? import_node_path21.default.posix.join(
+                remoteArtifactsBundlePath: setupArtifacts ? import_node_path22.default.posix.join(expandedWorkdir, ".devbox", "setup-artifacts.tgz") : null,
+                remoteArtifactsManifestPath: setupArtifacts ? import_node_path22.default.posix.join(
                   expandedWorkdir,
                   ".devbox",
                   "setup-artifacts.json"
@@ -28152,15 +28393,14 @@ var init_init = __esm({
             resolveInitStatus(initState?.steps, initState?.complete)
           );
         } else if (!skipProvision || !skipSetupUpload) {
-          const tempDir = await import_promises26.default.mkdtemp(import_node_path21.default.join(import_node_os10.default.tmpdir(), "devbox-init-"));
-          const bundlePath = import_node_path21.default.join(tempDir, "repo.bundle");
-          const archivePath = import_node_path21.default.join(tempDir, "repo.tgz");
-          const gitMetaPath = import_node_path21.default.join(tempDir, "git-meta.tgz");
-          const gitMetaListPath = import_node_path21.default.join(tempDir, "git-meta.list");
-          const stagedPatchPath = import_node_path21.default.join(tempDir, "staged.patch");
-          const unstagedPatchPath = import_node_path21.default.join(tempDir, "unstaged.patch");
-          const untrackedPath = import_node_path21.default.join(tempDir, "untracked.tgz");
-          const untrackedListPath = import_node_path21.default.join(tempDir, "untracked.list");
+          const tempDir = await import_promises28.default.mkdtemp(import_node_path22.default.join(import_node_os9.default.tmpdir(), "devbox-init-"));
+          const bundlePath = import_node_path22.default.join(tempDir, "repo.bundle");
+          const gitMetaPath = import_node_path22.default.join(tempDir, "git-meta.tgz");
+          const gitMetaListPath = import_node_path22.default.join(tempDir, "git-meta.list");
+          const stagedPatchPath = import_node_path22.default.join(tempDir, "staged.patch");
+          const unstagedPatchPath = import_node_path22.default.join(tempDir, "unstaged.patch");
+          const untrackedPath = import_node_path22.default.join(tempDir, "untracked.tgz");
+          const untrackedListPath = import_node_path22.default.join(tempDir, "untracked.list");
           const globalGitConfigSources = await readGlobalGitConfigFiles(repoRoot);
           const globalGitConfigMappings = mapGlobalGitConfigDestinations(
             globalGitConfigSources,
@@ -28168,12 +28408,11 @@ var init_init = __esm({
           );
           try {
             const remoteBundlePath = "/home/sprite/.devbox/upload.bundle";
-            const remoteArchivePath = "/home/sprite/.devbox/upload.tgz";
             const remoteGitMetaPath = "/home/sprite/.devbox/git-meta.tgz";
             const remoteStagedPatchPath = "/home/sprite/.devbox/staged.patch";
             const remoteUnstagedPatchPath = "/home/sprite/.devbox/unstaged.patch";
             const remoteUntrackedPath = "/home/sprite/.devbox/untracked.tgz";
-            const remoteHasGit = await runInitStep({
+            await runInitStep({
               enabled: progressEnabled,
               title: "Preparing remote directories",
               fn: async ({ status }) => {
@@ -28183,16 +28422,20 @@ var init_init = __esm({
                   "-lc",
                   "git --version"
                 ]);
-                const remoteHasGit2 = gitCheck.exitCode === 0;
+                if (gitCheck.exitCode !== 0) {
+                  const details = gitCheck.stderr || gitCheck.stdout || "";
+                  throw new Error(
+                    details ? `Remote git unavailable: ${details.trim()}` : "Remote git unavailable"
+                  );
+                }
                 const remoteDirs = /* @__PURE__ */ new Set();
-                remoteDirs.add(import_node_path21.default.posix.dirname(remoteBundlePath));
-                remoteDirs.add(import_node_path21.default.posix.dirname(remoteArchivePath));
-                remoteDirs.add(import_node_path21.default.posix.dirname(remoteGitMetaPath));
-                remoteDirs.add(import_node_path21.default.posix.dirname(remoteStagedPatchPath));
-                remoteDirs.add(import_node_path21.default.posix.dirname(remoteUnstagedPatchPath));
-                remoteDirs.add(import_node_path21.default.posix.dirname(remoteUntrackedPath));
+                remoteDirs.add(import_node_path22.default.posix.dirname(remoteBundlePath));
+                remoteDirs.add(import_node_path22.default.posix.dirname(remoteGitMetaPath));
+                remoteDirs.add(import_node_path22.default.posix.dirname(remoteStagedPatchPath));
+                remoteDirs.add(import_node_path22.default.posix.dirname(remoteUnstagedPatchPath));
+                remoteDirs.add(import_node_path22.default.posix.dirname(remoteUntrackedPath));
                 for (const mapping of globalGitConfigMappings) {
-                  remoteDirs.add(import_node_path21.default.posix.dirname(mapping.dest));
+                  remoteDirs.add(import_node_path22.default.posix.dirname(mapping.dest));
                 }
                 if (remoteDirs.size > 0) {
                   status.stage("Preparing remote directories");
@@ -28207,7 +28450,6 @@ var init_init = __esm({
                     );
                   }
                 }
-                return remoteHasGit2;
               }
             });
             const { headState, gitCommonDir, worktreeState, copyWorktree } = await runInitStep({
@@ -28242,63 +28484,37 @@ var init_init = __esm({
                 let stagedPatchCreated = false;
                 let unstagedPatchCreated = false;
                 let untrackedCreated = false;
-                if (remoteHasGit) {
-                  status.stage("Packaging repo bundle");
-                  await runCommand2(repoRoot, "git", [
-                    "bundle",
-                    "create",
-                    bundlePath,
-                    "--all"
-                  ]);
-                  status.stage("Packaging git metadata");
-                  gitMetaCreated = await createGitMetaArchive(
-                    gitCommonDir,
-                    gitMetaPath,
-                    gitMetaListPath
+                status.stage("Packaging repo bundle");
+                await runCommand2(repoRoot, "git", [
+                  "bundle",
+                  "create",
+                  bundlePath,
+                  "--all"
+                ]);
+                status.stage("Packaging git metadata");
+                gitMetaCreated = await createGitMetaArchive(
+                  gitCommonDir,
+                  gitMetaPath,
+                  gitMetaListPath
+                );
+                if (copyWorktree) {
+                  status.stage("Packaging repo changes");
+                  stagedPatchCreated = await writePatch(
+                    repoRoot,
+                    ["diff", "--binary", "--cached"],
+                    stagedPatchPath
+                  );
+                  unstagedPatchCreated = await writePatch(
+                    repoRoot,
+                    ["diff", "--binary"],
+                    unstagedPatchPath
+                  );
+                  untrackedCreated = await createFileListArchive(
+                    repoRoot,
+                    worktreeState.untracked,
+                    untrackedPath,
+                    untrackedListPath
                   );
-                  if (copyWorktree) {
-                    status.stage("Packaging repo changes");
-                    stagedPatchCreated = await writePatch(
-                      repoRoot,
-                      ["diff", "--binary", "--cached"],
-                      stagedPatchPath
-                    );
-                    unstagedPatchCreated = await writePatch(
-                      repoRoot,
-                      ["diff", "--binary"],
-                      unstagedPatchPath
-                    );
-                    untrackedCreated = await createFileListArchive(
-                      repoRoot,
-                      worktreeState.untracked,
-                      untrackedPath,
-                      untrackedListPath
-                    );
-                  }
-                } else {
-                  status.stage("Packaging repo archive");
-                  if (copyWorktree) {
-                    const workingFiles = await readNullSeparatedPaths(repoRoot, [
-                      "ls-files",
-                      "--cached",
-                      "--others",
-                      "--exclude-standard"
-                    ]);
-                    await createFileListArchive(
-                      repoRoot,
-                      workingFiles,
-                      archivePath,
-                      untrackedListPath
-                    );
-                  } else {
-                    await runCommand2(repoRoot, "git", [
-                      "archive",
-                      "--format=tar.gz",
-                      "-o",
-                      archivePath,
-                      "HEAD"
-                    ]);
-                  }
                 }
                 return {
                   gitMetaCreated,
@@ -28312,51 +28528,42 @@ var init_init = __esm({
               enabled: progressEnabled,
               title: "Uploading repo",
               fn: async ({ status }) => {
-                if (remoteHasGit) {
-                  status.stage("Uploading repo bundle");
-                  const bundleData = await import_promises26.default.readFile(bundlePath);
-                  await client.writeFile(canonical, remoteBundlePath, bundleData);
-                  if (packaged.gitMetaCreated) {
-                    status.stage("Uploading git metadata");
-                    const gitMetaData = await import_promises26.default.readFile(gitMetaPath);
-                    await client.writeFile(canonical, remoteGitMetaPath, gitMetaData);
-                  }
-                  if (packaged.stagedPatchCreated) {
-                    status.stage("Uploading staged changes");
-                    await client.writeFile(
-                      canonical,
-                      remoteStagedPatchPath,
-                      await import_promises26.default.readFile(stagedPatchPath)
-                    );
-                  }
-                  if (packaged.unstagedPatchCreated) {
-                    status.stage("Uploading unstaged changes");
-                    await client.writeFile(
-                      canonical,
-                      remoteUnstagedPatchPath,
-                      await import_promises26.default.readFile(unstagedPatchPath)
-                    );
-                  }
-                  if (packaged.untrackedCreated) {
-                    status.stage("Uploading untracked files");
-                    await client.writeFile(
-                      canonical,
-                      remoteUntrackedPath,
-                      await import_promises26.default.readFile(untrackedPath)
-                    );
-                  }
-                } else {
-                  status.stage("Uploading repo archive");
+                status.stage("Uploading repo bundle");
+                const bundleData = await import_promises28.default.readFile(bundlePath);
+                await client.writeFile(canonical, remoteBundlePath, bundleData);
+                if (packaged.gitMetaCreated) {
+                  status.stage("Uploading git metadata");
+                  const gitMetaData = await import_promises28.default.readFile(gitMetaPath);
+                  await client.writeFile(canonical, remoteGitMetaPath, gitMetaData);
+                }
+                if (packaged.stagedPatchCreated) {
+                  status.stage("Uploading staged changes");
                   await client.writeFile(
                     canonical,
-                    remoteArchivePath,
-                    await import_promises26.default.readFile(archivePath)
+                    remoteStagedPatchPath,
+                    await import_promises28.default.readFile(stagedPatchPath)
+                  );
+                }
+                if (packaged.unstagedPatchCreated) {
+                  status.stage("Uploading unstaged changes");
+                  await client.writeFile(
+                    canonical,
+                    remoteUnstagedPatchPath,
+                    await import_promises28.default.readFile(unstagedPatchPath)
+                  );
+                }
+                if (packaged.untrackedCreated) {
+                  status.stage("Uploading untracked files");
+                  await client.writeFile(
+                    canonical,
+                    remoteUntrackedPath,
+                    await import_promises28.default.readFile(untrackedPath)
                   );
                 }
                 if (globalGitConfigMappings.length > 0) {
                   status.stage("Uploading git config");
                   for (const mapping of globalGitConfigMappings) {
-                    const data = await import_promises26.default.readFile(mapping.source);
+                    const data = await import_promises28.default.readFile(mapping.source);
                     await client.writeFile(canonical, mapping.dest, data);
                   }
                 }
@@ -28367,70 +28574,44 @@ var init_init = __esm({
               title: "Provisioning workdir",
               fn: async () => {
                 const backup = `${expandedWorkdir}.bak-${Date.now()}`;
-                if (remoteHasGit) {
-                  const checkoutCommand = headState.branch ? `git checkout -B ${shellQuote3(headState.branch)} ${shellQuote3(headState.commit)}` : `git checkout --detach ${shellQuote3(headState.commit)}`;
-                  const remoteCommand = [
-                    "set -euo pipefail",
-                    "unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE",
-                    `if [ -d ${shellQuote3(expandedWorkdir)} ]; then`,
-                    parsed.force ? `  mv ${shellQuote3(expandedWorkdir)} ${shellQuote3(backup)}` : `  echo "Target exists: ${expandedWorkdir}" >&2; exit 1`,
-                    "fi",
-                    `mkdir -p ${shellQuote3(import_node_path21.default.dirname(expandedWorkdir))}`,
-                    `git init -b devbox-init ${shellQuote3(expandedWorkdir)}`,
-                    `cd ${shellQuote3(expandedWorkdir)}`,
-                    `git fetch ${shellQuote3(remoteBundlePath)} 'refs/*:refs/*'`,
-                    `if [ -f ${shellQuote3(remoteGitMetaPath)} ]; then`,
-                    `  tar -xzf ${shellQuote3(remoteGitMetaPath)} -C .git`,
-                    "fi",
-                    checkoutCommand,
-                    `if [ -f ${shellQuote3(remoteStagedPatchPath)} ]; then`,
-                    `  git apply --index ${shellQuote3(remoteStagedPatchPath)}`,
-                    "fi",
-                    `if [ -f ${shellQuote3(remoteUnstagedPatchPath)} ]; then`,
-                    `  git apply ${shellQuote3(remoteUnstagedPatchPath)}`,
-                    "fi",
-                    `if [ -f ${shellQuote3(remoteUntrackedPath)} ]; then`,
-                    `  tar -xzf ${shellQuote3(remoteUntrackedPath)} -C .`,
-                    "fi"
-                  ].join("\n");
-                  const execResult = await client.exec(canonical, [
-                    "/bin/bash",
-                    "--noprofile",
-                    "--norc",
-                    "-e",
-                    "-u",
-                    "-o",
-                    "pipefail",
-                    "-c",
-                    remoteCommand
-                  ]);
-                  if (execResult.exitCode !== 0) {
-                    throw new Error(execResult.stderr || "Remote init failed");
-                  }
-                } else {
-                  const remoteCommand = [
-                    "set -euo pipefail",
-                    "unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE",
-                    `if [ -d ${shellQuote3(expandedWorkdir)} ]; then`,
-                    parsed.force ? `  mv ${shellQuote3(expandedWorkdir)} ${shellQuote3(backup)}` : `  echo "Target exists: ${expandedWorkdir}" >&2; exit 1`,
-                    "fi",
-                    `mkdir -p ${shellQuote3(expandedWorkdir)}`,
-                    `tar -xzf ${shellQuote3(remoteArchivePath)} -C ${shellQuote3(expandedWorkdir)}`
-                  ].join("\n");
-                  const execResult = await client.exec(canonical, [
-                    "/bin/bash",
-                    "--noprofile",
-                    "--norc",
-                    "-e",
-                    "-u",
-                    "-o",
-                    "pipefail",
-                    "-c",
-                    remoteCommand
-                  ]);
-                  if (execResult.exitCode !== 0) {
-                    throw new Error(execResult.stderr || "Remote init failed");
-                  }
+                const checkoutCommand = headState.branch ? `git checkout -B ${shellQuote3(headState.branch)} ${shellQuote3(headState.commit)}` : `git checkout --detach ${shellQuote3(headState.commit)}`;
+                const remoteCommand = [
+                  "set -euo pipefail",
+                  "unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE",
+                  `if [ -d ${shellQuote3(expandedWorkdir)} ]; then`,
+                  parsed.force ? `  mv ${shellQuote3(expandedWorkdir)} ${shellQuote3(backup)}` : `  echo "Target exists: ${expandedWorkdir}" >&2; exit 1`,
+                  "fi",
+                  `mkdir -p ${shellQuote3(import_node_path22.default.dirname(expandedWorkdir))}`,
+                  `git init -b devbox-init ${shellQuote3(expandedWorkdir)}`,
+                  `cd ${shellQuote3(expandedWorkdir)}`,
+                  `git fetch ${shellQuote3(remoteBundlePath)} 'refs/*:refs/*'`,
+                  `if [ -f ${shellQuote3(remoteGitMetaPath)} ]; then`,
+                  `  tar -xzf ${shellQuote3(remoteGitMetaPath)} -C .git`,
+                  "fi",
+                  checkoutCommand,
+                  `if [ -f ${shellQuote3(remoteStagedPatchPath)} ]; then`,
+                  `  git apply --index ${shellQuote3(remoteStagedPatchPath)}`,
+                  "fi",
+                  `if [ -f ${shellQuote3(remoteUnstagedPatchPath)} ]; then`,
+                  `  git apply ${shellQuote3(remoteUnstagedPatchPath)}`,
+                  "fi",
+                  `if [ -f ${shellQuote3(remoteUntrackedPath)} ]; then`,
+                  `  tar -xzf ${shellQuote3(remoteUntrackedPath)} -C .`,
+                  "fi"
+                ].join("\n");
+                const execResult = await client.exec(canonical, [
+                  "/bin/bash",
+                  "--noprofile",
+                  "--norc",
+                  "-e",
+                  "-u",
+                  "-o",
+                  "pipefail",
+                  "-c",
+                  remoteCommand
+                ]);
+                if (execResult.exitCode !== 0) {
+                  throw new Error(execResult.stderr || "Remote init failed");
                 }
                 await updateInitState({ steps: { workdirProvisioned: true } });
               }
@@ -28447,12 +28628,12 @@ var init_init = __esm({
                     remoteSetupPath,
                     localArtifactsBundlePath: setupArtifacts?.bundlePath ?? null,
                     localArtifactsManifestPath: setupArtifacts?.manifestPath ?? null,
-                    remoteArtifactsBundlePath: setupArtifacts ? import_node_path21.default.posix.join(
+                    remoteArtifactsBundlePath: setupArtifacts ? import_node_path22.default.posix.join(
                       expandedWorkdir,
                       ".devbox",
                       "setup-artifacts.tgz"
                     ) : null,
-                    remoteArtifactsManifestPath: setupArtifacts ? import_node_path21.default.posix.join(
+                    remoteArtifactsManifestPath: setupArtifacts ? import_node_path22.default.posix.join(
                       expandedWorkdir,
                       ".devbox",
                       "setup-artifacts.json"
@@ -28467,7 +28648,7 @@ var init_init = __esm({
               );
             }
           } finally {
-            await import_promises26.default.rm(tempDir, { recursive: true, force: true });
+            await import_promises28.default.rm(tempDir, { recursive: true, force: true });
           }
         }
         await runInitStep({
@@ -28801,8 +28982,7 @@ Tip: re-run with DEVBOX_LOG_LEVEL=info to see Sprite exec logs on stderr.`
           enabled: progressEnabled,
           title: "Writing local metadata",
           fn: async () => {
-            await ensureDevboxToml(repoRoot, repoName, slug);
-            await writeRepoMarker(repoRoot, { fingerprint, canonical, alias });
+            await writeRepoMarker(projectDir, { fingerprint, canonical, alias });
           }
         });
         await runInitStep({
@@ -28824,18 +29004,6 @@ Tip: re-run with DEVBOX_LOG_LEVEL=info to see Sprite exec logs on stderr.`
             }
           }
         });
-        try {
-          const gitignore = await import_promises26.default.readFile(
-            import_node_path21.default.join(repoRoot, ".gitignore"),
-            "utf8"
-          );
-          if (!gitignore.includes(".devbox")) {
-            console.log(
-              "Note: add .devbox/ to .gitignore to keep local marker private."
-            );
-          }
-        } catch {
-        }
         const skipSetupArtifactsStage = skipCodexApply || shouldResume && initState?.steps.setupArtifactsStaged;
         if (!skipSetupArtifactsStage) {
           await runInitStep({
@@ -29264,13 +29432,13 @@ var init_logout = __esm({
 });
 
 // src/devbox/commands/mount.ts
-var import_node_child_process10, import_promises27, import_node_path22, parseMountArgs, resolveMountDir, commandExists, ensureLocalDependencies, resolveCanonicalBox, runCommand5, forwardSshPort, stopSshPort, unmount, runMount, runUnmount;
+var import_node_child_process10, import_promises29, import_node_path23, parseMountArgs, resolveMountDir, commandExists, ensureLocalDependencies, resolveCanonicalBox, runCommand5, forwardSshPort, stopSshPort, unmount, runMount, runUnmount;
 var init_mount = __esm({
   "src/devbox/commands/mount.ts"() {
     "use strict";
     import_node_child_process10 = require("node:child_process");
-    import_promises27 = __toESM(require("node:fs/promises"), 1);
-    import_node_path22 = __toESM(require("node:path"), 1);
+    import_promises29 = __toESM(require("node:fs/promises"), 1);
+    import_node_path23 = __toESM(require("node:path"), 1);
     init_src();
     init_daemonClient();
     init_auth();
@@ -29291,7 +29459,7 @@ var init_mount = __esm({
       }
       return parsed;
     };
-    resolveMountDir = (canonical) => import_node_path22.default.join(resolveDevboxDir(), "mounts", canonical);
+    resolveMountDir = (canonical) => import_node_path23.default.join(resolveDevboxDir(), "mounts", canonical);
     commandExists = (command) => {
       const checker = process.platform === "win32" ? "where" : "which";
       const result = (0, import_node_child_process10.spawnSync)(checker, [command], { stdio: "ignore" });
@@ -29394,7 +29562,7 @@ var init_mount = __esm({
       await ensureRemoteMountAccess(client, canonical, publicKey);
       await ensureSshdService(client, canonical);
       const mountDir = resolveMountDir(canonical);
-      await import_promises27.default.mkdir(mountDir, { recursive: true });
+      await import_promises29.default.mkdir(mountDir, { recursive: true });
       const localPort = await forwardSshPort(socketInfo.socketPath, canonical);
       const sshfsArgs = [
         "-o",
@@ -30353,11 +30521,11 @@ var init_services = __esm({
     };
     loadConfigFromSprite = async (client, canonical) => {
       const workdir = await resolveProjectWorkdir(client, canonical);
-      const path24 = workdir ? `${workdir.replace(/\/$/, "")}/devbox.toml` : null;
+      const path25 = workdir ? `${workdir.replace(/\/$/, "")}/devbox.toml` : null;
       if (!workdir) {
         return {
           workdir: null,
-          path: path24,
+          path: path25,
           content: null,
           services: {},
           missing: true,
@@ -30372,7 +30540,7 @@ var init_services = __esm({
         const content = Buffer.from(bytes).toString("utf8");
         return {
           workdir,
-          path: path24,
+          path: path25,
           content,
           services: parseServicesToml(content),
           missing: false
@@ -30381,7 +30549,7 @@ var init_services = __esm({
         if (error instanceof SpritesApiError && error.status === 404) {
           return {
             workdir,
-            path: path24,
+            path: path25,
             content: null,
             services: {},
             missing: true
@@ -30389,7 +30557,7 @@ var init_services = __esm({
         }
         return {
           workdir,
-          path: path24,
+          path: path25,
           content: null,
           services: {},
           missing: false,
@@ -30682,12 +30850,12 @@ var init_services = __esm({
 });
 
 // src/devbox/commands/setup.ts
-var import_node_crypto13, import_promises28, parseSetupArgs, promptForValue2, listSprites2, runSetup;
+var import_node_crypto12, import_promises30, parseSetupArgs, promptForValue2, listSprites2, runSetup;
 var init_setup = __esm({
   "src/devbox/commands/setup.ts"() {
     "use strict";
-    import_node_crypto13 = require("node:crypto");
-    import_promises28 = __toESM(require("node:readline/promises"), 1);
+    import_node_crypto12 = require("node:crypto");
+    import_promises30 = __toESM(require("node:readline/promises"), 1);
     init_src();
     init_src();
     init_auth();
@@ -30736,7 +30904,7 @@ var init_setup = __esm({
       if (!process.stdin.isTTY) {
         throw new Error(`Missing ${label} (non-interactive)`);
       }
-      const rl = import_promises28.default.createInterface({
+      const rl = import_promises30.default.createInterface({
         input: process.stdin,
         output: process.stdout
       });
@@ -30745,7 +30913,7 @@ var init_setup = __esm({
       return answer.trim();
     };
     listSprites2 = async (apiBaseUrl, token) => {
-      const requestId = (0, import_node_crypto13.randomUUID)();
+      const requestId = (0, import_node_crypto12.randomUUID)();
       const url = new URL("/v1/sprites", apiBaseUrl);
       url.searchParams.set("max_results", "1");
       logger7.info("sprites_request", {
@@ -30862,16 +31030,16 @@ var init_setup = __esm({
 });
 
 // src/devbox/commands/wezterm.ts
-var import_node_crypto14, import_node_child_process11, import_promises29, import_node_os11, import_node_path23, import_promises30, logger10, WEZTERM_APP_PATH, WEZTERM_BIN_PATH, WEZTERM_BIN_DIR, WEZTERM_INSTALL_URL, WEZTERM_PATH_EXPORT, WEZTERM_HEALTH_POLL_INTERVAL_MS, WEZTERM_HEALTH_POLL_TIMEOUT_MS, WEZTERM_PROXY_ENV, WEZTERM_PROXY_LOG_NAME, WEZTERM_USAGE, parseWeztermArgs, resolveCanonical3, initWeztermClient, waitForWeztermMuxHealthy, ensureWeztermMuxReady, runWeztermProxy, runCommand6, promptYesNo2, fileExists, hasWeztermOnPath, resolveShellProfilePath, ensureWeztermOnPath, ensureWeztermInstalled, expandPath, resolveDefaultConfigPath, escapeRegExp, resolveDvbCommand, formatLuaArgs, buildProxyCommand, buildDomainBlock, canAppendToConfig, countReturns, applyReturnTableTransform, insertBlock, runWeztermSetup, startWeztermDomain, runWezterm;
+var import_node_crypto13, import_node_child_process11, import_promises31, import_node_os10, import_node_path24, import_promises32, logger10, WEZTERM_APP_PATH, WEZTERM_BIN_PATH, WEZTERM_BIN_DIR, WEZTERM_INSTALL_URL, WEZTERM_PATH_EXPORT, WEZTERM_HEALTH_POLL_INTERVAL_MS, WEZTERM_HEALTH_POLL_TIMEOUT_MS, WEZTERM_PROXY_BASE_ENV, WEZTERM_PROXY_LOG_NAME, WEZTERM_USAGE, parseWeztermArgs, resolveCanonical3, initWeztermClient, waitForWeztermMuxHealthy, ensureWeztermMuxReady, runWeztermProxy, runCommand6, promptYesNo2, fileExists, hasWeztermOnPath, resolveShellProfilePath, ensureWeztermOnPath, ensureWeztermInstalled, expandPath, resolveDefaultConfigPath, escapeRegExp, resolveCliName2, resolveDvbCommand, formatLuaArgs, resolveWeztermProxyEnv, buildProxyCommand, buildDomainBlock, canAppendToConfig, countReturns, applyReturnTableTransform, insertBlock, runWeztermSetup, startWeztermDomain, runWezterm;
 var init_wezterm = __esm({
   "src/devbox/commands/wezterm.ts"() {
     "use strict";
-    import_node_crypto14 = require("node:crypto");
+    import_node_crypto13 = require("node:crypto");
     import_node_child_process11 = require("node:child_process");
-    import_promises29 = __toESM(require("node:fs/promises"), 1);
-    import_node_os11 = __toESM(require("node:os"), 1);
-    import_node_path23 = __toESM(require("node:path"), 1);
-    import_promises30 = __toESM(require("node:readline/promises"), 1);
+    import_promises31 = __toESM(require("node:fs/promises"), 1);
+    import_node_os10 = __toESM(require("node:os"), 1);
+    import_node_path24 = __toESM(require("node:path"), 1);
+    import_promises32 = __toESM(require("node:readline/promises"), 1);
     init_src();
     init_daemonClient();
     init_auth();
@@ -30887,7 +31055,7 @@ var init_wezterm = __esm({
     WEZTERM_PATH_EXPORT = 'export PATH="$PATH:/Applications/WezTerm.app/Contents/MacOS"';
     WEZTERM_HEALTH_POLL_INTERVAL_MS = 200;
     WEZTERM_HEALTH_POLL_TIMEOUT_MS = 6e3;
-    WEZTERM_PROXY_ENV = [
+    WEZTERM_PROXY_BASE_ENV = [
       "DEVBOX_LOG_LEVEL=silent",
       "DEVBOX_WEZTERM_PROXY=1",
       "NODE_NO_WARNINGS=1"
@@ -31059,14 +31227,14 @@ var init_wezterm = __esm({
     runWeztermProxy = async (box, port, options) => {
       const writeProxyLog = async (message) => {
         if (process.env.DEVBOX_WEZTERM_PROXY !== "1") return;
-        const homeDir = import_node_os11.default.homedir();
+        const homeDir = import_node_os10.default.homedir();
         if (!homeDir) return;
         try {
-          const logDir = import_node_path23.default.join(homeDir, ".devbox", "wezterm");
-          await import_promises29.default.mkdir(logDir, { recursive: true });
+          const logDir = import_node_path24.default.join(resolveDevboxDir(homeDir), "wezterm");
+          await import_promises31.default.mkdir(logDir, { recursive: true });
           const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${message}
 `;
-          await import_promises29.default.appendFile(import_node_path23.default.join(logDir, WEZTERM_PROXY_LOG_NAME), line, "utf8");
+          await import_promises31.default.appendFile(import_node_path24.default.join(logDir, WEZTERM_PROXY_LOG_NAME), line, "utf8");
         } catch {
         }
       };
@@ -31076,7 +31244,7 @@ var init_wezterm = __esm({
       await writeProxyLog(
         `proxy_ready box=${canonical} setup=${skipSetup ? "skip" : "full"}`
       );
-      const requestId = (0, import_node_crypto14.randomUUID)();
+      const requestId = (0, import_node_crypto13.randomUUID)();
       const proxyPath = `/v1/sprites/${canonical}/proxy`;
       logger10.info("sprites_request", {
         requestId,
@@ -31280,7 +31448,7 @@ var init_wezterm = __esm({
       if (!process.stdin.isTTY || !process.stdout.isTTY) {
         throw new Error("This command requires a TTY to confirm changes.");
       }
-      const rl = import_promises30.default.createInterface({
+      const rl = import_promises32.default.createInterface({
         input: process.stdin,
         output: process.stdout
       });
@@ -31292,7 +31460,7 @@ var init_wezterm = __esm({
     };
     fileExists = async (value) => {
       try {
-        await import_promises29.default.access(value);
+        await import_promises31.default.access(value);
         return true;
       } catch {
         return false;
@@ -31309,16 +31477,16 @@ var init_wezterm = __esm({
       }
       const shell = process.env.SHELL ?? "";
       if (shell.includes("zsh")) {
-        return import_node_path23.default.join(homeDir, ".zshrc");
+        return import_node_path24.default.join(homeDir, ".zshrc");
       }
       if (shell.includes("bash")) {
-        const profile = import_node_path23.default.join(homeDir, ".bash_profile");
+        const profile = import_node_path24.default.join(homeDir, ".bash_profile");
         if (await fileExists(profile)) {
           return profile;
         }
-        return import_node_path23.default.join(homeDir, ".bashrc");
+        return import_node_path24.default.join(homeDir, ".bashrc");
       }
-      return import_node_path23.default.join(homeDir, ".profile");
+      return import_node_path24.default.join(homeDir, ".profile");
     };
     ensureWeztermOnPath = async () => {
       if (await hasWeztermOnPath()) {
@@ -31338,7 +31506,7 @@ var init_wezterm = __esm({
       if (shouldUpdate) {
         let content = "";
         try {
-          content = await import_promises29.default.readFile(profilePath, "utf8");
+          content = await import_promises31.default.readFile(profilePath, "utf8");
         } catch {
           content = "";
         }
@@ -31346,7 +31514,7 @@ var init_wezterm = __esm({
           const next = `${content.trimEnd()}
 ${content ? "\n" : ""}${WEZTERM_PATH_EXPORT}
 `;
-          await import_promises29.default.writeFile(profilePath, next, "utf8");
+          await import_promises31.default.writeFile(profilePath, next, "utf8");
           updatedProfile = true;
         }
         const currentPath = process.env.PATH ?? "";
@@ -31375,7 +31543,7 @@ ${content ? "\n" : ""}${WEZTERM_PATH_EXPORT}
     expandPath = (value) => {
       if (value.startsWith("~/")) {
         const homeDir = process.env.HOME ?? "";
-        return homeDir ? import_node_path23.default.join(homeDir, value.slice(2)) : value;
+        return homeDir ? import_node_path24.default.join(homeDir, value.slice(2)) : value;
       }
       return value;
     };
@@ -31385,12 +31553,12 @@ ${content ? "\n" : ""}${WEZTERM_PATH_EXPORT}
         throw new Error("HOME is not set; pass --path to wezterm setup.");
       }
       const candidates = [
-        import_node_path23.default.join(homeDir, ".wezterm.lua"),
-        import_node_path23.default.join(homeDir, ".config", "wezterm", "wezterm.lua")
+        import_node_path24.default.join(homeDir, ".wezterm.lua"),
+        import_node_path24.default.join(homeDir, ".config", "wezterm", "wezterm.lua")
       ];
       for (const candidate of candidates) {
         try {
-          await import_promises29.default.access(candidate);
+          await import_promises31.default.access(candidate);
           return candidate;
         } catch {
         }
@@ -31398,22 +31566,43 @@ ${content ? "\n" : ""}${WEZTERM_PATH_EXPORT}
       return candidates[0];
     };
     escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    resolveCliName2 = () => {
+      const raw = process.env.DEVBOX_CLI_NAME?.trim();
+      if (!raw) return "dvb";
+      const normalized = raw.replace(/[^A-Za-z0-9_-]+/g, "").slice(0, 32);
+      return normalized.length > 0 ? normalized : "dvb";
+    };
     resolveDvbCommand = async () => {
       const scriptPath = process.argv[1];
       if (scriptPath) {
-        const candidate = import_node_path23.default.isAbsolute(scriptPath) ? scriptPath : import_node_path23.default.resolve(process.cwd(), scriptPath);
+        const candidate = import_node_path24.default.isAbsolute(scriptPath) ? scriptPath : import_node_path24.default.resolve(process.cwd(), scriptPath);
         try {
-          await import_promises29.default.access(candidate);
+          await import_promises31.default.access(candidate);
           return [process.execPath, candidate];
         } catch {
         }
       }
-      return ["dvb"];
+      return [resolveCliName2()];
     };
     formatLuaArgs = (args) => `{ ${args.map((arg) => JSON.stringify(arg)).join(", ")} }`;
+    resolveWeztermProxyEnv = () => {
+      const env2 = [...WEZTERM_PROXY_BASE_ENV];
+      const profile = process.env.DEVBOX_PROFILE?.trim();
+      if (profile) env2.push(`DEVBOX_PROFILE=${profile}`);
+      const cliName = resolveCliName2();
+      if (cliName !== "dvb") env2.push(`DEVBOX_CLI_NAME=${cliName}`);
+      return env2;
+    };
     buildProxyCommand = async (box, port) => {
       const command = await resolveDvbCommand();
-      const args = ["env", ...WEZTERM_PROXY_ENV, ...command, "wezterm", "proxy", box];
+      const args = [
+        "env",
+        ...resolveWeztermProxyEnv(),
+        ...command,
+        "wezterm",
+        "proxy",
+        box
+      ];
       if (port) {
         args.push("--port", String(port));
       }
@@ -31487,7 +31676,7 @@ ${block}`;
       let existing = "";
       let hasExisting = false;
       try {
-        existing = await import_promises29.default.readFile(configPath, "utf8");
+        existing = await import_promises31.default.readFile(configPath, "utf8");
         hasExisting = true;
       } catch {
         hasExisting = false;
@@ -31526,8 +31715,8 @@ ${block}`;
         }
       }
       if (updated) {
-        await import_promises29.default.mkdir(import_node_path23.default.dirname(configPath), { recursive: true });
-        await import_promises29.default.writeFile(configPath, nextContent, "utf8");
+        await import_promises31.default.mkdir(import_node_path24.default.dirname(configPath), { recursive: true });
+        await import_promises31.default.writeFile(configPath, nextContent, "utf8");
         console.log(`Updated WezTerm config: ${configPath}`);
       } else {
         console.log(`WezTerm config already up to date: ${configPath}`);
@@ -31777,8 +31966,9 @@ var init_cli = __esm({
 
 // src/bin/dvb.ts
 var import_node_fs4 = __toESM(require("node:fs"), 1);
-var import_node_os12 = __toESM(require("node:os"), 1);
-var import_node_path24 = __toESM(require("node:path"), 1);
+var import_node_os11 = __toESM(require("node:os"), 1);
+var import_node_path25 = __toESM(require("node:path"), 1);
+init_src();
 var MIN_NODE_MAJOR = 24;
 var assertNodeVersion = () => {
   const version2 = process.versions.node;
@@ -31829,13 +32019,13 @@ var formatErrorMessage = (error) => {
 run().catch((error) => {
   const message = formatErrorMessage(error);
   if (process.env.DEVBOX_WEZTERM_PROXY === "1") {
-    const homeDir = import_node_os12.default.homedir();
+    const homeDir = import_node_os11.default.homedir();
     if (homeDir) {
       try {
-        const logDir = import_node_path24.default.join(homeDir, ".devbox", "wezterm");
+        const logDir = import_node_path25.default.join(resolveDevboxDir(homeDir), "wezterm");
         import_node_fs4.default.mkdirSync(logDir, { recursive: true });
         import_node_fs4.default.appendFileSync(
-          import_node_path24.default.join(logDir, "proxy.log"),
+          import_node_path25.default.join(logDir, "proxy.log"),
           `${(/* @__PURE__ */ new Date()).toISOString()} ${message}
 `
         );