instabox 0.6.0 → 0.6.2

package/bin/instabox.mjs

@@ -34,7 +34,8 @@ const API = (
   process.env.INSTABOX_API ||
   'https://api.instabox.sh'
 ).replace(/\/$/, '');
-const IMAGE = process.env.INSTABOX_IMAGE || 'universal';
+// The template a new box starts from: the CLI's and dashboard's default (shown as standard).
+const IMAGE = process.env.INSTABOX_IMAGE || 'agent-browser';
 // SSH certificate lifetime for a box with no timeout of its own.
 const CERT_MIN = 120;
 // With no provider selected, the browser confirms its existing Instabox account

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instabox",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest",
   "type": "module",
   "bin": {

package/skills/instabox/SKILL.md

@@ -7,7 +7,7 @@ metadata:
 
 # instabox CLI
 
-An instabox sandbox is a Linux VM (Debian, one user with passwordless sudo: named after your local username when created with `instabox create`, `user` from the dashboard, `dev` on older boxes; `instabox get <box>` shows it). It has a root disk and a persistent `/data` disk; HOME is `/data/home`. Boxes are private to the signed-in account.
+An instabox sandbox is a Linux VM (Debian, one user with passwordless sudo: named after your local username when created with `instabox create`, `user` from the dashboard, `dev` on older boxes; `instabox get <box>` shows it). It has a root disk and a persistent `/data` disk; HOME is `/data/home`. Each box belongs to an organization; access follows its membership and sandbox permissions.
 
 ## Sign in
 
@@ -16,19 +16,31 @@ instabox whoami              # who is signed in (fails if nobody)
 instabox login               # confirm the browser's account, or choose GitHub / Google
 ```
 
-A GitHub sign-in and a Google sign-in are separate accounts with separate boxes. Both `instabox login` and `npx instabox@latest` open account confirmation in the browser: use its current Instabox account or choose another. To go directly to a provider, use `instabox login --provider github|google`, or `npx instabox@latest --github|--google`. The CLI shares the sign-in `npx` made. Device-code sign-in (`--device`) uses GitHub.
+A GitHub sign-in and a Google sign-in with the same verified email share one account; with different emails they are separate accounts with separate boxes. Both `instabox login` and `npx instabox@latest` open account confirmation in the browser: use its current Instabox account or choose another. To go directly to a provider, use `instabox login --provider github|google`, or `npx instabox@latest --github|--google`. The CLI shares the sign-in `npx` made. Device-code sign-in (`--device`) uses GitHub.
 
 For CI or an agent without a browser, use an API key instead: `export INSTABOX_API_KEY=ibk_...` (the user creates it on the dashboard's API Keys page). Never print, commit or log a key.
 
 ## Templates
 
-`universal` is the default, so `create` needs no `--template` for ordinary work. It is Debian with git, gh, Node.js 22, Python (uv), Go, Rust, a C toolchain, Docker, Claude Code and Codex; a desktop (VNC, Chromium) installs itself the first time it is used. Pick another template only for its one purpose:
+`agent-browser` is the default, so `create` needs no `--template` for ordinary work. It is Debian with git, gh, Node.js 22, Python (uv), Go, Rust, a C toolchain, Docker, Claude Code and Codex, plus a desktop (VNC, Chromium) ready for browsing or driving a GUI from the start. The dashboard shows it as **standard**. Pick another template only for its one purpose:
 
-- `agent-browser`: universal with the desktop already installed, for browsing or driving a GUI from the start.
+- `universal`: the same tools without the desktop, which installs itself the first time it is used (about half a minute); a smaller root disk. The dashboard shows it as **basic**.
 - `herdr`: for the herdr client.
 - `orca`: for Orca desktop and mobile.
 
-`instabox templates` lists the ones this server offers.
+`instabox templates` lists the ones this server offers. The free plan creates boxes from `agent-browser` only: another template is refused with `403 template_not_allowed` and needs a paid plan (the user upgrades on the dashboard). A box from a snapshot (`--snapshot`) works on every plan, whatever template the snapshot came from. Do not retry another template on the free plan; use `agent-browser`.
+
+## Sizes
+
+A box is 4 vCPU / 8 GB of memory unless `create` names another size of the account's plan with both `--vcpus` and `--mem-mib`:
+
+| Plan | Sizes (`--vcpus` / `--mem-mib`)         |
+| ---- | --------------------------------------- |
+| Free | 4 / 8192 (default), 2 / 4096            |
+| Pro  | 2 / 4096, 4 / 8192 (default), 8 / 16384 |
+| Team | 4 / 8192 (default) up to 32 / 65536     |
+
+`instabox whoami --json` lists the sizes this account may create as `allowedSpecs` (the default first, then the plan's others and any an admin granted); check it rather than assuming the plan. Another size is refused with `400 spec_not_allowed`, whose message names the account's sizes. Pick a size for the work: 2 vCPU for light editing or a single agent, the default for most builds, 8 vCPU (Pro) for heavy builds or many processes. `--snapshot` takes the same flags. The size is fixed once the box exists; for another size, save a snapshot and create a new box from it with the size flags.
 
 ## Everyday commands
 
@@ -40,39 +52,50 @@ instabox ssh work                               # interactive shell (leave with:
 instabox exec work -- uname -a                  # one command, no SSH client needed
 instabox exec work --cwd /data/home -- ls -la   # exec runs `bash -lc` as the box's user
 instabox files work /data/home                  # list a directory (or print a text file)
-instabox auto-suspend work 10m                  # pause after 10 idle minutes (default 30m; 0: never)
+instabox auto-suspend work 10m                  # idle time before it pauses (fixed at 30m unless an admin gave the account manual lifecycle)
 instabox timeout work 2h --on-timeout pause     # pause (keeps memory) or kill at the deadline
 instabox stop work && instabox start work       # stop ends processes, keeps disks
 instabox suspend work && instabox resume work   # pause/resume keeps running processes
+instabox rename work api                        # rename in place, any state; ID and port URLs stay
 instabox rm work                                # delete the box
 ```
 
 - Names or IDs (`m_...`) both work wherever `<id-or-name>` is accepted.
-- `create` options: `--template T` or `--snapshot S`, `--auto-suspend D|0`, `--timeout D [--on-timeout pause|kill]`, `--meta K=V`, `--no-vault`, `--no-wait`. Every box is the same size (`instabox usage` shows it); there are no size flags.
-- A new box pauses itself after 30 idle minutes (no agent working, no terminal use, little CPU) and wakes on the next `exec`, `ssh`, `files`, public port request or `instabox wake <box>`; a paused box keeps its memory and processes. `--auto-suspend 0` keeps a box always on (a server that must keep answering); `--auto-suspend 2h` changes the idle time.
+- `create` options: `--template T` or `--snapshot S`, `--vcpus N --mem-mib M` (a size of the plan, see Sizes), `--auto-suspend D|0`, `--timeout D [--on-timeout pause|kill]`, `--meta K=V`, `--org O`, `--secrets all|NAME,NAME|none`, `--env-secrets NAME,NAME|none`, `--no-wait`.
+- A box pauses itself after 30 idle minutes (no agent working, no terminal use, little CPU) and wakes on the next `exec`, `ssh`, `files`, public port request or `instabox wake <box>`; a paused box keeps its memory and processes. The 30 minutes are fixed for every account unless an admin gave it manual lifecycle: only then do `--auto-suspend 0` (always on) and `--auto-suspend 2h` apply, and the CLI prints a note when the server kept 30m. Timeouts are capped at 4h the same way. Do not try to keep a box on by other means; a paused box resumes on the next command.
 - Use `exec` to run a command and read its output, and `ssh` for an interactive shell.
 - `exec` returns the command's exit code and takes `--stdin` to pipe input. It stops the command after `--timeout` seconds: 60 by default, 600 at most. Run anything longer (installs, builds, test suites) over SSH, which has no time limit and also returns the exit code: `instabox ssh work -- 'cd /data/workspace/app && npm ci'`.
 - The box's HOME has `MACHINE.md` (which box it is, its size, what survives a stop, the installed tools) and `AGENTS.md`. Both are worth reading before working in the box; they appear a moment after it starts.
 - A public URL for a web server in the box: `instabox port publish work 3000` prints it (`instabox port ls`, `instabox port unpublish work 3000`). The URL works while the box runs.
 
-## Vault: the user's secrets in every box
+## Organization Secrets
+
+Secrets are encrypted key=value entries owned by an org. Each entry has one delivery mode:
+
+- `proxy`: the box receives a placeholder. The outbound proxy replaces it in ordinary HTTPS header values only when the destination matches the Secret's allowed hosts. Code in the box can use this credential but does not receive its real value through Secret delivery. No header-name configuration is needed.
+- `env`: the box receives the real value. Use this explicitly for native database credentials, local signing, and clients that cannot use header substitution. Code running in the box can read and copy the value.
 
-The user's Vault holds their secrets (API keys for model providers, a `.env`, a service-account file) on the server and writes them into every box of theirs when it boots or resumes: `env` items as environment variables of every login shell (so of `instabox exec` too), `file` items as files under HOME.
+A new box without Secret selection flags keeps the existing Vault behavior. Opt into Secrets with `--secrets` or `--env-secrets`, or use `secrets select` later. At creation, `--env-secrets` alone also selects all org proxy Secrets. Select env names explicitly; there is no env `all` mode. Metadata labels do not select Secrets, and Secrets do not deliver files.
 
 ```sh
-instabox vault show work                 # what the box gets (names, never values) and the last write
-instabox vault push work                 # write the current items into a running box now
-instabox vault set ANTHROPIC_API_KEY     # value from stdin, or prompted without echo (sign-in only)
-instabox vault set-file .config/svc.json --from ./svc.json
-instabox vault ls; instabox vault rm NAME
-instabox create --name tenant --no-vault # a box for someone else: never gets the user's items
+instabox secrets ls --org team                 # metadata only
+instabox secrets show work                    # selection and independent proxy/guest status
+instabox secrets set SERVICE_API_KEY --org team --delivery proxy --host api.example.com
+instabox secrets set DATABASE_URL --org team --delivery env
+instabox create --name app --org team --secrets SERVICE_API_KEY --env-secrets DATABASE_URL
+instabox secrets select work --env-secrets DATABASE_URL
+instabox secrets push work                    # refresh managed env/trust on a running box
+instabox create --name tenant --no-vault --secrets none --env-secrets none
 ```
 
-- Before asking the user for a credential, check names with `instabox vault show <box>`. Inside the box, use silent presence checks: `test "${NAME+x}" = x` for an environment variable (replace `NAME` with its name), or `test -f "$HOME/.config/svc.json"` for a credential file. Exit status 0 means present, 1 means absent. Never print credential values or read credential-file contents into agent output, chat or logs.
-- A changed item reaches the box at its next boot or resume, or at once with `vault push` (a changed `env` item reaches new shells only).
-- A box made for another person or tenant must be created with `--no-vault` (`vault: false` in the API): anything running in it can read what the Vault writes. This is for good; `instabox start|resume <box> --no-vault` does the same to an existing box.
-- An item's selector (`--selector K=V`) limits it to boxes whose metadata has those labels: create the box with the `--meta` the user's items expect.
-- Managing items needs a sign-in; an API key cannot read, create or change them. Never ask for a secret's value to put it somewhere else.
+- Values for `set` come from stdin or a hidden prompt. Never print a credential or put its value into agent output, chat, command arguments, or logs. Before asking for a credential, check metadata with `secrets ls --org <org>` and `secrets show <box>`. A silent check such as `test "${NAME+x}" = x` tests variable presence without revealing it; it does not prove successful proxy authorization.
+- Org commands default to the signed-in user's personal org. Use `--org` for a team, and select only Secrets from the box's org. Value, host, delivery-mode and deletion changes require an org owner/admin sign-in. API keys with the appropriate machine scopes can inspect metadata and manage sandbox selections, but cannot retrieve or change Secret values.
+- Selection updates replace each supplied list; omitted lists remain unchanged. Preserve existing names when adding to a selection. Proxy selection accepts `all`; both selections accept `none` or `[]`. JSON arrays allow a Secret literally named `all` or `none`.
+- Proxy delivery requires allowed hosts and works with literal placeholders in HTTPS headers on port 443. Do not hash, encode, or sign with a placeholder. Native database TLS is not HTTPS. Unsupported traffic never falls back to real-value env delivery.
+- Rotating an existing proxy value preserves its placeholder. Env refresh and newly added variables affect new shells that load the managed environment; restart or reconfigure existing applications and connection pools. Removing a selection cannot recover env values already copied into processes, files, or snapshots. Revoke or rotate those credentials at the upstream service when necessary.
+- For a box intended for another person or tenant, disable personal Vault injection with `--no-vault` and explicitly select only the org Secrets they may use. For a fresh box with neither system's credentials, use `--no-vault --secrets none --env-secrets none`. Empty Secret selections alone still permit Vault injection. These flags do not remove credentials already copied into a source snapshot.
+- For an existing box, disable Vault with `start BOX --no-vault` or `resume BOX --no-vault` and explicitly clear both Secret selections with `secrets select BOX --secrets none --env-secrets none`. Refresh a running guest with both `vault push BOX` and `secrets push BOX`. Existing processes and copied files can retain values; disabling either system does not recover those copies.
+- Vault remains available through `vault set`, `set-file`, `import`, `ls`, `rm`, `show`, and `push`. The CLI warns about future retirement. A box may use Vault and Secrets together; Secrets wins same-named environment variables. Neither store automatically copies or deletes the other. Move values deliberately when the user is ready.
 
 ## Moving work onto a box
 

package/skills/instabox-basic-setup/SKILL.md

@@ -1,108 +1,108 @@
 ---
 name: instabox-basic-setup
-description: Use when the user wants their instabox boxes set up like their laptop — "put my tokens / dotfiles / git config into instabox", "set up my boxes like my laptop", "give every box my GitHub and Claude tokens", "move my setup to instabox", "move everything to instabox". Scans this machine, lets the user pick from a checkbox plan, then puts the picks into their instabox Vault, so every box (and every box created later) gets them: tokens (GH_TOKEN, CLAUDE_CODE_OAUTH_TOKEN, model and service API keys) as environment variables, and git and editor config (~/.gitconfig, global gitignore, ~/.vimrc, nvim, ~/.tmux.conf) as files. Moves no code: for a repo, use instabox-move-repo.
+description: Use when the user wants their instabox setup to use local tokens, git config or editor config — "put my tokens / dotfiles / git config into instabox", "set up my box like my laptop", "move my setup to instabox". Produces a names-only scan and a reviewable plan, saves selected credentials as org key=value Secrets with explicit proxy/env modes, grants them only through sandbox selections, and copies approved ordinary config files directly to named running sandboxes. It does not put files in the Secret store or automatically give real credentials to future boxes. Moves no code; for a repo, use instabox-move-repo.
 metadata:
   installed-by: instabox
 ---
 
-# Put a basic setup into the instabox Vault
+# Basic setup with org Secrets and sandbox config copies
 
-This skill puts the user's personal setup into their instabox **Vault** (`instabox vault`: per-user secrets and files, written into their boxes), so every box of theirs starts with it: the ones running now (at their next start or resume, or at once with `instabox vault push <box>`) and every box created later. It copies no repository, no agent history, installs nothing and touches no box directly. To move a repository, use the `instabox-move-repo` skill. See the `instabox` skill for the CLI.
+Use the user's chosen org and sandbox IDs. Secrets are shared within an org, but real-value `env` delivery requires explicit sandbox selection. A `proxy` Secret supplies a placeholder for HTTPS header substitution at its allowed hosts. Other org sandboxes selecting all proxy Secrets, including future sandboxes, can also use a newly saved proxy credential. Updating an existing Secret affects every sandbox already authorized to use it.
 
-What it moves, and nothing else:
+Git and editor configuration is copied separately, once, to the named running sandboxes. It is not stored as Secrets, does not consume Secret quota, and is not reapplied on start or resume. This skill moves no repository or agent history. Use `instabox-move-repo` for code and conversation history.
 
-| Group | Becomes | From |
+| Group | Destination | Sources |
 | --- | --- | --- |
-| Tokens | Vault `env` items: on tmpfs in the box, set in every login shell; gone at a stop, back at the next start; never in a snapshot | `GH_TOKEN` from `gh auth token`; well-known model and service tokens exported in the shell files (`ANTHROPIC_API_KEY`, `CLAUDE_CODE_OAUTH_TOKEN`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, `OPENROUTER_API_KEY`, `HF_TOKEN`, `NPM_TOKEN`, `VERCEL_TOKEN`, `CLOUDFLARE_API_TOKEN`, `SUPABASE_ACCESS_TOKEN`, `FLY_API_TOKEN`, `SENTRY_AUTH_TOKEN`, `LINEAR_API_KEY`, ...) or in this shell's environment. Other credential-looking exports are listed unchecked. |
-| Git | Vault `file` items in the box's home | `~/.gitconfig` (and `~/.config/git/config`), the global gitignore |
-| Editor and terminal | Vault `file` items | `~/.vimrc`, nvim's `init.lua` / `init.vim` and the `.lua` / `.vim` files around it (no plugin checkouts), `~/.tmux.conf` |
+| Tokens | Encrypted org key=value Secrets; explicit per-token `proxy` or `env` mode | GitHub token through `gh auth token`; known service credentials in the environment or shell startup files; other credential-like exports listed unchecked |
+| Git | Files under the selected sandbox's home | `.gitconfig`, `.config/git/config`, global gitignore |
+| Editor and terminal | Files under the selected sandbox's home | `.vimrc`, nvim config without plugin checkouts, `.tmux.conf` |
 
-Four scripts in `scripts/` next to this file do the parts that must be exact (Node 18+, nothing to install):
+The scripts beside this file require Node 18+ locally and Python 3 in sandboxes receiving config files:
 
-| Script | Does |
+| Script | Responsibility |
 | --- | --- |
-| `scan.mjs` | Read-only inventory, as JSON: tokens by name and place (never values), the files, and what cannot move. |
-| `plan.mjs` | `write`: the checkbox plan. `parse`: reads the edited plan back, strictly, as JSON. |
-| `push.mjs` | Puts the picks into the Vault, piping each value from its source into `instabox vault set` / `set-file`. `--dry-run` first. |
-| `content.mjs` | What a file becomes in the Vault (used by the other two). |
+| `scan.mjs` | Read-only inventory of names, source locations, sizes and manual setup requirements; no credential values in output |
+| `plan.mjs` | Write and strictly parse the editable plan, binding it to an org and Secret metadata |
+| `push.mjs` | Read approved values into memory, validate all inputs and quotas, save Secrets through CLI stdin, merge explicit sandbox selections, and copy config |
+| `content.mjs` | Rewrite HOME paths, remove recognized credential lines, and adapt git/editor configuration for Linux |
+| `install-files.py` | Install ordinary config files privately, refusing symlinks and unsafe paths; no Secret-store or legacy Vault access |
 
-**Never read, print or paste a credential value yourself**: not `gh auth token`, not `echo $OPENAI_API_KEY`, not `cat` of a shell file or of `~/.gitconfig`, never the macOS keychain. `push.mjs` is the only thing that touches values. If something needs a value the scripts cannot get, tell the user the command to run themselves (`instabox vault set NAME` prompts without echo).
+Never print credential values, shell startup files, credential-bearing config, or `gh auth token` output. Do not run these scripts against the user's machine unless their request authorizes this setup. Scripts may read credentials internally; their output is limited to names, sizes and outcomes. If a value cannot be obtained, let the user supply it through a hidden CLI prompt with the appropriate org and delivery mode.
 
-Before starting, tell the user plainly: a scan of this machine (nothing changes here), a plan file they edit, then their Vault gets what they checked. By default every box they have and will create gets it; they can scope it with a selector. Nothing is copied from a box back here, and nothing keeps the two in sync: to change something later, change it here and run this again.
-
-## 1. Scan
+## 1. Scan and choose the org
 
 ```bash
-instabox whoami                                    # signed in? otherwise: instabox login
-S=~/.claude/skills/instabox-basic-setup/scripts    # or ~/.agents/skills/instabox-basic-setup/scripts: wherever this file is
-W=~/instabox-basic-setup && mkdir -p -m 700 "$W"
+instabox whoami
+instabox org ls --json
+S=~/.claude/skills/instabox-basic-setup/scripts # or the installed ~/.agents/skills path
+W=$(mktemp -d)
 node "$S/scan.mjs" > "$W/scan.json"
-instabox vault ls --json > "$W/vault.json"         # what is in the Vault already (names, no values)
+ORG_ID=<stable-org-id>
+instabox secrets ls --org "$ORG_ID" --json > "$W/secrets.json"
 instabox usage --json | jq '.limits.vault // {}' > "$W/limits.json"
 ```
 
-`instabox vault ls` fails with `API keys cannot manage the vault` when `INSTABOX_API_KEY` is set: ask the user to unset it and `instabox login`. A `404` means the server has no Vault: stop and say so.
+Saving Secret values requires an org owner/admin sign-in. An API key can read metadata but cannot import values. Do not change the user's authentication silently: if value management is rejected, explain that they need an owner/admin session. A 404 for Secret routes means Secret management is not configured on that server.
+
+Use `instabox get <box> --json` to resolve each intended sandbox to its stable `m_...` ID and confirm its `orgId`. No sandbox is required when the user only wants to save credentials. Config copying requires explicitly named running sandboxes; do not create a box merely to verify setup unless creation is authorized.
 
-## 2. Write the plan and let the user choose
+## 2. Prepare a concrete plan
 
 ```bash
-node "$S/plan.mjs" write --scan "$W/scan.json" --vault "$W/vault.json" > "$W/plan.md"
+node "$S/plan.mjs" write --scan "$W/scan.json" --secrets "$W/secrets.json" \
+  --org "$ORG_ID" --sandbox <sandbox-id> > "$W/plan.md"
 ```
 
-Add `--selector key=value` (comma-separated for more) only if the user wants the setup on some boxes, not all; the plan's `Selector:` line can be edited too (`*` is every box). A box gets the items when its metadata has every label (`instabox create --meta key=value`).
+Repeat `--sandbox` for additional targets, or omit it to save Secrets without adding env grants or copying files. The plan lists `Org`, `Sandboxes`, checkboxes and one `Delivery` line per token. The org is bound to the metadata used to generate the plan; regenerate for another org. Sandbox IDs and delivery policies can be edited in the plan.
 
-`plan.md` has a `- [x]` / `- [ ]` line per item, in three sections (Tokens, Git, Editor and terminal), then a "Can't move" list with no checkboxes. Defaults:
+A token policy looks like either of these:
+
+```text
+Delivery `env:SERVICE_API_KEY`: `proxy` hosts `api.example.com`
+Delivery `env:DATABASE_URL`: `env` hosts `-`
+```
 
-- Well-known tokens and every file are checked. Other credential-looking exports, and tokens the shell reads from the macOS keychain, are unchecked (checking the latter runs that keychain lookup once, at push time).
-- Something already in the Vault, set there some other way than this skill, is unchecked and says so: checking it **replaces** it (for every box its selector reached). Items this skill set on an earlier run are replaced without asking (the manifest, step 3).
+The `env:` prefix is the scanner's variable ID, not its delivery mode. New token rows start with explicit `env` mode for client compatibility; this gives the named sandboxes the real value. Choose `proxy` and exact approved hosts when the client sends the value literally in an HTTPS header on port 443. Do not infer hosts from a token's value or silently switch modes when a client fails. Native database protocols, local signing and git's encoded credential exchange need the real value or a separate protocol-aware broker. Proxy placeholders cannot be used as real signing or encoding inputs.
 
-Show the user a short summary (which tokens, which files, what cannot move) and the path of the file, and ask them to edit the checkboxes and the selector, then tell you to go on. In Claude Code you may ask a coarse question first with AskUserQuestion (multiSelect: "Tokens / Git / Editor and terminal") and apply the answer by changing only `[x]` and `[ ]`; the user still gets the file for details.
+Well-known token rows are checked by default; unknown and keychain-backed sources are unchecked. Existing Secrets changed outside the last successful run are unchecked, and checking them authorizes replacement in the org. A previous proxy mode is preserved as the starting policy on a repeat run. Files are unchecked when no sandbox is selected. Checking a config file authorizes replacement of that path on each named sandbox.
 
-When they are done, read it back:
+Show the concrete names, modes, allowed hosts, org and target sandboxes. Obtain any choices or authorization the original request did not already provide before reading values or writing. Do not ask again for an action already explicitly authorized. Explain that env values are readable by sandbox code and may persist in processes, files or snapshots; removing a selection cannot recover them.
+
+Parse the approved plan:
 
 ```bash
-node "$S/plan.mjs" parse --scan "$W/scan.json" --vault "$W/vault.json" --limits "$W/limits.json" "$W/plan.md" > "$W/selection.json"
+node "$S/plan.mjs" parse --scan "$W/scan.json" --secrets "$W/secrets.json" \
+  --org "$ORG_ID" --limits "$W/limits.json" "$W/plan.md" > "$W/selection.json"
 ```
 
-- Exit 1: the plan has problems (a malformed checkbox, a line deleted or duplicated, an unknown id, a bad selector, a plan from another scan or Vault state, a file that became empty or over 64 KiB). All are listed; show them, fix or let the user fix, parse again. Never fix a plan by editing ids or deleting lines. If the scan or Vault changed, run step 1 and 2 again.
-- Exit 3: over the Vault's limits (100 items, 256 KiB in all, items already there included; 64 KiB per item). The message gives the totals and the biggest lines: ask the user what to uncheck (nvim's files are one item each), or which old Vault items to remove (`instabox vault rm NAME`), then parse again.
+Exit 1 identifies malformed or missing rows, invalid policies, a changed org/catalog, unsafe config, or a file selection without targets. Fix choices without changing item IDs or deleting rows. Exit 3 identifies quota or copy-size limits. Config files have their own copy limits and do not count as Secret entries. Values are measured before push; plan generation never reads token values. Legacy selector-based plans and manifests grant no authority in the new model and must be regenerated.
 
-## 3. Push into the Vault
+## 3. Dry-run, then apply the approved selection
 
 ```bash
-node "$S/push.mjs" --selection "$W/selection.json" --dry-run   # names, sizes, totals; writes nothing
+node "$S/push.mjs" --selection "$W/selection.json" --dry-run
 node "$S/push.mjs" --selection "$W/selection.json"
 ```
 
-Show the user the dry run's lines before the real run. Values go from their source (`gh auth token`, a variable after sourcing the user's shell file, this environment) straight into the CLI's stdin. A shell file that only exports when interactive (the usual `case $- in *i*)` guard) is sourced a second time in an interactive shell, which may run its prompt setup; a token it still does not yield comes from this environment, or fails with the reason; the output is names, sizes and outcomes. Every value is read and the totals checked before anything is written: over the limits, nothing is written (exit 3). An item that appeared in the Vault after the plan was written is left alone (`kept`). A `failed` line names the item and why; give the user the command to set it themselves (`instabox vault set NAME`, which prompts without echo). Re-running is safe: the same items are set again.
+The dry-run reads the approved credential sources and prepares filtered config, but makes no writes to InstaBox and does not change its local manifest. Sourcing a shell startup file may run its local initialization code; an approved keychain-backed source may invoke its lookup. Values remain in memory and CLI stdin, never in the plan, manifest, arguments or logs. Review the dry-run's metadata before applying any action not yet authorized.
 
-The run records what it set in `~/.config/instabox-basic-setup/pushed.json` (names, kinds, paths; no values), so the next run knows those are its own.
+The pusher verifies org ownership, target orgs, Secret IDs and versions, input limits and total Secret quota before mutations. If a selected Secret changed since planning, regenerate the plan. These are preflight checks, not a transaction across all CLI operations: concurrent org edits can still occur during application. A failed run reports partial outcomes; successfully saved Secrets remain in the org. Do not assume rollback or automatic removal of previously copied files.
 
-What a file becomes (counted per file in the plan's sizes):
+Only selected token names are added to each target's grants; existing selections are preserved, including proxy `all`. Env selection never becomes `all`. Running targets receive an immediate managed-environment refresh; stopped targets can receive selections for their next start, but config copying requires them to be running. A failed or pending guest refresh does not install config that may depend on those credentials. Existing processes need to reload their environment or restart.
 
-- This machine's HOME is rewritten to the box's (`/data/home`); lines that look like a credential are replaced by a comment; macOS-only lines (`osxkeychain`, Homebrew paths, `pbcopy`, `reattach-to-user-namespace`, ...) are commented out.
-- `~/.gitconfig` also: commit and tag signing is turned off (`gpgsign`: the signing key is not on the box), `url."git@...".insteadOf` rewrites are commented out (the box has no SSH key), and when `GH_TOKEN` is in the Vault, gh's credential helper for github.com is added (what `gh auth setup-git` writes), so `git clone https://github.com/...` and `git push` use the token.
+Files are transformed before direct copying: this machine's HOME becomes `/data/home`, recognized credential lines are removed, macOS-only lines and unsupported signing/SSH rewrites are commented out. Structured config suspected of containing credentials is rejected rather than copied verbatim. This filtering is best effort, not a guarantee that arbitrary configuration is credential-free. The gh git helper is added only when this plan explicitly selects `GH_TOKEN` with env delivery. An existing org Secret by itself is not a sandbox grant; reuse it through an explicitly reviewed `instabox secrets select` update if needed, preserving other selected names.
 
-## 4. Verify on a box (optional)
+The local manifest at `~/.config/instabox-basic-setup/pushed.json` stores org IDs, Secret IDs/versions/modes and copied sandbox paths, never values. It does not grant reuse across orgs or across deletion and recreation of a Secret. It records completed work for a repeat plan; it does not sync changes automatically.
 
-If the user names a running box (`instabox ls`), or wants one to try, write the Vault into it now and look:
+## 4. Verify and report
 
 ```bash
-BOX=<box>
-instabox vault push "$BOX"            # writes now; lists variables and files written, and any "kept" path
-instabox vault show "$BOX"            # what it gets with its metadata
-instabox exec "$BOX" -- 'gh auth status; git config --get user.name; test -n "${CLAUDE_CODE_OAUTH_TOKEN-}${ANTHROPIC_API_KEY-}" && echo claude token set'
+instabox secrets show <box>
+instabox exec <box> -- 'test "${GH_TOKEN+x}" = x && test -f "$HOME/.gitconfig"'
 ```
 
-A `kept: ~/path (not written: ... symlink ...)` line means the box has a symlink in that path; tell the user. Check presence of a token, never print one. A box created with `--no-vault` gets nothing, ever; one whose metadata does not match the selector gets nothing either. Do not create a box for this unless the user asks.
-
-## 5. Report
-
-Tell the user, in short sections:
+Use silent presence checks and metadata; never print variables to verify them. A placeholder's presence does not prove proxy authorization or upstream success. Confirm client behavior without logging credentials, and explain application restarts when env values changed.
 
-- **In your Vault**: each token by name, each file by path, and which boxes get them (every box, or the selector). Running boxes get them at their next start or resume, or now with `instabox vault push <box>`; new boxes at once.
-- **Left alone**: what they unchecked, items kept because they were set some other way, failures with the reason. Items from an earlier run they unchecked this time are still in the Vault (the push prints them): `instabox vault rm NAME` removes one, and boxes lose it at their next write.
-- **Do these yourself**: every entry of `.manual` in `selection.json`, with its command, for example: Claude Code's sign-in — run `claude setup-token` here yourself, then `instabox vault set CLAUDE_CODE_OAUTH_TOKEN` and paste it (or `claude`, then `/login`, on each box); Codex — `codex login --device-auth` on the box, or `instabox vault set OPENAI_API_KEY`; `gh auth login` here if gh is not signed in.
-- **Good to know**: Vault files are written again at every start and resume, so an edit made to them on a box is replaced; change them here and run this skill again (or `instabox vault rm` the item to keep a box's own copy). Tokens are environment variables of login shells (SSH, `instabox exec`, the terminal), not of systemd services. Shell aliases, SSH keys, cloud credential files and agent config are not part of this setup.
+Report the org Secret names and modes saved, sandbox IDs whose selections changed, config paths copied, failures and manual setup steps. Saving env Secrets without targets adds no grants; replacing a value still affects sandboxes already authorized to use it. Future boxes without Secret selection flags keep their existing Vault behavior. At creation, selecting env Secrets alone also selects all org proxy Secrets; add an explicit proxy selection to narrow that access. Previously saved credentials or config not selected this time remain; deletion or cleanup needs its own intended scope. Rotate or revoke upstream when a previously delivered env value must stop working.
 
-Delete `$W` when the user is done with it (it holds the scan, the plan and the Vault's item names, no values).
+Config edits in a sandbox are not overwritten at every resume. Shell aliases, SSH keys, cloud credential files, agent sign-in databases and repositories are outside this inventory. Complete the selected manual sign-in steps only within existing authorization. Remove `$W` when no longer needed; it contains metadata and choices, not credential values.

package/skills/instabox-basic-setup/scripts/content.mjs

@@ -1,4 +1,4 @@
-// What a file item's content becomes in the Vault: the local file with this
+// What a directly copied configuration file becomes: the local file with this
 // machine's HOME rewritten to the box's, lines that look like credentials
 // removed and macOS-only lines commented out. ~/.gitconfig also gets a few
 // changes so git works on a box that has GH_TOKEN and no SSH key.
@@ -43,7 +43,7 @@ export function scrubText(text, { path, home }) {
 // The credential helper `gh auth setup-git` writes: git over HTTPS uses GH_TOKEN through gh.
 export const GH_HELPER = [
   '',
-  `# ${TAG}: git over HTTPS to GitHub uses GH_TOKEN (from the Vault) through gh`,
+  `# ${TAG}: git over HTTPS to GitHub uses an explicitly selected env GH_TOKEN through gh`,
   '[credential "https://github.com"]',
   '\thelper =',
   '\thelper = !gh auth git-credential',
@@ -53,7 +53,7 @@ export const GH_HELPER = [
   '',
 ].join('\n');
 
-// ~/.gitconfig for the box. ghToken: GH_TOKEN goes to the Vault too, so the gh helper is added.
+// ~/.gitconfig for the box. ghToken: GH_TOKEN is explicitly selected for env delivery, so the gh helper is added.
 // Changes, besides scrubText's:
 //  - commit/tag signing is turned off: the signing key (GPG, SSH, 1Password) is not on the box;
 //  - url.<ssh>.insteadOf rewrites are commented out: the box has no SSH key, and they would
@@ -90,9 +90,14 @@ export function fileContent(f, { home, ghToken = false } = {}) {
   } catch (e) {
     return { error: `${f.src}: ${e.code || 'unreadable'}` };
   }
-  if (buf.includes(0)) return { error: `${f.src}: a binary file (the Vault holds text only)` };
+  if (buf.includes(0)) return { error: `${f.src}: a binary file (config copying supports UTF-8 text only)` };
   const text = buf.toString('utf8');
+  if (!Buffer.from(text).equals(buf)) return { error: `${f.src}: invalid UTF-8 text` };
   if (f.transform === 'gitconfig') return gitconfigText(text, { home, ghToken });
-  if (f.transform === 'raw') return { text, secrets: 0, macos: 0 };
+  if (f.transform === 'raw') {
+    if (SECRET_VALUE.test(text) || text.split('\n').some((line) => SECRET_KEY_LINE.test(line)))
+      return { error: `${f.src}: possible credential in structured config; review it separately` };
+    return { text, secrets: 0, macos: 0 };
+  }
   return scrubText(text, { path: f.path, home });
 }

package/skills/instabox-basic-setup/scripts/install-files.py

@@ -0,0 +1,82 @@
+# One-time config copying, run as the sandbox user. This is not Secret delivery.
+import json
+import os
+import stat
+import sys
+
+HOME = '/data/home'
+MARKER = 'INSTABOX-BASIC-SETUP '
+DIRECTORY = os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW
+
+
+def valid_path(path):
+    return (isinstance(path, str) and 0 < len(path) <= 255
+            and not any(ord(c) < 32 or ord(c) == 127 or c == '\\' for c in path)
+            and all(p and p != '.' and not p.startswith('..') for p in path.split('/')))
+
+
+def install_files(files, home=HOME):
+    results = []
+    for entry in files:
+        path = entry.get('path')
+        result = {'path': path, 'status': 'failed'}
+        results.append(result)
+        if not valid_path(path) or not isinstance(entry.get('text'), str):
+            continue
+        data = entry['text'].encode('utf-8')
+        if len(data) > 64 * 1024 or b'\x00' in data:
+            continue
+        fd = None
+        temporary = None
+        try:
+            fd = os.open(home, DIRECTORY)
+            parts = path.split('/')
+            for part in parts[:-1]:
+                try:
+                    os.mkdir(part, 0o700, dir_fd=fd)
+                except FileExistsError:
+                    pass
+                child = os.open(part, DIRECTORY, dir_fd=fd)
+                os.close(fd)
+                fd = child
+            name = parts[-1]
+            try:
+                current = os.stat(name, dir_fd=fd, follow_symlinks=False)
+                if not stat.S_ISREG(current.st_mode):
+                    continue
+            except FileNotFoundError:
+                pass
+            temporary = '.instabox-setup-' + os.urandom(8).hex()
+            output = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600, dir_fd=fd)
+            with os.fdopen(output, 'wb') as stream:
+                stream.write(data)
+                stream.flush()
+                os.fsync(stream.fileno())
+                os.fchmod(stream.fileno(), 0o600)
+            os.rename(temporary, name, src_dir_fd=fd, dst_dir_fd=fd)
+            temporary = None
+            result['status'] = 'written'
+        except Exception:
+            # The remote shell and filesystem are untrusted. Return only fixed
+            # outcomes; exception text and config contents never reach logs.
+            pass
+        finally:
+            if fd is not None:
+                if temporary:
+                    try:
+                        os.unlink(temporary, dir_fd=fd)
+                    except OSError:
+                        pass
+                os.close(fd)
+    return results
+
+
+if __name__ == '__main__':
+    try:
+        payload = json.load(sys.stdin)
+        result = install_files(payload['files'])
+        sys.stdout.write(MARKER + json.dumps({'files': result}) + '\n')
+        sys.exit(0 if all(item['status'] == 'written' for item in result) else 1)
+    except Exception:
+        sys.stdout.write(MARKER + '{"error":"config copy failed"}\n')
+        sys.exit(1)