grokbox 0.1.0 → 0.1.1

package/README.md

@@ -10,7 +10,7 @@ This project is not affiliated with or endorsed by Anysphere, Cursor, xAI, or
 Grok Bot. Grok Bot, Cursor, and related names identify compatible products and
 remain the property of their respective owners.
 
-> **Release:** current source is `0.1.0`. Stable versions publish to npm
+> **Release:** current source is `0.1.1`. Stable versions publish to npm
 > `latest`; prereleases use `next`. Upstream-private compatibility adapters
 > remain experimental and subject to the documented acceptance limits.
 
@@ -47,7 +47,7 @@ never gain host filesystem or process authority.
 ## Prerequisites and platform support
 
 - Node.js 20+ for the published-style CLI runtime.
-- Bun 1.3.14 for source development and the pre-release source shim.
+- Bun 1.3.14 for source development and the source-backed shim.
 - An existing Grok Bot cloud computer that you own or are authorized to use.
 - Tailscale plus BatchMode SSH for remote bootstrap/recovery; bootstrap also
   needs npm or Bun locally to repack the installed runtime for transfer.
@@ -147,7 +147,7 @@ grokbox jobs list --table
 grokbox desktop status --table
 ```
 
-Routine reads expose bounded metadata only: prompt bodies, webhook credentials, native paths, and unknown provider fields stay private. The same `agents routines list/show` and `agents routines webhook credential <agent> <routine-id> --confirm` commands use cloud SSOT when the selected Profile has `server.access_token_ref` (configure with `profile update <name> --server-access-token-ref file:/absolute/path/to/cloud-token`); otherwise they retain Gateway/Host behavior. Cloud keys are minted only after confirmation and reused from a scoped local cache; `--reveal-key` explicitly reveals the key, never a cloud prompt, and `--verify` never invokes the real Routine. Cloud reads are read-only; mutations retain the Host contract. Box-local create writes a disabled definition; later mutations require confirmation and a fresh revision. Temporal create/update remain unsupported. See the [Routine contract](docs/product-contract.md#711-native-routines) for setup, verification, and failure guidance.
+Routine reads expose bounded metadata only, never prompts, keys, native paths, or unknown provider fields. Version 0.1.1 automatically uses proven current-box native Host authentication for `agents routines list/show` and `agents routines webhook credential <agent> <routine-id> --confirm`, without manual cloud token setup. This supports only the observed packaged production Linux Host layout described in the [native identity boundary](docs/upstream-integration.md#server-of-record-routine-surface); custom backends and lab/dev Hosts fail as unsupported. Explicit Profile credentials remain authoritative, including on rejection; remote Profiles never borrow local identity. Missing native proof retains Gateway/Host behavior, not false empty Temporal lists; authentication failures never fall back. Confirmation gates credential side effects, and the key cache remains stable across token renewal. `--reveal-key` reveals only the key; `--verify` never invokes the real Routine. Mutations retain the Host contract; capabilities remain conditional, not proof of authorization. Source-first real-box validation passed with the default Profile and no token injection: both CLI names read Routine list/show with the public Bot UUID and current cloud webhook URL; unknown Routine lookup returned exit 17. No real Routine was invoked and no webhook key was minted. See the [Routine contract](docs/product-contract.md#711-native-routines).
 
 Mutating commands require explicit capability and, where destructive, explicit
 confirmation. `desktop prune run` defaults to dry-run; `--yes` invokes the

package/README.zh-CN.md

@@ -6,7 +6,7 @@
 
 本项目与 Anysphere、Cursor、xAI 或 Grok Bot 没有隶属或背书关系。Grok Bot、Cursor 及相关名称仅用于标识兼容产品，其权利归各自所有者。
 
-> **发布：** 当前源码版本是 `0.1.0`。正式版发布到 npm `latest`，预发布版使用 `next`。上游私有接口的兼容适配器仍为实验性，遵守文档中的验收范围与限制。
+> **发布：** 当前源码版本是 `0.1.1`。正式版发布到 npm `latest`，预发布版使用 `next`。上游私有接口的兼容适配器仍为实验性，遵守文档中的验收范围与限制。
 
 ## 它能做什么
 
@@ -40,7 +40,7 @@ Daemon 不提供通用 raw RPC 或任意 shell。仅有 Gateway 权限的 Profil
 ## 前置条件与平台支持
 
 - 发布版 CLI 运行时需要 Node.js 20+。
-- 源码开发与发布前源码 shim 需要 Bun 1.3.14。
+- 源码开发与源码 shim 需要 Bun 1.3.14。
 - 需要一个你拥有或获准使用的 Grok Bot 云电脑。
 - 远程 bootstrap/recovery 需要 Tailscale 与 BatchMode SSH；bootstrap 还需要本机 npm 或 Bun，以便重新打包已安装运行时并传输。
 
@@ -128,7 +128,7 @@ grokbox jobs list --table
 grokbox desktop status --table
 ```
 
-Routine 读取只输出有界元数据，不暴露 prompt 正文、Webhook credential、原生路径或未知 provider 字段。同一组 `agents routines list/show` 与 `agents routines webhook credential <agent> <routine-id> --confirm` 命令，在 selected Profile 配置 `server.access_token_ref` 时使用 cloud SSOT（通过 `profile update <name> --server-access-token-ref file:/absolute/path/to/cloud-token` 配置）；未配置时保留 Gateway/Host 行为。Cloud key 仅在确认后铸造，并从按范围隔离的本地缓存复用；`--reveal-key` 显式输出 key，但不输出 cloud prompt；`--verify` 从不调用真实 Routine。Cloud 读取为只读，mutation 保留现有 Host 合同。Box-local create 创建 disabled definition，后续 mutation 需要确认与 fresh revision；Temporal create/update 仍不支持。配置、验证与失败处理见 [Routine 合同](docs/product-contract.md#711-native-routines)。
+Routine 读取只输出有界元数据，不暴露 prompt、key、原生路径或未知 provider 字段。0.1.1 通过已证明归属的当前 box 原生 Host 身份，自动使用同一组 `agents routines list/show` 与 `agents routines webhook credential <agent> <routine-id> --confirm` 命令，无需手工配置 cloud token。仅支持[精确原生身份边界](docs/upstream-integration.md#server-of-record-routine-surface)中的已观察 packaged production Linux Host 布局；自定义 backend、lab/dev Host 以 unsupported 拒绝。显式 Profile 凭据优先，被拒绝后不 fallback；Remote Profile 不能借用本机身份。原生证明不可用时保留 Gateway/Host 行为，缺失 Temporal bridge 必须拒绝而非返回虚假空列表。确认后才发生 credential 副作用，key 缓存身份不随 token 续期变化；`--reveal-key` 只揭示 key，`--verify` 不调用真实 Routine。Mutation 保留 Host 合同；capabilities 仍为条件依赖，不宣称已授权。源码优先实机验收已通过：默认 Profile、无 token 注入下，两个 CLI 名称均可读取公开 Bot UUID 对应的 Routine list/show 与当前云端 webhook URL；未知 Routine 返回 exit 17。未调用真实 Routine，也未创建 webhook key。详见 [Routine 合同](docs/product-contract.md#711-native-routines)。
 
 变更命令需要显式 capability；破坏性操作还需要显式确认。`desktop prune run` 默认 dry-run；传入 `--yes` 后会调用上游 stop-window 路径，并删除该 fork 的 Chrome profile。
 

package/dist/index.js

@@ -3474,7 +3474,7 @@ import { fileURLToPath } from "node:url";
 // package.json
 var package_default = {
   name: "grokbox",
-  version: "0.1.0",
+  version: "0.1.1",
   packageManager: "bun@1.3.14",
   description: "Unofficial CLI and control plane for Grok Bot cloud computers",
   license: "MIT",
@@ -7557,11 +7557,11 @@ function jitteredInterval(intervalMs, randomUUID7) {
   const factor = 1 - JITTER_RATIO + sample * JITTER_RATIO * 2;
   return Math.max(1e3, Math.round(intervalMs * factor));
 }
-function failureDelay(intervalMs, failure, consecutiveFailures, retryAfterMs) {
-  if (failure === "rate_limited") {
+function failureDelay(intervalMs, failure2, consecutiveFailures, retryAfterMs) {
+  if (failure2 === "rate_limited") {
     return Math.max(intervalMs, retryAfterMs ?? FAILURE_BASE_BACKOFF_MS);
   }
-  if (failure === "provider_unavailable" || failure === "request_timeout") {
+  if (failure2 === "provider_unavailable" || failure2 === "request_timeout") {
     const backoff = Math.min(
       FAILURE_BASE_BACKOFF_MS * 2 ** Math.max(0, consecutiveFailures - 1),
       FAILURE_MAX_BACKOFF_MS
@@ -14914,6 +14914,7 @@ async function runProfileCapabilities(deps, name, raw) {
   const sandboxCapability = sandboxConfigured ? "provider-authorization-dependent" : false;
   const quotaCapability = profile.quota?.access_token_ref ? "provider-authorization-dependent" : false;
   const serverCapability = profile.server?.access_token_ref ? "provider-authorization-dependent" : false;
+  const routineCapability = serverCapability || (local || directGateway || daemon ? "runtime-host-dependent" : false);
   writeSuccess(deps.stdout, {
     profile: profile.name,
     transport: profile.transport,
@@ -14941,12 +14942,17 @@ async function runProfileCapabilities(deps, name, raw) {
       "sandbox.wake": sandboxCapability,
       "sandbox.keepalive": sandboxCapability,
       "quota.read": quotaCapability,
-      "grok.routine.read": serverCapability || local || directGateway || daemon,
-      "grok.routine.webhook": serverCapability || local || directGateway || daemon
+      "grok.routine.read": routineCapability,
+      "grok.routine.webhook": routineCapability
     }
   });
 }
 
+// src/box-routine-auth.ts
+import { createHash as createHash9 } from "node:crypto";
+import { constants as constants5 } from "node:fs";
+import { open as open7, stat as stat6 } from "node:fs/promises";
+
 // src/server-routines.ts
 import { createHash as createHash8 } from "node:crypto";
 import { constants as constants4 } from "node:fs";
@@ -15354,7 +15360,7 @@ async function cachedWebhookKey(deps, options2) {
   if (options2.routine.createdAtMs === null) throw protocolFailure2("routine_incarnation_missing");
   const scope = createHash8("sha256").update(JSON.stringify([
     normalizedBackend(options2.backendUrl),
-    createHash8("sha256").update(options2.token).digest("hex"),
+    options2.credentialScope ?? createHash8("sha256").update(options2.token).digest("hex"),
     options2.agentId,
     options2.routine.serverId,
     options2.routine.createdAtMs
@@ -15378,8 +15384,8 @@ async function cachedWebhookKey(deps, options2) {
     }
     if (cached) {
       try {
-        const stat6 = await cached.stat();
-        if (!stat6.isFile() || (stat6.mode & 63) !== 0 || stat6.nlink !== 1 || stat6.size > 8192 || process.getuid && stat6.uid !== process.getuid()) throw protocolFailure2("key_store_permissions");
+        const stat7 = await cached.stat();
+        if (!stat7.isFile() || (stat7.mode & 63) !== 0 || stat7.nlink !== 1 || stat7.size > 8192 || process.getuid && stat7.uid !== process.getuid()) throw protocolFailure2("key_store_permissions");
         const bytes = Buffer.alloc(8193);
         const { bytesRead } = await cached.read(bytes, 0, bytes.length, 0);
         if (bytesRead > 8192) throw protocolFailure2("key_store_corrupt");
@@ -15428,6 +15434,178 @@ async function cachedWebhookKey(deps, options2) {
   }
 }
 
+// src/box-routine-auth.ts
+var ENV_LIMIT = 256 * 1024;
+var RESPONSE_LIMIT = 32 * 1024;
+async function boundedFile(path, limit) {
+  const handle = await open7(path, constants5.O_RDONLY | constants5.O_NOFOLLOW);
+  try {
+    const buffer = Buffer.alloc(limit + 1);
+    let length = 0;
+    while (length < buffer.length) {
+      const { bytesRead } = await handle.read(buffer, length, buffer.length - length, null);
+      if (!bytesRead) break;
+      length += bytesRead;
+    }
+    if (length > limit) throw new Error("bounded process read");
+    return buffer.subarray(0, length);
+  } finally {
+    await handle.close();
+  }
+}
+var productionIO = {
+  platform: process.platform,
+  uid: process.getuid?.() ?? -1,
+  async process(pid) {
+    const root = `/proc/${pid}`;
+    const metadata = await stat6(root);
+    const status = (await boundedFile(`${root}/status`, 32 * 1024)).toString("utf8");
+    const uids = /^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s*$/m.exec(status);
+    if (!uids || uids.slice(1).some((uid) => Number(uid) !== metadata.uid)) throw new Error("process owner");
+    const raw = (await boundedFile(`${root}/stat`, 8192)).toString("utf8");
+    const start = raw.slice(raw.lastIndexOf(")") + 2).split(" ")[19];
+    if (!start || !/^\d+$/.test(start)) throw new Error("process start");
+    return { uid: metadata.uid, start, cmdline: (await boundedFile(`${root}/cmdline`, 8192)).toString("utf8") };
+  },
+  environment: async (pid) => await boundedFile(`/proc/${pid}/environ`, ENV_LIMIT)
+};
+function nativeRoutineAuthEligible(deps) {
+  return (deps.boxRoutineAuthIO ?? productionIO).platform === "linux" && (deps.transport === "auto" || deps.transport === "local") && !deps.gatewayServerUrl && !deps.daemonServerUrl && !deps.sshHost;
+}
+function validHost(value, uid) {
+  const args = value.cmdline.split("\0");
+  if (args.at(-1) === "") args.pop();
+  return uid >= 0 && value.uid === uid && /^\d+$/.test(value.start) && args[0] === "/exec-daemon/node" && args.at(-1) === "/opt/sand/sand-host/host-main.cjs" && args.slice(1, -1).every((arg) => arg === "--disable-warning=ExperimentalWarning");
+}
+function sameDiscovery(a, b) {
+  return a.pid === b.pid && a.startedAt === b.startedAt && a.baseUrl === b.baseUrl && a.token === b.token;
+}
+function failure(code) {
+  return new CliError("credential_invalid", "Current-box Routine authentication could not be established safely.", { failureCode: code });
+}
+async function resolveBoxRoutineAuth(deps, timeoutMs) {
+  if (!nativeRoutineAuthEligible(deps)) return null;
+  if (deps.signal?.aborted) throw failure("request_cancelled");
+  const io = deps.boxRoutineAuthIO ?? productionIO;
+  let discovery;
+  let environment;
+  try {
+    discovery = await readDiscovery(deps);
+    if (!Number.isSafeInteger(discovery.pid) || discovery.pid <= 0 || !Number.isSafeInteger(discovery.startedAt) || discovery.startedAt <= 0) return null;
+    const before = await io.process(discovery.pid);
+    if (!validHost(before, io.uid)) return null;
+    const healthy = await new GatewayClient({ ...deps, transport: "local" }).health(timeoutMs);
+    if (!sameDiscovery(discovery, healthy.discovery) || healthy.health.pid !== discovery.pid || healthy.health.startedAt !== discovery.startedAt) return null;
+    environment = await io.environment(discovery.pid);
+    const after = await io.process(discovery.pid);
+    if (!validHost(after, io.uid) || before.start !== after.start || before.cmdline !== after.cmdline || !sameDiscovery(discovery, await readDiscovery(deps))) return null;
+  } catch {
+    if (deps.signal?.aborted) throw failure("request_cancelled");
+    return null;
+  }
+  if (environment.length > ENV_LIMIT) throw failure("renewal_credential_oversized");
+  const entries = environment.toString("utf8").split("\0").filter((entry) => entry.startsWith("SAND_INFERENCE_RENEWAL_CREDENTIAL="));
+  if (entries.length === 0) return null;
+  const credential = entries[0].slice("SAND_INFERENCE_RENEWAL_CREDENTIAL=".length).trim();
+  if (entries.length !== 1 || !credential || Buffer.byteLength(credential) > 16 * 1024 || /[\r\n]/.test(credential)) {
+    throw failure("renewal_credential_invalid");
+  }
+  const metadata = {};
+  for (const entry of environment.toString("utf8").split("\0")) {
+    const separator = entry.indexOf("=");
+    const key = entry.slice(0, separator);
+    if (!["SAND_CLIENT_APP_VERSION", "SAND_BOX_OWNER_NAMESPACE", "SAND_BACKEND_URL", "CURSOR_API_BASE_URL", "SAND_PACKAGED", "SAND_LAB"].includes(key)) continue;
+    const value = entry.slice(separator + 1);
+    if (metadata[key] !== void 0 || value.length > 1024 || /[^\x20-\x7e]/.test(value)) throw failure("renewal_metadata_invalid");
+    metadata[key] = value;
+  }
+  for (const key of ["SAND_BACKEND_URL", "CURSOR_API_BASE_URL"]) {
+    const origin = metadata[key];
+    if (origin && origin !== DEFAULT_SERVER_BACKEND_URL && origin !== `${DEFAULT_SERVER_BACKEND_URL}/`) throw failure("renewal_backend_unsupported");
+  }
+  const ownerNamespace = metadata.SAND_BOX_OWNER_NAMESPACE?.trim();
+  if (metadata.SAND_PACKAGED !== "1" || metadata.SAND_LAB === "1" || ownerNamespace === "dev" || ownerNamespace === "lab") {
+    throw failure("renewal_namespace_unsupported");
+  }
+  const namespace = "prod";
+  const clientVersion = /^(\d+\.\d+\.\d+)(?:-.+)?$/.exec(metadata.SAND_CLIENT_APP_VERSION?.trim() ?? "")?.[1] ?? "0.1.0";
+  const credentialScope = createHash9("sha256").update(JSON.stringify([
+    "box-routine-auth-v1",
+    DEFAULT_SERVER_BACKEND_URL,
+    namespace,
+    credential
+  ])).digest("hex");
+  const controller2 = new AbortController();
+  const abort2 = () => controller2.abort();
+  deps.signal?.addEventListener("abort", abort2, { once: true });
+  const timer = setTimeout(abort2, timeoutMs);
+  try {
+    if (deps.signal?.aborted) controller2.abort();
+    if (controller2.signal.aborted) throw failure("request_cancelled");
+    const response = await deps.fetch(`${DEFAULT_SERVER_BACKEND_URL}/sand-box/inference-credential`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-cursor-client-type": "sand",
+        "x-cursor-client-source": "sand-desktop",
+        "x-cursor-client-version": clientVersion,
+        "x-sand-box-namespace": namespace
+      },
+      body: JSON.stringify({ credential }),
+      redirect: "manual",
+      cache: "no-store",
+      signal: controller2.signal
+    });
+    if (response.redirected || !response.ok) {
+      await response.body?.cancel().catch(() => void 0);
+      throw failure(response.status >= 300 && response.status < 400 ? "renewal_redirect_refused" : response.status === 401 || response.status === 403 ? "renewal_unauthorized" : "renewal_unavailable");
+    }
+    const declared = response.headers.get("content-length");
+    if (declared !== null && (!Number.isSafeInteger(Number(declared)) || Number(declared) < 0 || Number(declared) > RESPONSE_LIMIT)) {
+      await response.body?.cancel().catch(() => void 0);
+      throw failure("renewal_response_oversized");
+    }
+    const reader = response.body?.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+      if (reader) for (; ; ) {
+        const next = await reader.read();
+        if (next.done) break;
+        size += next.value.byteLength;
+        if (size > RESPONSE_LIMIT) {
+          await reader.cancel().catch(() => void 0);
+          throw failure("renewal_response_oversized");
+        }
+        chunks.push(Buffer.from(next.value));
+      }
+    } finally {
+      reader?.releaseLock();
+    }
+    if (controller2.signal.aborted) throw failure("request_cancelled");
+    const result = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    let expiresAtMs = isRecord(result) ? result.expiresAtMs : void 0;
+    if (expiresAtMs === void 0 && isRecord(result) && typeof result.accessToken === "string") {
+      try {
+        const payload = JSON.parse(Buffer.from(result.accessToken.split(".")[1] ?? "", "base64url").toString("utf8"));
+        if (isRecord(payload) && typeof payload.exp === "number") expiresAtMs = payload.exp * 1e3;
+      } catch {
+      }
+    }
+    if (!isRecord(result) || typeof result.accessToken !== "string" || !result.accessToken || Buffer.byteLength(result.accessToken) > 16 * 1024 || /[\s\0]/.test(result.accessToken) || typeof expiresAtMs !== "number" || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= deps.now() + 3e4) {
+      throw failure("renewal_response_invalid");
+    }
+    return { backendUrl: DEFAULT_SERVER_BACKEND_URL, token: result.accessToken, credentialScope };
+  } catch (error) {
+    if (controller2.signal.aborted) throw failure("request_cancelled");
+    if (error instanceof CliError) throw error;
+    throw failure("renewal_response_invalid");
+  } finally {
+    clearTimeout(timer);
+    deps.signal?.removeEventListener("abort", abort2);
+  }
+}
+
 // src/commands/routines.ts
 function routineCliError(error) {
   if (error instanceof CliError) return error;
@@ -15904,10 +16082,10 @@ async function deleteRoutine(deps, client2, agentTarget, routineTarget, raw) {
     })
   }, after.discovery);
 }
-async function cloudRoutines(deps, action, agentTarget, routineTarget, raw) {
+async function cloudRoutines(deps, action, agentTarget, routineTarget, raw, nativeAuth) {
   if (action === "webhook-credential") requireConfirmed(raw);
   const io = ioFromOpts(raw);
-  const context = {
+  const context = nativeAuth ? { ...nativeAuth, timeoutMs: io.timeoutMs } : {
     backendUrl: normalizedBackend(deps.serverBackendUrl ?? DEFAULT_SERVER_BACKEND_URL),
     token: await resolveSecretRef(deps, deps.serverAccessTokenRef),
     timeoutMs: io.timeoutMs
@@ -15956,6 +16134,14 @@ async function runRoutines(deps, action, agentTarget, routineTarget, raw) {
     await cloudRoutines(deps, action, agentTarget, routineTarget, raw);
     return;
   }
+  if (action === "webhook-credential") requireConfirmed(raw);
+  if (action === "list" || action === "show" || action === "webhook-credential") {
+    const nativeAuth = await resolveBoxRoutineAuth(deps, ioFromOpts(raw).timeoutMs);
+    if (nativeAuth) {
+      await cloudRoutines(deps, action, agentTarget, routineTarget, raw, nativeAuth);
+      return;
+    }
+  }
   const client2 = new GatewayClient(deps);
   if (action === "list" || action === "show") {
     await listOrShow(deps, client2, action, agentTarget, routineTarget, raw);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grokbox",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "packageManager": "bun@1.3.14",
   "description": "Unofficial CLI and control plane for Grok Bot cloud computers",
   "license": "MIT",

package/skills/core.md

@@ -41,8 +41,6 @@ grokbox box wake
 grokbox box keepalive status
 grokbox agents list --table
 grokbox agents routines list <agent> --table
-grokbox profile update <name> --server-access-token-ref file:/absolute/path/to/cloud-token
-grokbox profile use <name>
 grokbox agents routines show <agent> <routine-id>
 grokbox agents routines webhook credential <agent> <routine-id> --confirm --verify
 grokbox groups list --table
@@ -76,8 +74,8 @@ Targets accept an exact ID first, then an unambiguous case-insensitive name/titl
    `groups list/show/create/update/delete` only own product groups. Membership is only
    `groups members list/add/remove/set`; every member must resolve to a non-group agent and a group
    must retain 1-6 unique members.
-3. **Manage Routines through one interface**: `agents routines list/show` and `agents routines webhook credential <agent> <routine-id>` use the selected box Profile's cloud SSOT whenever `server.access_token_ref` is configured. Configure with `profile add/update --server-access-token-ref` and optional `--server-backend-url`, using a protected secret reference. Cloud reads preserve envelopes and bounded metadata with `serverId`, webhook URL, and `mutable:false`, never keys or prompts. The Server-returned automation ID is authoritative. There is no separate command root, source flag, desktop discovery, or roster union. First credential access needs `--confirm` to mint; repeated access reuses a local cache scoped to backend, credential digest, agent, Server ID, and creation time. Minting is never automatically retried. `--reveal-key` explicitly reveals the key, never a cloud prompt. `--verify` probes only a fixed, distinct nonexistent ID, requires strict 401 `missing required scope` evidence, supports abort, and never POSTs to the real Routine. Cloud failures are reported directly: check the selected Profile reference/backend and authorization/protocol error, not another route.
-   Without cloud configuration, Gateway/Host behavior remains, including fail-closed missing Temporal bridge checks. Mutations retain the Host contract: Box-local create is disabled, later mutations require fresh `--expect-revision` and `--confirm`, and unsupported Temporal create/update refuse. Cloud adds no CRUD. Unknown write outcomes require reconciliation, not automatic replay. Host credential disclosure retains its existing contract. Cloud authority grants no Gateway, daemon, Sandbox, or quota permissions.
+3. **Manage Routines through one interface**: `agents routines list/show` and `agents routines webhook credential <agent> <routine-id> --confirm` use explicit selected Profile `server.access_token_ref` first, including on rejection with no fallback. Supported local Linux `auto`/local contexts automatically use proven current-box native Host auth without manual token setup. Only the observed packaged production argv is supported: `/exec-daemon/node`, optional exact `--disable-warning=ExperimentalWarning` arguments, then `/opt/sand/sand-host/host-main.cjs`, with `SAND_PACKAGED=1` and production backend metadata. Custom backends and lab/dev Hosts fail as unsupported. External use may configure `profile add/update --server-access-token-ref` and `--server-backend-url`. Remote Profiles cannot borrow local identity. Exact loopback discovery PID/start generation and health, same-UID Host command line and generation before/after bounded allowlisted environment access are required; never scan all processes, read private App secrets, use identity sockets, or merge accounts by name. Renew only through the fixed inference endpoint; keep account tokens in memory, never treat `grokBotToken` as account auth. Missing proof retains Gateway/Host behavior, including fail-closed missing Temporal bridge checks; renewal/provider/auth errors never fall back. Default-Profile source-first real-box list/show validation passed without injected tokens; no real Routine was invoked and no webhook key was minted.
+   Cloud reads preserve bounded metadata with `serverId`, webhook URL, and `mutable:false`, never keys or prompts. The Server automation ID is authoritative. `--confirm` precedes credential side effects; repeated access reuses a scoped key cache whose native renewal identity remains stable across token renewal. Minting is never automatically retried. `--reveal-key` reveals only the cloud key; `--verify` probes only a distinct nonexistent ID, requires strict 401 `missing required scope`, and never POSTs to the real Routine. No new server command, `--via`, cloud CRUD, or roster union exists. Mutations retain Host revision/confirmation contracts and unsupported Temporal create/update refuse. Static `profile capabilities` is config-only: explicit cloud config is `provider-authorization-dependent`, eligible Host transport is `runtime-host-dependent`, never proven authorization or a native secret/process/network probe. Runtime commands establish availability. Cloud authority grants no Gateway, daemon, Sandbox, or quota permissions.
 4. **Search/read transcript**: `history search <query>`, `history tail <target>`, and
    `history thread <target> --root <entry-id>` own transcript access. Object `show` commands do
    not add transcript side projections.