instabox 0.6.0 → 0.6.1

package/skills/instabox-basic-setup/scripts/plan.mjs

@@ -1,295 +1,313 @@
 #!/usr/bin/env node
-// The checkbox plan between the scan and the push.
-//
-//   node plan.mjs write --scan scan.json --vault vault.json [--selector k=v,...] > plan.md
-//   node plan.mjs parse --scan scan.json --vault vault.json plan.md > selection.json
-//
-// vault.json is `instabox vault ls --json`: items already in the Vault. One
-// set there by an earlier run of this skill (listed in the manifest, see
-// push.mjs) is replaced; one set any other way is unchecked, and checking it
-// replaces it.
-//
-// `parse` reads the plan back strictly: every id exactly once, nothing
-// unknown, no malformed checkbox. Errors go to stderr, all at once, exit 1.
-// Over the Vault's limits: exit 3, with the sizes.
+// Names-only approval plan for org Secrets and explicit sandbox config copies.
 import { createHash } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { fileContent } from './content.mjs';
 import {
-  VAULT_MAX_ITEMS,
-  VAULT_MAX_TOTAL,
-  VAULT_MAX_VALUE,
+  SECRET_MAX_ITEMS,
+  SECRET_MAX_TOTAL,
+  FILE_MAX_VALUE,
+  FILE_MAX_TOTAL,
+  configPathOK,
+  deliveryPolicy,
   human,
   isMain,
-  parseSelector,
-  selectorString,
+  sameSecret,
+  secretIdentity,
+  validID,
 } from './lib.mjs';
 
 export const MANIFEST = join(homedir(), '.config', 'instabox-basic-setup', 'pushed.json');
-
 export function readManifest(path = MANIFEST) {
   try {
     const m = JSON.parse(readFileSync(path, 'utf8'));
-    return Array.isArray(m.items) ? m : { items: [] };
-  } catch {
-    return { items: [] };
-  }
+    if (m.version === 3 && Array.isArray(m.secrets) && Array.isArray(m.files)) return m;
+  } catch {}
+  // Legacy names and file paths confer no ownership of an org Secret.
+  return { version: 3, secrets: [], files: [] };
 }
 
-const SECTIONS = [
-  ['tokens', 'Tokens', 'Environment variables, on tmpfs in the box (gone at a stop, back at the next start; never in a snapshot). Values go from this machine straight into the Vault and are never shown.'],
-  ['git', 'Git', 'Files in the box’s home, written at every start and resume.'],
-  ['editor', 'Editor and terminal', 'Files in the box’s home, written at every start and resume.'],
-];
-
-// Vault names an item writes: env name, or each file's item name.
-const vaultNames = (it) => (it.kind === 'env' ? [it.name] : it.files.map((f) => f.name));
+export function existingFor(it, secrets, manifest) {
+  if (it.kind !== 'env') return [];
+  return secrets
+    .filter((s) => s.name === it.name)
+    .map((item) => ({
+      item,
+      ours: (manifest.secrets || []).some((m) => sameSecret(m, item)),
+    }));
+}
 
-// What is in the Vault already under one of this item's names or paths: [{vault item, ours}].
-export function existingFor(it, vault, manifest) {
-  const ours = new Set((manifest?.items || []).map((m) => m.name));
-  const found = [];
-  const names = new Set(vaultNames(it));
-  const paths = new Set(it.kind === 'file' ? it.files.map((f) => f.path) : []);
-  for (const v of vault || []) {
-    if (names.has(v.name) || (v.path && paths.has(v.path))) found.push({ item: v, ours: ours.has(v.name) });
-  }
-  return found;
+export function planDigest(scan, secrets, manifest, orgId) {
+  const rows = secrets.map(secretIdentity).sort((a, b) => a.name.localeCompare(b.name));
+  const own = (manifest.secrets || [])
+    .filter((s) => s.orgId === orgId)
+    .map(secretIdentity)
+    .sort((a, b) => a.name.localeCompare(b.name));
+  return createHash('sha256')
+    .update(JSON.stringify([scan, rows, own, orgId]))
+    .digest('hex')
+    .slice(0, 16);
 }
 
-export function planDigest(scan, vault, manifest) {
-  const v = (vault || []).map((i) => [i.name, i.kind, i.path || '', selectorString(i.selector)]).sort();
-  const m = (manifest?.items || []).map((i) => i.name).sort();
-  return createHash('sha256').update(JSON.stringify([scan, v, m])).digest('hex').slice(0, 16);
+export class PlanError extends Error {
+  constructor(errors, code = 1) {
+    super(errors.join('\n'));
+    this.errors = errors;
+    this.code = code;
+  }
 }
 
-// The default checkbox: the scan's, except that something set in the Vault some other way stays unless checked.
-function defaults(scan, vault, manifest) {
-  return scan.items.map((it) => {
-    const ex = existingFor(it, vault, manifest);
-    const theirs = ex.filter((e) => !e.ours);
-    return { it, ex, theirs, checked: it.checked && !theirs.length };
-  });
+function checkContext(scan, secrets, orgId) {
+  if (scan.version !== 3 || !Array.isArray(scan.items))
+    throw new PlanError(['scan format changed; run scan.mjs again']);
+  if (!validID(orgId)) throw new PlanError(['an explicit org ID is required']);
+  if (!Array.isArray(secrets) || secrets.some((s) => s.orgId !== orgId || !s.id || !Number.isSafeInteger(s.version)))
+    throw new PlanError(['Secret metadata must belong to the selected org and include IDs and versions']);
 }
 
-export function writePlan(scan, { vault = [], manifest = { items: [] }, selector = {} } = {}) {
-  const h = scan.home;
-  const out = [];
-  out.push('# instabox basic setup: plan', '');
-  out.push(
-    'Check `[x]` what goes into your instabox Vault and uncheck `[ ]` what stays out.',
-    'Do not edit the ids in backticks or delete lines: the agent reads this file back and stops on anything it does not recognise.',
+export function writePlan(
+  scan,
+  { secrets = [], manifest = { secrets: [] }, orgId, sandboxes = [], delivery = 'env', hosts = [] } = {},
+) {
+  checkContext(scan, secrets, orgId);
+  if (sandboxes.some((id) => !validID(id) || !id.startsWith('m_')))
+    throw new PlanError(['sandboxes must use stable m_ IDs']);
+  const policy = deliveryPolicy(delivery, hosts);
+  const out = [
+    '# instabox basic setup: plan',
     '',
-    'The selector says which of your boxes get these items: `*` is every box, the ones you create later included;',
-    '`key=value` (comma-separated for more) only boxes with that metadata (`instabox create --meta key=value`).',
+    'Check `[x]` the items to save or copy. Do not change IDs or delete lines.',
+    'Tokens become encrypted org Secrets. Each Delivery line explicitly chooses env (real values) or proxy (HTTPS-header placeholders with allowed hosts).',
+    'This run adds env grants only to the sandbox IDs below; an empty list adds no grants. Existing grants remain in force.',
+    'Proxy Secrets also become available to other org sandboxes whose proxy selection is all, including future sandboxes.',
+    'Replacing an existing Secret affects its other authorized sandboxes. Config files are copied once to the named running sandboxes and may overwrite those paths; they are not Secrets.',
+    'Env values can be copied into files, processes or snapshots; removing a selection cannot recover those copies.',
     '',
-    `Selector: \`${selectorString(selector)}\``,
+    `Org: \`${orgId}\``,
+    `Sandboxes: \`${[...new Set(sandboxes)].join(',') || '-'}\``,
     '',
-    `<!-- plan ${planDigest(scan, vault, manifest)}: written from this scan and Vault; scan again and write a new plan if either changed -->`,
-  );
-  const rows = defaults(scan, vault, manifest);
-  for (const [key, title, blurb] of SECTIONS) {
-    out.push('', `## ${title}`, '', blurb, '');
-    const mine = rows.filter((r) => r.it.section === key);
-    if (!mine.length) out.push('_Nothing found._');
-    for (const { it, ex, theirs, checked } of mine) {
-      let text;
-      if (it.kind === 'env') text = `${it.name} from ${it.from}`;
-      else if (it.files.length === 1) text = `~/${it.path} · ${human(it.bytes)}`;
-      else text = `~/${it.path}/: ${it.files.length} files · ${human(it.bytes)}`;
-      if (it.reason) text += ` · off by default: ${it.reason}`;
-      if (it.note) text += ` · ${it.note}`;
-      if (theirs.length)
-        text += ` · already in your Vault as ${theirs.map((e) => e.item.name).join(', ')}, set some other way: checking this replaces it`;
-      else if (ex.length) text += ' · replaces the copy from your last run';
-      out.push(`- [${checked ? 'x' : ' '}] \`${it.id}\` ${text}`);
+    `<!-- plan ${planDigest(scan, secrets, manifest, orgId)}: scan and org metadata; regenerate if either changes -->`,
+  ];
+  for (const [section, title] of [
+    ['tokens', 'Tokens'],
+    ['git', 'Git config copies'],
+    ['editor', 'Editor and terminal config copies'],
+  ]) {
+    out.push('', `## ${title}`, '');
+    const rows = scan.items.filter((it) => it.section === section);
+    if (!rows.length) out.push('_Nothing found._');
+    for (const it of rows) {
+      const ex = existingFor(it, secrets, manifest);
+      const other = ex.some((e) => !e.ours);
+      const checked = it.checked && !other && (it.kind === 'env' || sandboxes.length > 0);
+      let description =
+        it.kind === 'env'
+          ? `${it.name} from ${it.from}`
+          : `~/${it.path}: ${it.files.length} file(s), ${human(it.bytes)}`;
+      if (it.reason) description += `; off by default: ${it.reason}`;
+      if (it.note) description += `; ${it.note}`;
+      if (other) description += '; already in this org, set or changed elsewhere: checking replaces it';
+      else if (ex.length) description += '; replaces the unchanged Secret from your previous run';
+      if (it.kind === 'file' && !sandboxes.length) description += '; select running sandbox IDs before checking this';
+      out.push(`- [${checked ? 'x' : ' '}] \`${it.id}\` ${description}`);
+      if (it.kind === 'env') {
+        // Preserve an existing mode as a starting point; never silently change
+        // a proxy credential into a real-value env credential on a repeat run.
+        const p = ex.length ? deliveryPolicy(ex[0].item.delivery, ex[0].item.hosts || []) : policy;
+        out.push(`Delivery \`${it.id}\`: \`${p.delivery}\` hosts \`${p.hosts.join(',') || '-'}\``);
+      }
     }
   }
-  out.push('', '## Can’t move: do these yourself', '');
-  out.push('No checkbox: the agent repeats these at the end, with the command for each.', '');
-  if (!scan.manual.length) out.push('_Nothing._');
+  out.push('', '## Manual setup', '', 'These entries have no checkbox; no credentials are read for them.', '');
   for (const m of scan.manual) out.push(`- ${m.what}: ${m.why}. ${m.todo}`);
-  out.push('');
-  return out.join('\n');
-}
-
-export class PlanError extends Error {
-  constructor(errors, code = 1) {
-    super(errors.join('\n'));
-    this.errors = errors;
-    this.code = code;
-  }
+  return out.join('\n') + '\n';
 }
 
-// Reads the plan back. Throws PlanError listing every problem (code 1), or the limits (code 3).
-export function parsePlan(scan, text, { vault = [], manifest = { items: [] }, limits = {} } = {}) {
-  const maxItems = limits.maxItems || VAULT_MAX_ITEMS;
-  const maxBytes = limits.maxBytes || VAULT_MAX_TOTAL;
+export function parsePlan(scan, text, { secrets = [], manifest = { secrets: [] }, orgId, limits = {} } = {}) {
+  checkContext(scan, secrets, orgId);
   const errors = [];
-  const byId = new Map(scan.items.map((i) => [i.id, i]));
-  const state = new Map();
-  let selector = null;
-  let sawSelector = false;
-  let digest = null;
-  text.split('\n').forEach((raw, i) => {
-    const n = i + 1;
-    const l = raw.replace(/\r$/, '');
-    const s = l.match(/^Selector:\s*(.*)$/);
-    if (s && /^`/.test(s[1].trim())) {
-      if (sawSelector) errors.push(`line ${n}: a second Selector: line`);
-      sawSelector = true;
-      const m = s[1].trim().match(/^`([^`]*)`$/);
-      if (!m) errors.push(`line ${n}: write the selector in backticks: Selector: \`*\``);
-      else
-        try {
-          selector = parseSelector(m[1]);
-        } catch (e) {
-          errors.push(`line ${n}: ${e.message}`);
-        }
-      return;
+  const byId = new Map(scan.items.map((it) => [it.id, it]));
+  const states = new Map(),
+    policies = new Map();
+  let planOrg, sandboxes, digest;
+  for (const [index, raw] of text.split('\n').entries()) {
+    const line = raw.replace(/\r$/, ''),
+      n = index + 1;
+    if (/^(Org|Sandboxes):/.test(line)) {
+      const m = line.match(/^(Org|Sandboxes): `([^`]*)`$/);
+      if (!m) {
+        errors.push(`line ${n}: invalid Org or Sandboxes line`);
+        continue;
+      }
+      if (m[1] === 'Org') {
+        if (planOrg !== undefined) errors.push(`line ${n}: duplicate Org line`);
+        planOrg = m[2];
+      } else {
+        if (sandboxes !== undefined) errors.push(`line ${n}: duplicate Sandboxes line`);
+        sandboxes = m[2] === '-' ? [] : m[2].split(',').map((s) => s.trim());
+        if (
+          sandboxes.some((id) => !validID(id) || !id.startsWith('m_')) ||
+          new Set(sandboxes).size !== sandboxes.length
+        )
+          errors.push(`line ${n}: use distinct stable sandbox IDs, comma-separated, or -`);
+      }
+      continue;
+    }
+    if (/^Delivery\b/.test(line)) {
+      const m = line.match(/^Delivery `([^`]+)`: `([^`]+)` hosts `([^`]*)`$/);
+      if (!m || byId.get(m[1])?.kind !== 'env') {
+        errors.push(`line ${n}: invalid Delivery line`);
+        continue;
+      }
+      if (policies.has(m[1])) errors.push(`line ${n}: duplicate delivery for ${m[1]}`);
+      try {
+        policies.set(m[1], deliveryPolicy(m[2], m[3] === '-' ? [] : m[3].split(',').map((h) => h.trim())));
+      } catch (e) {
+        errors.push(`line ${n}: ${e.message}`);
+      }
+      continue;
+    }
+    if (/^Selector:/.test(line)) errors.push(`line ${n}: legacy selectors are retired`);
+    const d = line.match(/^<!-- plan ([0-9a-f]+):/);
+    if (d) {
+      if (digest) errors.push(`line ${n}: duplicate plan fingerprint`);
+      digest = d[1];
     }
-    const d = l.match(/<!-- plan ([0-9a-f]+):/);
-    if (d) digest = d[1];
-    // Anything that looks like a list item with a checkbox must be exactly one of ours.
-    if (!/^\s*(?:[-*+]|\d+[.)])\s*\[/.test(l) && !/^\s*[-*+]\s*`(?:env|file|files):/.test(l)) return;
-    const m = l.match(/^- \[([ xX])\] `([^`]+)`(?: .*)?$/);
+    if (!/^\s*(?:[-*+]|\d+[.)])\s*\[/.test(line) && !/^\s*[-*+]\s*`(?:env|file|files):/.test(line)) continue;
+    const m = line.match(/^- \[([ xX])\] `([^`]+)`(?: .*)?$/);
     if (!m) {
-      errors.push(`line ${n}: not a checkbox line this plan understands: ${JSON.stringify(l.slice(0, 80))} (write "- [x] \`id\` ..." or "- [ ] \`id\` ...")`);
-      return;
+      errors.push(`line ${n}: not a checkbox line; use - [x] or - [ ] with the original ID`);
+      continue;
     }
-    const [, mark, id] = m;
-    if (!byId.has(id)) return errors.push(`line ${n}: unknown id \`${id}\``);
-    if (state.has(id)) return errors.push(`line ${n}: \`${id}\` appears twice`);
-    state.set(id, mark !== ' ');
-  });
-  if (!sawSelector) errors.push('no "Selector: `*`" line (write `*` for every box)');
-  if (digest === null) errors.push('the "<!-- plan ... -->" line is missing: write the plan again');
-  else if (digest !== planDigest(scan, vault, manifest))
-    errors.push('this plan was written from a different scan or Vault: scan, list the Vault and write the plan again');
-  for (const id of byId.keys()) if (!state.has(id)) errors.push(`\`${id}\` is missing from the plan (uncheck a line instead of deleting it)`);
+    if (!byId.has(m[2])) {
+      errors.push(`line ${n}: unknown id \`${m[2]}\``);
+      continue;
+    }
+    if (states.has(m[2])) errors.push(`line ${n}: \`${m[2]}\` appears twice`);
+    states.set(m[2], m[1] !== ' ');
+  }
+  if (planOrg !== orgId) errors.push('Org must match the metadata used to write this plan; regenerate for another org');
+  if (sandboxes === undefined)
+    errors.push('Sandboxes line is required; use - to save Secrets without adding sandbox grants');
+  if (digest !== planDigest(scan, secrets, manifest, orgId))
+    errors.push('different scan or org Secret state; scan, list Secrets and write a new plan');
+  for (const it of scan.items) {
+    if (!states.has(it.id)) errors.push(`\`${it.id}\` is missing from the plan`);
+    if (it.kind === 'env' && !policies.has(it.id))
+      errors.push(`\`${it.id}\` needs an explicit delivery mode and hosts line`);
+  }
   if (errors.length) throw new PlanError(errors);
 
-  const picked = scan.items.filter((i) => state.get(i.id));
-  // GH_TOKEN from this plan, or already in the Vault: either way gh's credential helper works.
-  const ghToken =
-    picked.some((i) => i.kind === 'env' && i.name === 'GH_TOKEN') || vault.some((v) => v.kind === 'env' && v.name === 'GH_TOKEN');
-  const items = [];
-  const sizes = [];
-  for (const it of picked) {
-    const ex = existingFor(it, vault, manifest);
-    const out = { ...it, replace: ex.map((e) => e.item.name) };
-    delete out.checked;
-    if (it.kind === 'file') {
-      out.files = it.files.map((f) => {
+  const picked = scan.items.filter((it) => states.get(it.id));
+  const ghToken = picked.some(
+    (it) => it.kind === 'env' && it.name === 'GH_TOKEN' && policies.get(it.id).delivery === 'env',
+  );
+  const items = picked.map((it) => {
+    const item = { ...it };
+    delete item.checked;
+    if (it.kind === 'env') {
+      Object.assign(item, policies.get(it.id));
+      item.expected = secrets.find((s) => s.name === it.name);
+      item.expected = item.expected ? secretIdentity(item.expected) : null;
+    } else {
+      if (!sandboxes.length) errors.push(`\`${it.id}\`: config copying requires explicit running sandbox IDs`);
+      item.files = it.files.map((f) => {
+        if (!configPathOK(f.path)) errors.push(`\`${it.id}\`: invalid config path`);
         const c = fileContent(f, { home: scan.home, ghToken });
         if (c.error) errors.push(`\`${it.id}\`: ${c.error}`);
         const bytes = c.error ? 0 : Buffer.byteLength(c.text);
-        if (bytes > VAULT_MAX_VALUE) errors.push(`\`${it.id}\`: ~/${f.path} is ${human(bytes)}, over the Vault's 64 KiB per item: uncheck it`);
-        if (!c.error && !bytes) errors.push(`\`${it.id}\`: ~/${f.path} is empty, and the Vault takes no empty file: uncheck it`);
+        if (bytes > FILE_MAX_VALUE) errors.push(`\`${it.id}\`: file exceeds the config-copy limit of 64 KiB`);
         return { ...f, bytes };
       });
-      out.bytes = out.files.reduce((s, f) => s + f.bytes, 0);
+      item.bytes = item.files.reduce((sum, f) => sum + f.bytes, 0);
     }
-    sizes.push({ id: it.id, items: vaultNames(it).length, bytes: out.bytes || 0 });
-    items.push(out);
-  }
+    return item;
+  });
   if (errors.length) throw new PlanError(errors);
-
-  // The Vault's quotas count every item of the user, so what stays there counts too.
-  const replaced = new Set(items.flatMap((i) => i.replace));
-  const staying = vault.filter((v) => !replaced.has(v.name));
-  const stayBytes = staying.reduce((s, v) => s + (v.size || 0), 0);
-  const nItems = staying.length + sizes.reduce((s, x) => s + x.items, 0);
-  const nBytes = stayBytes + sizes.reduce((s, x) => s + x.bytes, 0);
-  const vaultUse = { items: nItems, maxItems, fileBytes: nBytes, maxBytes, staying: staying.length, stayingBytes: stayBytes };
-  if (nItems > maxItems || nBytes > maxBytes) {
-    const big = [...sizes].sort((a, b) => b.bytes - a.bytes || b.items - a.items).slice(0, 8);
+  const tokens = items.filter((it) => it.kind === 'env');
+  const names = new Set(tokens.map((it) => it.name));
+  const staying = secrets.filter((it) => !names.has(it.name));
+  const maxItems = limits.maxItems || SECRET_MAX_ITEMS,
+    maxBytes = limits.maxBytes || SECRET_MAX_TOTAL;
+  const totals = {
+    items: staying.length + tokens.length,
+    maxItems,
+    stayingBytes: staying.reduce((sum, s) => sum + (s.size || 0), 0),
+    maxBytes,
+  };
+  if (totals.items > maxItems || totals.stayingBytes > maxBytes)
     throw new PlanError(
       [
-        `over the Vault's limits: ${nItems} items of ${maxItems}, ${human(nBytes)} of ${human(maxBytes)} (tokens not counted yet), ${staying.length} items (${human(stayBytes)}) of them already in your Vault and staying.`,
-        `the biggest checked lines: ${big.map((b) => `\`${b.id}\` ${b.items} item${b.items === 1 ? '' : 's'}, ${human(b.bytes)}`).join('; ')}`,
-        'uncheck some, or remove Vault items you no longer need (`instabox vault ls`, `instabox vault rm NAME`)',
+        `over the org Secret limits: ${totals.items} items of ${maxItems}; ${human(totals.stayingBytes)} of ${human(maxBytes)} already staying (selected values measured before push)`,
+        'Uncheck tokens or remove unused org Secrets; config files do not consume Secret quota.',
       ],
       3,
     );
-  }
-
-  const ours = new Set((manifest.items || []).map((m) => m.name));
-  const pickedNames = new Set(items.flatMap(vaultNames));
+  const fileBytes = items.filter((it) => it.kind === 'file').reduce((sum, it) => sum + it.bytes, 0);
+  if (fileBytes > FILE_MAX_TOTAL)
+    throw new PlanError(['config copies exceed 512 KiB; uncheck files or transfer them separately'], 3);
   return {
-    version: 2,
+    version: 3,
     home: scan.home,
-    selector,
+    orgId,
+    sandboxes,
     ghToken,
     items,
     manual: scan.manual,
-    skipped: scan.items.filter((i) => !state.get(i.id)).map((i) => i.id),
-    // From an earlier run and not in this plan any more: left in the Vault, listed in the report.
-    leftover: (manifest.items || []).filter((m) => !pickedNames.has(m.name) && vault.some((v) => v.name === m.name)).map((m) => m.name),
-    vault: vaultUse,
-    ours: [...ours],
+    skipped: scan.items.filter((it) => !states.get(it.id)).map((it) => it.id),
+    leftover: (manifest.secrets || [])
+      .filter((m) => m.orgId === orgId && !names.has(m.name) && secrets.some((s) => sameSecret(m, s)))
+      .map((m) => m.name),
+    secrets: totals,
+    fileBytes,
   };
 }
 
-function readVault(file) {
-  const v = JSON.parse(readFileSync(file, 'utf8'));
-  if (!Array.isArray(v.items)) throw new Error(`${file}: not \`instabox vault ls --json\` output`);
-  return v.items;
-}
-
 function main() {
-  const [cmd, ...rest] = process.argv.slice(2);
+  const [command, ...args] = process.argv.slice(2);
   const opt = (name) => {
-    const i = rest.indexOf(name);
+    const i = args.indexOf(name);
     if (i < 0) return undefined;
-    const v = rest[i + 1] ?? '';
-    rest.splice(i, 2);
-    return v;
-  };
-  const usage = () => {
-    process.stderr.write(
-      'usage: plan.mjs write --scan scan.json --vault vault.json [--selector k=v,...] [--manifest FILE]\n' +
-        '       plan.mjs parse --scan scan.json --vault vault.json [--limits limits.json] [--manifest FILE] plan.md\n',
-    );
-    process.exit(2);
+    const value = args[i + 1];
+    args.splice(i, 2);
+    return value;
   };
-  const scanFile = opt('--scan');
-  const vaultFile = opt('--vault');
+  const scanFile = opt('--scan'),
+    secretsFile = opt('--secrets'),
+    orgId = opt('--org');
   const manifest = readManifest(opt('--manifest') || MANIFEST);
-  if (!scanFile || !vaultFile) usage();
-  const scan = JSON.parse(readFileSync(scanFile, 'utf8'));
-  const vault = readVault(vaultFile);
-  if (cmd === 'write') {
-    let selector = {};
-    const s = opt('--selector');
-    try {
-      if (s !== undefined) selector = parseSelector(s);
-    } catch (e) {
-      process.stderr.write(e.message + '\n');
-      process.exit(2);
-    }
-    if (rest.length) usage();
-    process.stdout.write(writePlan(scan, { vault, manifest, selector }));
-  } else if (cmd === 'parse') {
-    const lf = opt('--limits');
-    if (rest.length !== 1) usage();
-    let limits = {};
-    if (lf) {
-      try {
-        limits = JSON.parse(readFileSync(lf, 'utf8')) || {};
-      } catch {}
-    }
-    try {
-      const sel = parsePlan(scan, readFileSync(rest[0], 'utf8'), { vault, manifest, limits });
-      process.stdout.write(JSON.stringify(sel, null, 2) + '\n');
-    } catch (e) {
-      if (!(e instanceof PlanError)) throw e;
-      process.stderr.write(`${rest[0]}: ${e.code === 3 ? 'too big' : `${e.errors.length} problem(s)`}:\n${e.errors.map((x) => `  ${x}`).join('\n')}\n`);
-      process.exit(e.code);
-    }
-  } else usage();
+  try {
+    if (!scanFile || !secretsFile || !orgId)
+      throw new Error('use --scan scan.json --secrets secrets.json --org ORG_ID');
+    const scan = JSON.parse(readFileSync(scanFile, 'utf8'));
+    const secrets = JSON.parse(readFileSync(secretsFile, 'utf8')).items;
+    if (!Array.isArray(secrets)) throw new Error('metadata must be instabox secrets ls --json output');
+    if (command === 'write') {
+      const sandboxes = [],
+        hosts = [];
+      let value;
+      while ((value = opt('--sandbox')) !== undefined) sandboxes.push(value);
+      while ((value = opt('--host')) !== undefined) hosts.push(value);
+      const delivery = opt('--delivery') || 'env';
+      if (args.length) throw new Error('unknown write arguments');
+      process.stdout.write(writePlan(scan, { secrets, orgId, manifest, sandboxes, delivery, hosts }));
+    } else if (command === 'parse') {
+      const limitFile = opt('--limits');
+      const limits = limitFile ? JSON.parse(readFileSync(limitFile, 'utf8')) : {};
+      if (args.length !== 1) throw new Error('parse requires one plan.md path');
+      const selection = parsePlan(scan, readFileSync(args[0], 'utf8'), {
+        secrets,
+        orgId,
+        manifest,
+        limits: limits || {},
+      });
+      process.stdout.write(JSON.stringify(selection, null, 2) + '\n');
+    } else throw new Error('command must be write or parse');
+  } catch (e) {
+    process.stderr.write(e.message + '\n');
+    process.exit(e instanceof PlanError ? e.code : 1);
+  }
 }
-
 if (isMain(import.meta)) main();