instabox 0.6.3 → 0.6.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instabox",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest",
   "type": "module",
   "bin": {

package/skills/instabox/SKILL.md

@@ -18,7 +18,7 @@ instabox login               # confirm the browser's account, or choose GitHub /
 
 A GitHub sign-in and a Google sign-in with the same verified email share one account; with different emails they are separate accounts with separate boxes. Both `instabox login` and `npx instabox@latest` open account confirmation in the browser: use its current Instabox account or choose another. To go directly to a provider, use `instabox login --provider github|google`, or `npx instabox@latest --github|--google`. The CLI shares the sign-in `npx` made. Device-code sign-in (`--device`) uses GitHub.
 
-For CI or an agent without a browser, use an API key instead: `export INSTABOX_API_KEY=ibk_...` (the user creates it on the dashboard's API Keys page). Never print, commit or log a key.
+For CI or an agent without a browser, use an API key instead: `export INSTABOX_API_KEY=ibk_...` (the user creates it in the dashboard: Profile → API keys (account menu)). Never print, commit or log a key.
 
 ## Templates
 
@@ -27,6 +27,7 @@ For CI or an agent without a browser, use an API key instead: `export INSTABOX_A
 - `universal`: the same tools without the desktop, which installs itself the first time it is used (about half a minute); a smaller root disk. The dashboard shows it as **basic**.
 - `herdr`: for the herdr client.
 - `orca`: for Orca desktop and mobile.
+- `t3`: for the T3 Code desktop and mobile clients.
 
 `instabox templates` lists the ones this server offers. The free plan creates boxes from `agent-browser` only: another template is refused with `403 template_not_allowed` and needs a paid plan (the user upgrades on the dashboard). A box from a snapshot (`--snapshot`) works on every plan, whatever template the snapshot came from. Do not retry another template on the free plan; use `agent-browser`.
 
@@ -52,7 +53,9 @@ instabox ssh work                               # interactive shell (leave with:
 instabox exec work -- uname -a                  # one command, no SSH client needed
 instabox exec work --cwd /data/home -- ls -la   # exec runs `bash -lc` as the box's user
 instabox files work /data/home                  # list a directory (or print a text file)
-instabox auto-suspend work 10m                  # idle time before it pauses (fixed at 30m unless an admin gave the account manual lifecycle)
+instabox auto-suspend work 10m                  # idle time before a paid box pauses
+instabox max-run work 120                      # pause a paid box after two running hours
+instabox max-run work -1                       # remove the runtime cap; idle policy still applies
 instabox stop work && instabox start work       # stop ends processes, keeps disks
 instabox suspend work && instabox resume work   # pause/resume keeps running processes
 instabox rename work api                        # rename in place, any state; ID and port URLs stay
@@ -60,41 +63,43 @@ instabox rm work                                # delete the box
 ```
 
 - Names or IDs (`m_...`) both work wherever `<id-or-name>` is accepted.
-- `create` options: `--template T` or `--snapshot S`, `--vcpus N --mem-mib M` (a size of the plan, see Sizes), `--auto-suspend D|0`, `--meta K=V`, `--org O`, `--secrets all|NAME,NAME|none`, `--env-secrets NAME,NAME|none`, `--no-wait`.
-- A box pauses itself after 30 idle minutes (no agent working, no terminal use, little CPU) and wakes on the next `exec`, `ssh`, `files`, public port request or `instabox wake <box>`; a paused box keeps its memory and processes. The 30 minutes are fixed for every account unless an admin gave it manual lifecycle: only then do `--auto-suspend 0` (always on) and `--auto-suspend 2h` apply, and the CLI prints a note when the server kept 30m. Boxes have no other timeout. Do not try to keep a box on by other means; a paused box resumes on the next command.
+- `create` options: `--template T` or `--snapshot S`, `--vcpus N --mem-mib M` (a size of the plan, see Sizes), `--auto-suspend D|0`, `--max-run-minutes N`, `--meta K=V`, `--org O`, `--secrets all|NAME,NAME|none`, `--no-wait`.
+- Idle auto-pause defaults to 30 minutes. Paid boxes allow 5, 10, 15, 20, 25 or 30 minutes, or `0` to turn it off. Free boxes keep 30 minutes unless an admin grants an idle override. Idle means no agent working, no terminal use and little CPU.
+- Max run minutes is independent of idle activity: `-1` is unlimited, `0` pauses immediately, and a positive integer forces a pause after that many running minutes. Free boxes have a fixed 480-minute cap that only an admin session can change; paid boxes default to `-1` and can change it. An idle override does not permit changes to a free box's runtime cap. The first limit reached pauses the box; both timers restart after sleep and wake.
+- A runtime pause blocks every wake path during a server-configured cooldown, 10 minutes by default. Wait until the `cooldownUntil` deadline shown by `instabox get`; edits cannot clear it. Afterward, an automatically paused box wakes on `exec`, `ssh`, `files`, a public port request or `instabox wake <box>`. A zero runtime cap must be changed before waking. A normal pause preserves memory and processes.
 - Use `exec` to run a command and read its output, and `ssh` for an interactive shell.
-- `exec` returns the command's exit code and takes `--stdin` to pipe input. It stops the command after `--timeout` seconds: 60 by default, 600 at most. Run anything longer (installs, builds, test suites) over SSH, which has no time limit and also returns the exit code: `instabox ssh work -- 'cd /data/workspace/app && npm ci'`.
+- `exec` returns the command's exit code and takes `--stdin` to pipe input. It stops the command after `--timeout` seconds: 60 by default, 600 at most. Run longer commands (installs, builds, test suites) over SSH, which also returns the exit code: `instabox ssh work -- 'cd /data/workspace/app && npm ci'`. The box's runtime cap still applies during SSH or exec.
 - The box's HOME has `MACHINE.md` (which box it is, its size, what survives a stop, the installed tools) and `AGENTS.md`. Both are worth reading before working in the box; they appear a moment after it starts.
 - A public URL for a web server in the box: `instabox port publish work 3000` prints it (`instabox port ls`, `instabox port unpublish work 3000`). The URL works while the box runs.
 
 ## Organization Secrets
 
-Secrets are encrypted key=value entries owned by an org. Each entry has one delivery mode:
+Secrets are encrypted API credentials owned by an org, each limited to the HTTPS hosts it may be sent to. A box that selects a Secret gets a placeholder in its environment, never the credential itself. When a request from the box goes to one of the Secret's allowed hosts over HTTPS, the outbound proxy swaps the placeholder in the request headers for the credential. Code in the box can call the API but cannot read or copy the credential. No header-name configuration is needed.
 
-- `proxy`: the box receives a placeholder. The outbound proxy replaces it in ordinary HTTPS header values only when the destination matches the Secret's allowed hosts. Code in the box can use this credential but does not receive its real value through Secret delivery. No header-name configuration is needed.
-- `env`: the box receives the real value. Use this explicitly for native database credentials, local signing, and clients that cannot use header substitution. Code running in the box can read and copy the value.
+Secrets suit HTTP API keys and tokens that a client sends in a request header: model providers, GitHub's API, deploy and SaaS APIs. They do not cover database URLs or passwords, signing keys, or anything a client hashes, encodes or sends outside an HTTPS header; those need their own setup on the box.
 
-A new box without Secret selection flags keeps the existing Vault behavior. Opt into Secrets with `--secrets` or `--env-secrets`, or use `secrets select` later. At creation, `--env-secrets` alone also selects all org proxy Secrets. Select env names explicitly; there is no env `all` mode. Metadata labels do not select Secrets, and Secrets do not deliver files.
+Secrets replace the Vault, which is legacy and will be retired: save every new API credential as a Secret, never in the Vault, and do not suggest `vault set`, `set-file` or `import` to users. A new box without `--secrets` still gets an existing user's Vault items (see the last point below). Opt into Secrets with `create --secrets`, or use `secrets select` later. Metadata labels do not select Secrets, and Secrets do not deliver files.
 
 ```sh
 instabox secrets ls --org team                 # metadata only
-instabox secrets show work                    # selection and independent proxy/guest status
-instabox secrets set SERVICE_API_KEY --org team --delivery proxy --host api.example.com
-instabox secrets set DATABASE_URL --org team --delivery env
-instabox create --name app --org team --secrets SERVICE_API_KEY --env-secrets DATABASE_URL
-instabox secrets select work --env-secrets DATABASE_URL
-instabox secrets push work                    # refresh managed env/trust on a running box
-instabox create --name tenant --no-vault --secrets none --env-secrets none
+instabox secrets show work                     # selection and proxy status
+instabox secrets set SERVICE_API_KEY --org team --host api.example.com
+instabox secrets import .env --org team --host api.example.com   # every value gets these hosts
+instabox create --name app --org team --secrets SERVICE_API_KEY
+instabox secrets select work --secrets SERVICE_API_KEY,OTHER_API_KEY
+instabox secrets push work                     # refresh the selection on a running box
+instabox create --name tenant --no-vault --secrets none
 ```
 
-- Values for `set` come from stdin or a hidden prompt. Never print a credential or put its value into agent output, chat, command arguments, or logs. Before asking for a credential, check metadata with `secrets ls --org <org>` and `secrets show <box>`. A silent check such as `test "${NAME+x}" = x` tests variable presence without revealing it; it does not prove successful proxy authorization.
-- Org commands default to the signed-in user's personal org. Use `--org` for a team, and select only Secrets from the box's org. Value, host, delivery-mode and deletion changes require an org owner/admin sign-in. API keys with the appropriate machine scopes can inspect metadata and manage sandbox selections, but cannot retrieve or change Secret values.
-- Selection updates replace each supplied list; omitted lists remain unchanged. Preserve existing names when adding to a selection. Proxy selection accepts `all`; both selections accept `none` or `[]`. JSON arrays allow a Secret literally named `all` or `none`.
-- Proxy delivery requires allowed hosts and works with literal placeholders in HTTPS headers on port 443. Do not hash, encode, or sign with a placeholder. Native database TLS is not HTTPS. Unsupported traffic never falls back to real-value env delivery.
-- Rotating an existing proxy value preserves its placeholder. Env refresh and newly added variables affect new shells that load the managed environment; restart or reconfigure existing applications and connection pools. Removing a selection cannot recover env values already copied into processes, files, or snapshots. Revoke or rotate those credentials at the upstream service when necessary.
-- For a box intended for another person or tenant, disable personal Vault injection with `--no-vault` and explicitly select only the org Secrets they may use. For a fresh box with neither system's credentials, use `--no-vault --secrets none --env-secrets none`. Empty Secret selections alone still permit Vault injection. These flags do not remove credentials already copied into a source snapshot.
-- For an existing box, disable Vault with `start BOX --no-vault` or `resume BOX --no-vault` and explicitly clear both Secret selections with `secrets select BOX --secrets none --env-secrets none`. Refresh a running guest with both `vault push BOX` and `secrets push BOX`. Existing processes and copied files can retain values; disabling either system does not recover those copies.
-- Vault remains available through `vault set`, `set-file`, `import`, `ls`, `rm`, `show`, and `push`. The CLI warns about future retirement. A box may use Vault and Secrets together; Secrets wins same-named environment variables. Neither store automatically copies or deletes the other. Move values deliberately when the user is ready.
+- Values for `set` come from stdin or a hidden prompt. Never print a credential or put its value into agent output, chat, command arguments, or logs. Before asking for a credential, check metadata with `secrets ls --org <org>` and `secrets show <box>`. A silent check such as `test "${NAME+x}" = x` tests that the placeholder is present without revealing it; it does not prove the upstream accepts the credential.
+- `--host` is required and repeatable: give each exact hostname the credential may be sent to (no scheme, port, path, wildcard or IP address). Use the service's API host, such as `api.openai.com`, never a guess from the credential's value.
+- Org commands default to the signed-in user's personal org. Use `--org` for a team, and select only Secrets from the box's org. Value, host and deletion changes require an org owner/admin sign-in. API keys with the appropriate machine scopes can inspect metadata and manage sandbox selections, but cannot retrieve or change Secret values.
+- `secrets select BOX --secrets` replaces the box's selection: `all`, `none`, comma-separated names, or a JSON array (which allows a Secret literally named `all` or `none`). Keep existing names when adding one.
+- Placeholders work only in HTTPS request headers on port 443 to the allowed hosts. Do not hash, encode, or sign with a placeholder; other traffic carries the placeholder unchanged.
+- Rotating a value keeps its placeholder, so running clients need no change. Newly selected names appear in new shells that load the managed environment; restart existing applications to pick them up.
+- For a box intended for another person or tenant, disable personal Vault injection with `--no-vault` and select only the org Secrets they may use. For a fresh box with neither system's credentials, use `--no-vault --secrets none`. An empty Secret selection alone still permits Vault injection. These flags do not remove credentials already copied into a source snapshot.
+- For an existing box, disable Vault with `start BOX --no-vault` or `resume BOX --no-vault` and clear the Secret selection with `secrets select BOX --secrets none`. Refresh a running guest with both `vault push BOX` and `secrets push BOX`. Vault values already copied into processes or files remain there; disabling Vault does not recover them.
+- The Vault is legacy and will be retired; every `vault` command prints a warning. Its commands remain only for items a user already saved: `vault ls`, `show`, `push` and `rm`, and `vault export` to recover a retained item. A box may use Vault and Secrets together; Secrets wins same-named environment variables. Neither store copies or deletes the other. To move a Vault env item that is an HTTP API credential, the user enters its value again as a Secret with its hosts (`secrets set NAME --host HOST` reads it from a hidden prompt), you select it on the box, then `vault rm` it with the user's go-ahead. Never read a Vault value to copy it. Database credentials and other non-HTTP secrets are not supported by Secrets and need their own setup on the box; Vault file items likewise.
 
 ## Moving work onto a box
 

package/skills/instabox-basic-setup/SKILL.md

@@ -1,19 +1,21 @@
 ---
 name: instabox-basic-setup
-description: Use when the user wants their instabox setup to use local tokens, git config or editor config — "put my tokens / dotfiles / git config into instabox", "set up my box like my laptop", "move my setup to instabox". Produces a names-only scan and a reviewable plan, saves selected credentials as org key=value Secrets with explicit proxy/env modes, grants them only through sandbox selections, and copies approved ordinary config files directly to named running sandboxes. It does not put files in the Secret store or automatically give real credentials to future boxes. Moves no code; for a repo, use instabox-move-repo.
+description: Use when the user wants their instabox setup to use local tokens, git config or editor config — "put my tokens / dotfiles / git config into instabox", "set up my box like my laptop", "move my setup to instabox". Produces a names-only scan and a reviewable plan, saves known API tokens as org Secrets for their service's HTTPS API hosts, selects them on named sandboxes, and copies approved ordinary config files directly to named running sandboxes. It does not put files in the Secret store. Moves no code; for a repo, use instabox-move-repo.
 metadata:
   installed-by: instabox
 ---
 
 # Basic setup with org Secrets and sandbox config copies
 
-Use the user's chosen org and sandbox IDs. Secrets are shared within an org, but real-value `env` delivery requires explicit sandbox selection. A `proxy` Secret supplies a placeholder for HTTPS header substitution at its allowed hosts. Other org sandboxes selecting all proxy Secrets, including future sandboxes, can also use a newly saved proxy credential. Updating an existing Secret affects every sandbox already authorized to use it.
+Use the user's chosen org and sandbox IDs. Secrets are shared within an org. A sandbox that selects a Secret gets a placeholder in its environment; the outbound proxy puts the token into HTTPS request headers sent to the Secret's allowed hosts, and nowhere else. Other org sandboxes whose selection is `all`, including future sandboxes, can also use a newly saved Secret. Updating an existing Secret affects every sandbox already selecting it.
+
+Only tokens in the built-in registry (`TOKEN_HOSTS` in `scripts/lib.mjs`) are saved, each for its service's API hosts: for example `ANTHROPIC_API_KEY` for `api.anthropic.com`, `OPENAI_API_KEY` for `api.openai.com`, `GH_TOKEN` and `GITHUB_TOKEN` for `api.github.com`. Every other credential-looking export becomes a manual step. Secrets work only for clients that send the token in an HTTPS header; database URLs, signing keys and git's own credential exchange need their own setup on the box.
 
 Git and editor configuration is copied separately, once, to the named running sandboxes. It is not stored as Secrets, does not consume Secret quota, and is not reapplied on start or resume. This skill moves no repository or agent history. Use `instabox-move-repo` for code and conversation history.
 
 | Group | Destination | Sources |
 | --- | --- | --- |
-| Tokens | Encrypted org key=value Secrets; explicit per-token `proxy` or `env` mode | GitHub token through `gh auth token`; known service credentials in the environment or shell startup files; other credential-like exports listed unchecked |
+| Tokens | Encrypted org Secrets, each limited to its registry hosts | GitHub token through `gh auth token`; registry tokens in the environment or shell startup files; other credential-like exports listed as manual steps |
 | Git | Files under the selected sandbox's home | `.gitconfig`, `.config/git/config`, global gitignore |
 | Editor and terminal | Files under the selected sandbox's home | `.vimrc`, nvim config without plugin checkouts, `.tmux.conf` |
 
@@ -23,11 +25,11 @@ The scripts beside this file require Node 18+ locally and Python 3 in sandboxes
 | --- | --- |
 | `scan.mjs` | Read-only inventory of names, source locations, sizes and manual setup requirements; no credential values in output |
 | `plan.mjs` | Write and strictly parse the editable plan, binding it to an org and Secret metadata |
-| `push.mjs` | Read approved values into memory, validate all inputs and quotas, save Secrets through CLI stdin, merge explicit sandbox selections, and copy config |
+| `push.mjs` | Read approved values into memory, validate all inputs and quotas, save Secrets with their registry hosts through CLI stdin, merge sandbox selections, and copy config |
 | `content.mjs` | Rewrite HOME paths, remove recognized credential lines, and adapt git/editor configuration for Linux |
 | `install-files.py` | Install ordinary config files privately, refusing symlinks and unsafe paths; no Secret-store or legacy Vault access |
 
-Never print credential values, shell startup files, credential-bearing config, or `gh auth token` output. Do not run these scripts against the user's machine unless their request authorizes this setup. Scripts may read credentials internally; their output is limited to names, sizes and outcomes. If a value cannot be obtained, let the user supply it through a hidden CLI prompt with the appropriate org and delivery mode.
+Never print credential values, shell startup files, credential-bearing config, or `gh auth token` output. Do not run these scripts against the user's machine unless their request authorizes this setup. Scripts may read credentials internally; their output is limited to names, sizes and outcomes. If a value cannot be obtained, let the user supply it through the hidden prompt of `instabox secrets set NAME --org ORG --host HOST`.
 
 ## 1. Scan and choose the org
 
@@ -53,20 +55,11 @@ node "$S/plan.mjs" write --scan "$W/scan.json" --secrets "$W/secrets.json" \
   --org "$ORG_ID" --sandbox <sandbox-id> > "$W/plan.md"
 ```
 
-Repeat `--sandbox` for additional targets, or omit it to save Secrets without adding env grants or copying files. The plan lists `Org`, `Sandboxes`, checkboxes and one `Delivery` line per token. The org is bound to the metadata used to generate the plan; regenerate for another org. Sandbox IDs and delivery policies can be edited in the plan.
-
-A token policy looks like either of these:
-
-```text
-Delivery `env:SERVICE_API_KEY`: `proxy` hosts `api.example.com`
-Delivery `env:DATABASE_URL`: `env` hosts `-`
-```
-
-The `env:` prefix is the scanner's variable ID, not its delivery mode. New token rows start with explicit `env` mode for client compatibility; this gives the named sandboxes the real value. Choose `proxy` and exact approved hosts when the client sends the value literally in an HTTPS header on port 443. Do not infer hosts from a token's value or silently switch modes when a client fails. Native database protocols, local signing and git's encoded credential exchange need the real value or a separate protocol-aware broker. Proxy placeholders cannot be used as real signing or encoding inputs.
+Repeat `--sandbox` for additional targets, or omit it to save Secrets without changing any selection or copying files. The plan lists `Org`, `Sandboxes` and checkboxes; each token row names the hosts its Secret is limited to. The org is bound to the metadata used to generate the plan; regenerate for another org. Sandbox IDs and checkboxes can be edited in the plan; hosts come from the registry and cannot.
 
-Well-known token rows are checked by default; unknown and keychain-backed sources are unchecked. Existing Secrets changed outside the last successful run are unchecked, and checking them authorizes replacement in the org. A previous proxy mode is preserved as the starting policy on a repeat run. Files are unchecked when no sandbox is selected. Checking a config file authorizes replacement of that path on each named sandbox.
+The `env:` prefix in a row ID is the scanner's variable ID. Registry token rows are checked by default; keychain-backed sources are unchecked. Existing Secrets changed outside the last successful run are unchecked, and checking them authorizes replacement in the org. Files are unchecked when no sandbox is selected. Checking a config file authorizes replacement of that path on each named sandbox.
 
-Show the concrete names, modes, allowed hosts, org and target sandboxes. Obtain any choices or authorization the original request did not already provide before reading values or writing. Do not ask again for an action already explicitly authorized. Explain that env values are readable by sandbox code and may persist in processes, files or snapshots; removing a selection cannot recover them.
+Show the concrete names, allowed hosts, org and target sandboxes. Obtain any choices or authorization the original request did not already provide before reading values or writing. Do not ask again for an action already explicitly authorized.
 
 Parse the approved plan:
 
@@ -75,7 +68,7 @@ node "$S/plan.mjs" parse --scan "$W/scan.json" --secrets "$W/secrets.json" \
   --org "$ORG_ID" --limits "$W/limits.json" "$W/plan.md" > "$W/selection.json"
 ```
 
-Exit 1 identifies malformed or missing rows, invalid policies, a changed org/catalog, unsafe config, or a file selection without targets. Fix choices without changing item IDs or deleting rows. Exit 3 identifies quota or copy-size limits. Config files have their own copy limits and do not count as Secret entries. Values are measured before push; plan generation never reads token values. Legacy selector-based plans and manifests grant no authority in the new model and must be regenerated.
+Exit 1 identifies malformed or missing rows, a changed org/catalog, a scan with a token outside the registry, unsafe config, or a file selection without targets. Fix choices without changing item IDs or deleting rows. Exit 3 identifies quota or copy-size limits. Config files have their own copy limits and do not count as Secret entries. Values are measured before push; plan generation never reads token values. Legacy selector-based plans and manifests grant no authority in the new model and must be regenerated.
 
 ## 3. Dry-run, then apply the approved selection
 
@@ -88,11 +81,11 @@ The dry-run reads the approved credential sources and prepares filtered config,
 
 The pusher verifies org ownership, target orgs, Secret IDs and versions, input limits and total Secret quota before mutations. If a selected Secret changed since planning, regenerate the plan. These are preflight checks, not a transaction across all CLI operations: concurrent org edits can still occur during application. A failed run reports partial outcomes; successfully saved Secrets remain in the org. Do not assume rollback or automatic removal of previously copied files.
 
-Only selected token names are added to each target's grants; existing selections are preserved, including proxy `all`. Env selection never becomes `all`. Running targets receive an immediate managed-environment refresh; stopped targets can receive selections for their next start, but config copying requires them to be running. A failed or pending guest refresh does not install config that may depend on those credentials. Existing processes need to reload their environment or restart.
+Only selected token names are added to each target's selection; existing names are preserved, and a target selecting `all` stays `all`. Running targets receive an immediate refresh; stopped targets receive the selection at their next start, but config copying requires them to be running. A failed or pending refresh does not install config that may depend on those credentials. Existing processes need to reload their environment or restart to see new placeholders.
 
-Files are transformed before direct copying: this machine's HOME becomes `/data/home`, recognized credential lines are removed, macOS-only lines and unsupported signing/SSH rewrites are commented out. Structured config suspected of containing credentials is rejected rather than copied verbatim. This filtering is best effort, not a guarantee that arbitrary configuration is credential-free. The gh git helper is added only when this plan explicitly selects `GH_TOKEN` with env delivery. An existing org Secret by itself is not a sandbox grant; reuse it through an explicitly reviewed `instabox secrets select` update if needed, preserving other selected names.
+Files are transformed before direct copying: this machine's HOME becomes `/data/home`, recognized credential lines are removed, macOS-only lines and unsupported signing/SSH rewrites are commented out. Structured config suspected of containing credentials is rejected rather than copied verbatim. This filtering is best effort, not a guarantee that arbitrary configuration is credential-free. No git credential helper is added: git over HTTPS sends credentials in a form the proxy cannot fill in, so the box needs its own git sign-in (for example `gh auth login` there). An existing org Secret by itself is not a sandbox selection; add it through an explicitly reviewed `instabox secrets select BOX --secrets ...` that keeps the other selected names.
 
-The local manifest at `~/.config/instabox-basic-setup/pushed.json` stores org IDs, Secret IDs/versions/modes and copied sandbox paths, never values. It does not grant reuse across orgs or across deletion and recreation of a Secret. It records completed work for a repeat plan; it does not sync changes automatically.
+The local manifest at `~/.config/instabox-basic-setup/pushed.json` stores org IDs, Secret IDs, versions and hosts, and copied sandbox paths, never values. It does not grant reuse across orgs or across deletion and recreation of a Secret. It records completed work for a repeat plan; it does not sync changes automatically.
 
 ## 4. Verify and report
 
@@ -101,8 +94,8 @@ instabox secrets show <box>
 instabox exec <box> -- 'test "${GH_TOKEN+x}" = x && test -f "$HOME/.gitconfig"'
 ```
 
-Use silent presence checks and metadata; never print variables to verify them. A placeholder's presence does not prove proxy authorization or upstream success. Confirm client behavior without logging credentials, and explain application restarts when env values changed.
+Use silent presence checks and metadata; never print variables to verify them. A placeholder's presence does not prove the upstream accepts the token. Confirm client behavior without logging credentials, and explain application restarts.
 
-Report the org Secret names and modes saved, sandbox IDs whose selections changed, config paths copied, failures and manual setup steps. Saving env Secrets without targets adds no grants; replacing a value still affects sandboxes already authorized to use it. Future boxes without Secret selection flags keep their existing Vault behavior. At creation, selecting env Secrets alone also selects all org proxy Secrets; add an explicit proxy selection to narrow that access. Previously saved credentials or config not selected this time remain; deletion or cleanup needs its own intended scope. Rotate or revoke upstream when a previously delivered env value must stop working.
+Report the org Secret names and hosts saved, sandbox IDs whose selections changed, config paths copied, failures and manual setup steps. Saving Secrets without targets changes no selection; replacing a value still affects sandboxes already selecting it. Say that git over HTTPS needs its own sign-in on the box, and that credentials outside the registry (database URLs, cloud keys, other tokens) were not moved and need their own setup there; an HTTP API key can be added with `instabox secrets set NAME --org ORG --host HOST`. Future boxes created without `--secrets` keep their existing Vault behavior. Previously saved credentials or config not selected this time remain; deletion or cleanup needs its own intended scope.
 
 Config edits in a sandbox are not overwritten at every resume. Shell aliases, SSH keys, cloud credential files, agent sign-in databases and repositories are outside this inventory. Complete the selected manual sign-in steps only within existing authorization. Remove `$W` when no longer needed; it contains metadata and choices, not credential values.

package/skills/instabox-basic-setup/scripts/content.mjs

@@ -1,7 +1,7 @@
 // What a directly copied configuration file becomes: the local file with this
 // machine's HOME rewritten to the box's, lines that look like credentials
 // removed and macOS-only lines commented out. ~/.gitconfig also gets a few
-// changes so git works on a box that has GH_TOKEN and no SSH key.
+// changes so git works on a box that has no signing or SSH key.
 //
 // Used by plan.mjs (for sizes) and push.mjs (for the upload). Nothing here
 // prints a file's content.
@@ -40,25 +40,11 @@ export function scrubText(text, { path, home }) {
   return { text: out.join('\n'), secrets, macos };
 }
 
-// The credential helper `gh auth setup-git` writes: git over HTTPS uses GH_TOKEN through gh.
-export const GH_HELPER = [
-  '',
-  `# ${TAG}: git over HTTPS to GitHub uses an explicitly selected env GH_TOKEN through gh`,
-  '[credential "https://github.com"]',
-  '\thelper =',
-  '\thelper = !gh auth git-credential',
-  '[credential "https://gist.github.com"]',
-  '\thelper =',
-  '\thelper = !gh auth git-credential',
-  '',
-].join('\n');
-
-// ~/.gitconfig for the box. ghToken: GH_TOKEN is explicitly selected for env delivery, so the gh helper is added.
-// Changes, besides scrubText's:
+// ~/.gitconfig for the box. Changes, besides scrubText's:
 //  - commit/tag signing is turned off: the signing key (GPG, SSH, 1Password) is not on the box;
 //  - url.<ssh>.insteadOf rewrites are commented out: the box has no SSH key, and they would
 //    send HTTPS remotes over SSH.
-export function gitconfigText(text, { home, ghToken }) {
+export function gitconfigText(text, { home }) {
   const r = scrubText(text, { path: '.gitconfig', home });
   let section = '';
   let signing = 0;
@@ -77,13 +63,11 @@ export function gitconfigText(text, { home, ghToken }) {
     }
     return line;
   });
-  let out = lines.join('\n');
-  if (ghToken) out = out.replace(/\n*$/, '\n') + GH_HELPER;
-  return { text: out, secrets: r.secrets, macos: r.macos, signing, insteadOf };
+  return { text: lines.join('\n'), secrets: r.secrets, macos: r.macos, signing, insteadOf };
 }
 
 // The content of one file of a file item, or {error}. f: {path, src, transform}.
-export function fileContent(f, { home, ghToken = false } = {}) {
+export function fileContent(f, { home } = {}) {
   let buf;
   try {
     buf = readFileSync(f.src);
@@ -93,7 +77,7 @@ export function fileContent(f, { home, ghToken = false } = {}) {
   if (buf.includes(0)) return { error: `${f.src}: a binary file (config copying supports UTF-8 text only)` };
   const text = buf.toString('utf8');
   if (!Buffer.from(text).equals(buf)) return { error: `${f.src}: invalid UTF-8 text` };
-  if (f.transform === 'gitconfig') return gitconfigText(text, { home, ghToken });
+  if (f.transform === 'gitconfig') return gitconfigText(text, { home });
   if (f.transform === 'raw') {
     if (SECRET_VALUE.test(text) || text.split('\n').some((line) => SECRET_KEY_LINE.test(line)))
       return { error: `${f.src}: possible credential in structured config; review it separately` };

package/skills/instabox-basic-setup/scripts/lib.mjs

@@ -3,7 +3,6 @@
 // The one rule every function here keeps: a credential's value is never
 // returned to the agent, stored in a file or printed. Code that looks at a
 // secret returns names, places and sizes only.
-import { isIP } from 'node:net';
 import { spawnSync } from 'node:child_process';
 import { lstatSync, readdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
@@ -38,50 +37,55 @@ export const SECRET_VALUE = new RegExp(
 export const SECRET_KEY_LINE =
   /(?:^|[\s{,;:])["']?[\w.-]*(?:token|password|passwd|secret|api[_-]?key|apikey|_auth|authorization|extraheader|private[_-]?key)[\w.-]*["']?\s*[=:]\s*["']?(?![0-9.]+\b|true\b|false\b)[^\s"',}]/i;
 
-// Model-provider and developer-service tokens: moved by default when found. Any other
-// credential-looking variable exported in a shell file is listed unchecked.
-export const WELL_KNOWN = new Set([
-  'GH_TOKEN',
-  'GITHUB_TOKEN',
-  'CLAUDE_CODE_OAUTH_TOKEN',
-  'ANTHROPIC_API_KEY',
-  'OPENAI_API_KEY',
-  'GEMINI_API_KEY',
-  'GOOGLE_API_KEY',
-  'GOOGLE_GENERATIVE_AI_API_KEY',
-  'OPENROUTER_API_KEY',
-  'GROQ_API_KEY',
-  'MISTRAL_API_KEY',
-  'DEEPSEEK_API_KEY',
-  'XAI_API_KEY',
-  'TOGETHER_API_KEY',
-  'FIREWORKS_API_KEY',
-  'PERPLEXITY_API_KEY',
-  'COHERE_API_KEY',
-  'VOYAGE_API_KEY',
-  'REPLICATE_API_TOKEN',
-  'ELEVENLABS_API_KEY',
-  'TAVILY_API_KEY',
-  'EXA_API_KEY',
-  'FIRECRAWL_API_KEY',
-  'BRAVE_API_KEY',
-  'PINECONE_API_KEY',
-  'HF_TOKEN',
-  'HUGGING_FACE_HUB_TOKEN',
-  'NPM_TOKEN',
-  'VERCEL_TOKEN',
-  'NETLIFY_AUTH_TOKEN',
-  'CLOUDFLARE_API_TOKEN',
-  'SUPABASE_ACCESS_TOKEN',
-  'FLY_API_TOKEN',
-  'RAILWAY_TOKEN',
-  'RENDER_API_KEY',
-  'NEON_API_KEY',
-  'SENTRY_AUTH_TOKEN',
-  'LINEAR_API_KEY',
-  'GITLAB_TOKEN',
-  'DIGITALOCEAN_ACCESS_TOKEN',
-]);
+// The tokens this skill saves, each with the HTTPS API hosts its usual client sends it to in a
+// request header. The box gets a placeholder and the outbound proxy fills in the token only for
+// these hosts. A token whose client signs with it, sends it in a body or URL, or talks to hosts
+// that cannot be named exactly is left out: the scan lists it as a manual step.
+// FORMAT is the scan and approved-selection format. 4: proxy-only Secrets, hosts from
+// TOKEN_HOSTS. Older files approved env delivery or other hosts; they are refused, never
+// reinterpreted, so an approval cannot widen a credential's reach.
+export const FORMAT = 4;
+
+export const TOKEN_HOSTS = new Map(
+  Object.entries({
+    GH_TOKEN: ['api.github.com'],
+    GITHUB_TOKEN: ['api.github.com'],
+    ANTHROPIC_API_KEY: ['api.anthropic.com'],
+    OPENAI_API_KEY: ['api.openai.com'],
+    GEMINI_API_KEY: ['generativelanguage.googleapis.com'],
+    GOOGLE_API_KEY: ['generativelanguage.googleapis.com'],
+    GOOGLE_GENERATIVE_AI_API_KEY: ['generativelanguage.googleapis.com'],
+    OPENROUTER_API_KEY: ['openrouter.ai'],
+    GROQ_API_KEY: ['api.groq.com'],
+    MISTRAL_API_KEY: ['api.mistral.ai'],
+    DEEPSEEK_API_KEY: ['api.deepseek.com'],
+    XAI_API_KEY: ['api.x.ai'],
+    TOGETHER_API_KEY: ['api.together.ai', 'api.together.xyz'],
+    FIREWORKS_API_KEY: ['api.fireworks.ai'],
+    PERPLEXITY_API_KEY: ['api.perplexity.ai'],
+    COHERE_API_KEY: ['api.cohere.ai', 'api.cohere.com'],
+    VOYAGE_API_KEY: ['api.voyageai.com'],
+    REPLICATE_API_TOKEN: ['api.replicate.com'],
+    ELEVENLABS_API_KEY: ['api.elevenlabs.io'],
+    TAVILY_API_KEY: ['api.tavily.com'],
+    EXA_API_KEY: ['api.exa.ai'],
+    FIRECRAWL_API_KEY: ['api.firecrawl.dev'],
+    BRAVE_API_KEY: ['api.search.brave.com'],
+    HF_TOKEN: ['huggingface.co', 'router.huggingface.co'],
+    HUGGING_FACE_HUB_TOKEN: ['huggingface.co', 'router.huggingface.co'],
+    NPM_TOKEN: ['registry.npmjs.org'],
+    VERCEL_TOKEN: ['api.vercel.com'],
+    NETLIFY_AUTH_TOKEN: ['api.netlify.com'],
+    CLOUDFLARE_API_TOKEN: ['api.cloudflare.com'],
+    SUPABASE_ACCESS_TOKEN: ['api.supabase.com'],
+    RENDER_API_KEY: ['api.render.com'],
+    NEON_API_KEY: ['console.neon.tech'],
+    SENTRY_AUTH_TOKEN: ['sentry.io'],
+    LINEAR_API_KEY: ['api.linear.app'],
+    GITLAB_TOKEN: ['gitlab.com'],
+    DIGITALOCEAN_ACCESS_TOKEN: ['api.digitalocean.com'],
+  }),
+);
 
 // Reserved Secret variable names (internal/secrets/validate.go).
 const RESERVED = new Set([
@@ -206,28 +210,6 @@ export function configPathOK(p) {
   return p.split('/').every((c) => c !== '' && c !== '.' && !c.startsWith('..'));
 }
 
-export function deliveryPolicy(delivery, hosts = []) {
-  if (!['env', 'proxy'].includes(delivery) || !Array.isArray(hosts)) throw new Error('delivery must be env or proxy');
-  if (delivery === 'env' && hosts.length) throw new Error('env delivery cannot enforce hosts; use -');
-  if (delivery === 'proxy' && (!hosts.length || hosts.length > 32))
-    throw new Error('proxy delivery requires 1-32 exact hosts');
-  const normalized = hosts.map((name) => {
-    if (typeof name !== 'string') throw new Error('hosts must be exact public DNS names');
-    const h = name.toLowerCase().replace(/\.$/, '');
-    if (
-      h.length > 253 ||
-      !h.includes('.') ||
-      isIP(h) ||
-      /(?:^|\.)(?:local|localhost)$/.test(h) ||
-      h.split('.').some((label) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))
-    ) {
-      throw new Error('hosts must be exact public DNS names without a scheme, port, path, IP address or wildcard');
-    }
-    return h;
-  });
-  return { delivery, hosts: [...new Set(normalized)].sort() };
-}
-
 export function validID(s) {
   return typeof s === 'string' && /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(s);
 }
@@ -237,7 +219,6 @@ export function secretIdentity(s) {
     name: s.name,
     orgId: s.orgId,
     version: s.version,
-    delivery: s.delivery,
     hosts: [...(s.hosts || [])].sort(),
   };
 }

package/skills/instabox-basic-setup/scripts/plan.mjs

@@ -11,7 +11,8 @@ import {
   FILE_MAX_VALUE,
   FILE_MAX_TOTAL,
   configPathOK,
-  deliveryPolicy,
+  FORMAT,
+  TOKEN_HOSTS,
   human,
   isMain,
   sameSecret,
@@ -60,30 +61,29 @@ export class PlanError extends Error {
 }
 
 function checkContext(scan, secrets, orgId) {
-  if (scan.version !== 3 || !Array.isArray(scan.items))
+  if (
+    scan.version !== FORMAT ||
+    !Array.isArray(scan.items) ||
+    scan.items.some((it) => it.kind === 'env' && !TOKEN_HOSTS.has(it.name))
+  )
     throw new PlanError(['scan format changed; run scan.mjs again']);
   if (!validID(orgId)) throw new PlanError(['an explicit org ID is required']);
   if (!Array.isArray(secrets) || secrets.some((s) => s.orgId !== orgId || !s.id || !Number.isSafeInteger(s.version)))
     throw new PlanError(['Secret metadata must belong to the selected org and include IDs and versions']);
 }
 
-export function writePlan(
-  scan,
-  { secrets = [], manifest = { secrets: [] }, orgId, sandboxes = [], delivery = 'env', hosts = [] } = {},
-) {
+export function writePlan(scan, { secrets = [], manifest = { secrets: [] }, orgId, sandboxes = [] } = {}) {
   checkContext(scan, secrets, orgId);
   if (sandboxes.some((id) => !validID(id) || !id.startsWith('m_')))
     throw new PlanError(['sandboxes must use stable m_ IDs']);
-  const policy = deliveryPolicy(delivery, hosts);
   const out = [
     '# instabox basic setup: plan',
     '',
     'Check `[x]` the items to save or copy. Do not change IDs or delete lines.',
-    'Tokens become encrypted org Secrets. Each Delivery line explicitly chooses env (real values) or proxy (HTTPS-header placeholders with allowed hosts).',
-    'This run adds env grants only to the sandbox IDs below; an empty list adds no grants. Existing grants remain in force.',
-    'Proxy Secrets also become available to other org sandboxes whose proxy selection is all, including future sandboxes.',
+    'Tokens become encrypted org Secrets. A box sees a placeholder; the outbound proxy puts the token into HTTPS headers sent to the hosts listed for each token, and nowhere else.',
+    'This run selects them only on the sandbox IDs below; an empty list changes no selection. Existing selections remain in force.',
+    'Saved Secrets also become available to other org sandboxes whose selection is all, including future sandboxes.',
     'Replacing an existing Secret affects its other authorized sandboxes. Config files are copied once to the named running sandboxes and may overwrite those paths; they are not Secrets.',
-    'Env values can be copied into files, processes or snapshots; removing a selection cannot recover those copies.',
     '',
     `Org: \`${orgId}\``,
     `Sandboxes: \`${[...new Set(sandboxes)].join(',') || '-'}\``,
@@ -104,7 +104,7 @@ export function writePlan(
       const checked = it.checked && !other && (it.kind === 'env' || sandboxes.length > 0);
       let description =
         it.kind === 'env'
-          ? `${it.name} from ${it.from}`
+          ? `${it.name} from ${it.from}, for ${TOKEN_HOSTS.get(it.name).join(', ')}`
           : `~/${it.path}: ${it.files.length} file(s), ${human(it.bytes)}`;
       if (it.reason) description += `; off by default: ${it.reason}`;
       if (it.note) description += `; ${it.note}`;
@@ -112,12 +112,6 @@ export function writePlan(
       else if (ex.length) description += '; replaces the unchanged Secret from your previous run';
       if (it.kind === 'file' && !sandboxes.length) description += '; select running sandbox IDs before checking this';
       out.push(`- [${checked ? 'x' : ' '}] \`${it.id}\` ${description}`);
-      if (it.kind === 'env') {
-        // Preserve an existing mode as a starting point; never silently change
-        // a proxy credential into a real-value env credential on a repeat run.
-        const p = ex.length ? deliveryPolicy(ex[0].item.delivery, ex[0].item.hosts || []) : policy;
-        out.push(`Delivery \`${it.id}\`: \`${p.delivery}\` hosts \`${p.hosts.join(',') || '-'}\``);
-      }
     }
   }
   out.push('', '## Manual setup', '', 'These entries have no checkbox; no credentials are read for them.', '');
@@ -129,8 +123,7 @@ export function parsePlan(scan, text, { secrets = [], manifest = { secrets: [] }
   checkContext(scan, secrets, orgId);
   const errors = [];
   const byId = new Map(scan.items.map((it) => [it.id, it]));
-  const states = new Map(),
-    policies = new Map();
+  const states = new Map();
   let planOrg, sandboxes, digest;
   for (const [index, raw] of text.split('\n').entries()) {
     const line = raw.replace(/\r$/, ''),
@@ -155,20 +148,6 @@ export function parsePlan(scan, text, { secrets = [], manifest = { secrets: [] }
       }
       continue;
     }
-    if (/^Delivery\b/.test(line)) {
-      const m = line.match(/^Delivery `([^`]+)`: `([^`]+)` hosts `([^`]*)`$/);
-      if (!m || byId.get(m[1])?.kind !== 'env') {
-        errors.push(`line ${n}: invalid Delivery line`);
-        continue;
-      }
-      if (policies.has(m[1])) errors.push(`line ${n}: duplicate delivery for ${m[1]}`);
-      try {
-        policies.set(m[1], deliveryPolicy(m[2], m[3] === '-' ? [] : m[3].split(',').map((h) => h.trim())));
-      } catch (e) {
-        errors.push(`line ${n}: ${e.message}`);
-      }
-      continue;
-    }
     if (/^Selector:/.test(line)) errors.push(`line ${n}: legacy selectors are retired`);
     const d = line.match(/^<!-- plan ([0-9a-f]+):/);
     if (d) {
@@ -195,27 +174,21 @@ export function parsePlan(scan, text, { secrets = [], manifest = { secrets: [] }
     errors.push('different scan or org Secret state; scan, list Secrets and write a new plan');
   for (const it of scan.items) {
     if (!states.has(it.id)) errors.push(`\`${it.id}\` is missing from the plan`);
-    if (it.kind === 'env' && !policies.has(it.id))
-      errors.push(`\`${it.id}\` needs an explicit delivery mode and hosts line`);
   }
   if (errors.length) throw new PlanError(errors);
 
   const picked = scan.items.filter((it) => states.get(it.id));
-  const ghToken = picked.some(
-    (it) => it.kind === 'env' && it.name === 'GH_TOKEN' && policies.get(it.id).delivery === 'env',
-  );
   const items = picked.map((it) => {
     const item = { ...it };
     delete item.checked;
     if (it.kind === 'env') {
-      Object.assign(item, policies.get(it.id));
       item.expected = secrets.find((s) => s.name === it.name);
       item.expected = item.expected ? secretIdentity(item.expected) : null;
     } else {
       if (!sandboxes.length) errors.push(`\`${it.id}\`: config copying requires explicit running sandbox IDs`);
       item.files = it.files.map((f) => {
         if (!configPathOK(f.path)) errors.push(`\`${it.id}\`: invalid config path`);
-        const c = fileContent(f, { home: scan.home, ghToken });
+        const c = fileContent(f, { home: scan.home });
         if (c.error) errors.push(`\`${it.id}\`: ${c.error}`);
         const bytes = c.error ? 0 : Buffer.byteLength(c.text);
         if (bytes > FILE_MAX_VALUE) errors.push(`\`${it.id}\`: file exceeds the config-copy limit of 64 KiB`);
@@ -249,11 +222,10 @@ export function parsePlan(scan, text, { secrets = [], manifest = { secrets: [] }
   if (fileBytes > FILE_MAX_TOTAL)
     throw new PlanError(['config copies exceed 512 KiB; uncheck files or transfer them separately'], 3);
   return {
-    version: 3,
+    version: FORMAT,
     home: scan.home,
     orgId,
     sandboxes,
-    ghToken,
     items,
     manual: scan.manual,
     skipped: scan.items.filter((it) => !states.get(it.id)).map((it) => it.id),
@@ -285,14 +257,11 @@ function main() {
     const secrets = JSON.parse(readFileSync(secretsFile, 'utf8')).items;
     if (!Array.isArray(secrets)) throw new Error('metadata must be instabox secrets ls --json output');
     if (command === 'write') {
-      const sandboxes = [],
-        hosts = [];
+      const sandboxes = [];
       let value;
       while ((value = opt('--sandbox')) !== undefined) sandboxes.push(value);
-      while ((value = opt('--host')) !== undefined) hosts.push(value);
-      const delivery = opt('--delivery') || 'env';
       if (args.length) throw new Error('unknown write arguments');
-      process.stdout.write(writePlan(scan, { secrets, orgId, manifest, sandboxes, delivery, hosts }));
+      process.stdout.write(writePlan(scan, { secrets, orgId, manifest, sandboxes }));
     } else if (command === 'parse') {
       const limitFile = opt('--limits');
       const limits = limitFile ? JSON.parse(readFileSync(limitFile, 'utf8')) : {};

package/skills/instabox-basic-setup/scripts/push.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-// Save reviewed org Secrets, select them for named sandboxes, and copy ordinary
-// config files separately. Credential values are held only in memory/stdin.
+// Save reviewed org Secrets for their registry hosts, select them for named sandboxes, and copy
+// ordinary config files separately. Credential values are held only in memory/stdin.
 import { spawnSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
@@ -13,7 +13,8 @@ import {
   FILE_MAX_VALUE,
   FILE_MAX_TOTAL,
   configPathOK,
-  deliveryPolicy,
+  FORMAT,
+  TOKEN_HOSTS,
   human,
   isMain,
   run,
@@ -107,8 +108,8 @@ function validSource(it, home) {
 }
 
 function checkSelection(sel) {
-  if (sel.version !== 3 || Object.hasOwn(sel, 'selector'))
-    throw new Error('legacy selection format is retired; scan and approve a new org Secret plan');
+  if (sel.version !== FORMAT || Object.hasOwn(sel, 'selector'))
+    throw new Error('this selection was approved in an older format; scan and approve a new org Secret plan');
   if (
     !validID(sel.orgId) ||
     !Array.isArray(sel.sandboxes) ||
@@ -124,12 +125,15 @@ function checkSelection(sel) {
     if (ids.has(it.id)) throw new Error('duplicate selection ID');
     ids.add(it.id);
     if (it.kind === 'env') {
-      if (!secretNameOK(it.name) || names.has(it.name) || !validSource(it, sel.home) || !Object.hasOwn(it, 'expected'))
+      if (
+        !TOKEN_HOSTS.has(it.name) ||
+        !secretNameOK(it.name) ||
+        names.has(it.name) ||
+        !validSource(it, sel.home) ||
+        !Object.hasOwn(it, 'expected')
+      )
         throw new Error('invalid Secret selection or source');
       names.add(it.name);
-      const policy = deliveryPolicy(it.delivery, it.hosts);
-      if (JSON.stringify(policy.hosts) !== JSON.stringify(it.hosts))
-        throw new Error('hosts must use the normalized policy from the approved plan');
     } else if (it.kind === 'file') {
       if (!sel.sandboxes.length || !Array.isArray(it.files))
         throw new Error('config copying needs explicit sandbox IDs');
@@ -191,7 +195,7 @@ export function push(
       if (sel.items.some((it) => it.kind === 'file') && box.state !== 'running')
         throw new Error(`${id}: start the sandbox before copying config files`);
       const selection = json(['secrets', 'show', id]);
-      if (!Array.isArray(selection.envSecrets) || (selection.secrets !== 'all' && !Array.isArray(selection.secrets)))
+      if (selection.secrets !== 'all' && !Array.isArray(selection.secrets))
         throw new Error('sandbox returned invalid Secret selections');
       return box;
     });
@@ -211,7 +215,6 @@ export function push(
 
   const tokens = [],
     files = [];
-  const ghToken = sel.items.some((it) => it.kind === 'env' && it.name === 'GH_TOKEN' && it.delivery === 'env');
   const rcNames = new Map(),
     rcValues = new Map();
   for (const it of sel.items)
@@ -229,13 +232,13 @@ export function push(
         typeof value !== 'string' ||
         value.includes('\0') ||
         Buffer.byteLength(value) > SECRET_MAX_VALUE ||
-        (it.delivery === 'proxy' && /[\x00-\x08\x0a-\x1f\x7f]/.test(value))
+        /[\x00-\x08\x0a-\x1f\x7f]/.test(value)
       )
-        return fail(`${it.name}: could not prepare a valid ${it.delivery} value; nothing written`);
-      tokens.push({ item: it, value });
+        return fail(`${it.name}: could not prepare a valid header value; nothing written`);
+      tokens.push({ item: it, hosts: TOKEN_HOSTS.get(it.name), value });
     } else {
       for (const f of it.files) {
-        const got = fileContent(f, { home: sel.home, ghToken });
+        const got = fileContent(f, { home: sel.home });
         if (got.error || Buffer.byteLength(got.text) > FILE_MAX_VALUE)
           return fail(`~/${f.path}: config could not be prepared; nothing written`);
         files.push({ path: f.path, text: got.text });
@@ -267,11 +270,11 @@ export function push(
 
   const manifest = readManifest(manifestPath);
   let ok = true;
-  for (const { item, value } of tokens) {
+  for (const { item, hosts, value } of tokens) {
     const r = {
       name: item.name,
       kind: 'secret',
-      delivery: item.delivery,
+      hosts,
       bytes: Buffer.byteLength(value),
       status: dryRun ? 'would save' : 'failed',
     };
@@ -284,9 +287,7 @@ export function push(
         item.name,
         '--org',
         sel.orgId,
-        '--delivery',
-        item.delivery,
-        ...item.hosts.flatMap((h) => ['--host', h]),
+        ...hosts.flatMap((h) => ['--host', h]),
         '--json',
       ];
       const response = run(args, { env, input: value + '\n' });
@@ -298,8 +299,7 @@ export function push(
           saved.orgId !== sel.orgId ||
           !saved.id ||
           !Number.isSafeInteger(saved.version) ||
-          saved.delivery !== item.delivery ||
-          JSON.stringify(deliveryPolicy(saved.delivery, saved.hosts || []).hosts) !== JSON.stringify(item.hosts)
+          JSON.stringify(unique(saved.hosts || [])) !== JSON.stringify(unique(hosts))
         )
           throw new Error();
         r.status = 'saved';
@@ -310,7 +310,7 @@ export function push(
       }
     }
     log(
-      `${r.status} ${item.name} (${item.delivery}${item.hosts.length ? ', ' + item.hosts.join(',') : ''}, ${r.bytes} bytes) in ${sel.orgId}`,
+      `${r.status} ${item.name} (for ${hosts.join(',')}, ${r.bytes} bytes) in ${sel.orgId}`,
     );
   }
   if (!dryRun && tokens.length) saveManifest(manifestPath, manifest);
@@ -333,17 +333,14 @@ export function push(
     try {
       if (tokens.length) {
         const current = json(['secrets', 'show', box.id]);
-        const envNames = tokens.filter((t) => t.item.delivery === 'env').map((t) => t.item.name);
-        const proxyNames = tokens.filter((t) => t.item.delivery === 'proxy').map((t) => t.item.name);
-        const flags = [];
-        if (envNames.length) flags.push('--env-secrets', JSON.stringify(unique([...current.envSecrets, ...envNames])));
-        if (proxyNames.length && current.secrets !== 'all')
-          flags.push('--secrets', JSON.stringify(unique([...current.secrets, ...proxyNames])));
-        if (flags.length) json(['secrets', 'select', box.id, ...flags]);
+        if (current.secrets !== 'all') {
+          const names = unique([...current.secrets, ...tokens.map((t) => t.item.name)]);
+          json(['secrets', 'select', box.id, '--secrets', JSON.stringify(names)]);
+        }
         if (box.state === 'running') {
           const refreshed = json(['secrets', 'push', box.id]);
           if (refreshed.guest?.state !== 'applied')
-            throw new Error('guest delivery is pending or failed; inspect secrets show and retry');
+            throw new Error('the box has not applied the Secret selection; inspect secrets show and retry');
         }
       }
       if (files.length) {
@@ -377,7 +374,7 @@ export function push(
       }
       result.status = 'configured';
       log(
-        `configured ${box.id}${box.state === 'running' ? '; existing application processes may need a restart' : '; Secret delivery waits for the next start'}`,
+        `configured ${box.id}${box.state === 'running' ? '; existing application processes may need a restart' : '; the Secret selection applies at the next start'}`,
       );
     } catch (e) {
       ok = false;

package/skills/instabox-basic-setup/scripts/scan.mjs

@@ -13,7 +13,8 @@ import {
   MACOS_ONLY,
   SECRET_VALUE,
   FILE_MAX_VALUE,
-  WELL_KNOWN,
+  FORMAT,
+  TOKEN_HOSTS,
   hasCommand,
   isMain,
   isSecretName,
@@ -76,7 +77,6 @@ function scanTokens({ home, env, procEnv }) {
     byName.set(name, item);
     items.push(item);
   };
-  const reserved = new Set();
 
   // gh: the token gh keeps (keychain or hosts.yml), read with `gh auth token` at push time.
   if (hasCommand('gh', env)) {
@@ -84,42 +84,54 @@ function scanTokens({ home, env, procEnv }) {
     if (st.ok) {
       const who = (st.stdout + st.stderr).match(/account (\S+)/)?.[1] || null;
       add('GH_TOKEN', { type: 'cmd', argv: ['gh', 'auth', 'token', '--hostname', 'github.com'] }, '`gh auth token`', {
-        note: `${who ? `GitHub account ${who}; ` : ''}gh, and git over HTTPS to GitHub, use it on the box`,
+        note: `${who ? `GitHub account ${who}; ` : ''}gh uses it on the box; git over HTTPS needs its own sign-in`,
       });
     }
   }
 
-  // Shell startup files: exported tokens.
+  // Shell startup files: exported tokens. Only names in TOKEN_HOSTS can be saved; any other
+  // credential-looking export is a manual step.
+  const listed = new Set();
+  const listManual = (name, place, why, todo) => {
+    if (listed.has(name)) return;
+    listed.add(name);
+    manual.push({ what: `${name} (${place})`, why, todo });
+  };
   for (const f of SHELL_RC) {
     const text = readText(join(home, f));
     if (text === null) continue;
     for (const a of shellAssignments(text)) {
-      if (!WELL_KNOWN.has(a.name) && !isSecretName(a.name) && !a.secretValue) continue;
+      if (!TOKEN_HOSTS.has(a.name) && !isSecretName(a.name) && !a.secretValue) continue;
+      const place = `~/${f}:${a.line}`;
       if (!secretNameOK(a.name)) {
-        if (!reserved.has(a.name)) {
-          reserved.add(a.name);
-          manual.push({
-            what: `${a.name} (~/${f}:${a.line})`,
-            why: 'Secrets reserve this variable name for sandbox or trust configuration',
-            todo: `if a box needs it, set it there by hand`,
-          });
-        }
+        listManual(
+          a.name,
+          place,
+          'Secrets reserve this variable name for sandbox or trust configuration',
+          'if a box needs it, set it there by hand',
+        );
+        continue;
+      }
+      if (!TOKEN_HOSTS.has(a.name)) {
+        listManual(
+          a.name,
+          place,
+          'this skill does not know which HTTPS API hosts it is for',
+          `if its client sends it in an HTTPS header, \`instabox secrets set ${a.name} --org <org> --host <api-host>\` and select it on the box; other credentials need their own setup there`,
+        );
         continue;
       }
       const extra = {};
       if (a.keychain) {
         extra.checked = false;
         extra.reason = 'your shell reads it from the macOS keychain: checking it runs that lookup once, at push time';
-      } else if (!WELL_KNOWN.has(a.name)) {
-        extra.checked = false;
-        extra.reason = 'not a well-known model or service token: check it only for the org and sandboxes in the plan';
       }
-      add(a.name, { type: 'rc', file: join(home, f), name: a.name }, `~/${f}:${a.line}`, extra);
+      add(a.name, { type: 'rc', file: join(home, f), name: a.name }, place, extra);
     }
   }
-  // Well-known tokens in the environment the scan runs in (set some other way than a shell file).
+  // Known tokens in the environment the scan runs in (set some other way than a shell file).
   for (const name of Object.keys(procEnv).sort()) {
-    if (!WELL_KNOWN.has(name) || !procEnv[name]) continue;
+    if (!TOKEN_HOSTS.has(name) || !procEnv[name]) continue;
     add(name, { type: 'env', name }, 'this shell’s environment');
   }
 
@@ -127,23 +139,20 @@ function scanTokens({ home, env, procEnv }) {
     manual.push({
       what: 'GitHub token (GH_TOKEN)',
       why: hasCommand('gh', env) ? 'gh is not signed in on this machine' : 'gh is not installed on this machine',
-      todo: 'sign in here with `gh auth login` and run this again; or put a token in yourself: `instabox secrets set GH_TOKEN --org <org> --delivery env` (it prompts without echo)',
-    });
-  if (!byName.has('CLAUDE_CODE_OAUTH_TOKEN'))
-    manual.push({
-      what: 'Claude Code sign-in (CLAUDE_CODE_OAUTH_TOKEN)',
-      why: 'not found in your shell files; the sign-in on this machine is in the macOS keychain, and is never read',
-      todo:
-        'run `claude setup-token` yourself, then `instabox secrets set CLAUDE_CODE_OAUTH_TOKEN --org <org> --delivery env` and paste it at the prompt' +
-        (byName.has('ANTHROPIC_API_KEY')
-          ? ' (or skip it: ANTHROPIC_API_KEY is in the plan, and Claude Code uses that)'
-          : '; or `claude`, then /login, on each box'),
+      todo: 'sign in here with `gh auth login` and run this again; or put a token in yourself: `instabox secrets set GH_TOKEN --org <org> --host api.github.com` (it prompts without echo)',
     });
+  manual.push({
+    what: 'Claude Code sign-in',
+    why: 'the sign-in on this machine is in the macOS keychain, and is never read',
+    todo: byName.has('ANTHROPIC_API_KEY')
+      ? 'skip it: ANTHROPIC_API_KEY is in the plan, and Claude Code uses that; or run `claude`, then /login, on each box'
+      : 'run `claude`, then /login, on each box',
+  });
   if (!byName.has('OPENAI_API_KEY') && (hasCommand('codex', env) || statOrNull(join(home, '.codex'))))
     manual.push({
       what: 'Codex sign-in',
       why: 'no OPENAI_API_KEY in your shell files; a ChatGPT sign-in cannot be copied (its refresh token rotates)',
-      todo: 'on each box: `codex login --device-auth`; or `instabox secrets set OPENAI_API_KEY --org <org> --delivery env`, then select it explicitly for each intended sandbox',
+      todo: 'on each box: `codex login --device-auth`; or `instabox secrets set OPENAI_API_KEY --org <org> --host api.openai.com`, then select it on each box',
     });
   return { items, manual };
 }
@@ -259,7 +268,7 @@ export function scan(opts = {}) {
   const home = resolve(opts.home || env.HOME);
   const tokens = scanTokens({ home, env, procEnv: opts.procEnv || env });
   const items = [...tokens.items, ...scanGit({ home, env }), ...scanEditor({ home })];
-  return { version: 3, home, platform: opts.platform || process.platform, items, manual: tokens.manual };
+  return { version: FORMAT, home, platform: opts.platform || process.platform, items, manual: tokens.manual };
 }
 
 function main() {

package/skills/instabox-move-repo/SKILL.md

@@ -20,16 +20,16 @@ Three scripts in `scripts/` next to this file do the parts that must be exact (N
 What goes over:
 
 - All of the main checkout's `.git` (branches, tags, stashes, unpushed commits, the index so staged changes stay staged, each worktree's own HEAD and index), every tracked file, and every untracked file git does not ignore, in the main checkout and in each linked worktree.
-- **Never build output or dependencies**, even when the repo forgot to ignore them: `node_modules`, `target`, `dist`, `build`, `out`, `.next`, `.nuxt`, `.svelte-kit`, `.turbo`, `.cache`, `coverage`, `__pycache__`, `.venv`, `venv`, `.tox`, `.mypy_cache`, `.pytest_cache`, `.gradle`, `bazel-*`, `*.egg-info`, `*.o`, `*.so`, `*.pyc`, `*.class`, ... (the full list is `EXCLUDED_DIRS` and `EXCLUDED_FILES` in `repo-files.mjs`). Files git ignores stay too. A **tracked** file always goes, even under such a name, so `git status` matches. `--keep NAME` copies an excluded name anyway, for a repo whose source really lives in, say, `build/` (pass it to every `repo-files.mjs` run, step 1 and step 3, through `KEEP`). It does not bring back an untracked `.env`: their values need explicit Secret import and selection (step 7).
+- **Never build output or dependencies**, even when the repo forgot to ignore them: `node_modules`, `target`, `dist`, `build`, `out`, `.next`, `.nuxt`, `.svelte-kit`, `.turbo`, `.cache`, `coverage`, `__pycache__`, `.venv`, `venv`, `.tox`, `.mypy_cache`, `.pytest_cache`, `.gradle`, `bazel-*`, `*.egg-info`, `*.o`, `*.so`, `*.pyc`, `*.class`, ... (the full list is `EXCLUDED_DIRS` and `EXCLUDED_FILES` in `repo-files.mjs`). Files git ignores stay too. A **tracked** file always goes, even under such a name, so `git status` matches. `--keep NAME` copies an excluded name anyway, for a repo whose source really lives in, say, `build/` (pass it to every `repo-files.mjs` run, step 1 and step 3, through `KEEP`). It does not bring back an untracked `.env`: those stay behind (step 7 lists them).
 - Claude Code and Codex conversations for the repo and its worktrees (on by default, the user can opt out).
 
-Not moved: `.env` files that are not committed (their values can be imported as Secrets in step 7), credentials stored outside the repo (git credential helpers, gh, cloud, API keys in your environment), other local tools and config, other repos. A `.env` that is committed or staged is in `.git` and goes with it. Everything inside `.git` goes, including `.git/config` and so a remote URL with a token embedded in it (`https://x-access-token:TOKEN@...`); and only `.env`-named untracked files are held back, so an untracked `.npmrc` with a token, a `*.pem` or a `secrets.yaml` that git does not ignore goes too.
+Not moved: `.env` files that are not committed, credentials stored outside the repo (git credential helpers, gh, cloud, API keys in your environment), other local tools and config, other repos. A `.env` that is committed or staged is in `.git` and goes with it. Everything inside `.git` goes, including `.git/config` and so a remote URL with a token embedded in it (`https://x-access-token:TOKEN@...`); and only `.env`-named untracked files are held back, so an untracked `.npmrc` with a token, a `*.pem` or a `secrets.yaml` that git does not ignore goes too.
 
 **Never read, print or paste a credential value yourself**: not a `.env`, not `gh auth token`, not `echo $SOME_KEY`.
 
 Before starting, tell the user plainly:
 
-- **git push/pull from the box will not work until they set up credentials there** (for example `instabox ssh <box>` then `gh auth login`; org Secrets support key=value credentials, while git configuration must be set up separately).
+- **git push/pull from the box will not work until they set up credentials there** (for example `instabox ssh <box>` then `gh auth login`; org Secrets cover HTTP API keys only, so git sign-in is set up separately).
 - **The copied conversation history may contain secrets they pasted earlier** (tokens, keys, passwords). It goes by default; ask whether to skip it (or only Codex / only Claude Code).
 - Their local copy stays as it is, and nothing keeps the two in sync afterwards.
 
@@ -72,7 +72,7 @@ BOX=<box>
 instabox create --name "$BOX" --meta repo="$(basename "$DEST")"
 ```
 
-Box names are lowercase letters, digits and `-`. The box gets the default size, 4 vCPU / 8 GB (the instabox skill's Sizes lists the others a plan offers). The default template (`agent-browser`, shown as standard in the dashboard) has git, Node.js 22, Python (uv), Go, Rust, a C toolchain, Docker and a desktop with Chromium. This box is meant to stay; it pauses itself after 30 idle minutes. The `repo=` label can match existing Vault selectors; it does not select org Secrets. Without Secret selection flags the box keeps the existing Vault behavior. Opt into org Secrets explicitly with `--secrets` or `--env-secrets`; at creation, `--env-secrets` alone also selects all org proxy Secrets. Use `--no-vault --secrets none --env-secrets none` when neither store should deliver credentials.
+Box names are lowercase letters, digits and `-`. The box gets the default size, 4 vCPU / 8 GB (the instabox skill's Sizes lists the others a plan offers). The default template (`agent-browser`, shown as standard in the dashboard) has git, Node.js 22, Python (uv), Go, Rust, a C toolchain, Docker and a desktop with Chromium. This box is meant to stay; it pauses itself after 30 idle minutes. The `repo=` label can match a user's existing Vault selectors (the Vault is legacy and will be retired; never save credentials there); it does not select org Secrets. Without `--secrets` the box still gets such existing Vault items. Opt into org Secrets explicitly with `--secrets NAME,NAME`. Use `--no-vault --secrets none` when neither store should deliver credentials.
 
 ## 3. Copy the repo and its worktrees
 
@@ -111,7 +111,7 @@ done
 git worktree list; instabox exec "$BOX" --cwd "$DEST" -- git worktree list
 ```
 
-The only allowed differences are `<` lines starting with `??` for what the plan left out (a build directory, an untracked `.env`, or a whole `?? dir/` that held only those), and ` M <submodule>` for a submodule with uncommitted changes inside it (those are not copied: note it for step 8). A name passed with `--keep` must not show up as a `??` difference: it was meant to go. HEADs must match, and the box's `git worktree list` must show the same branches, detached HEADs and `locked` marks at the box paths, without the worktrees left behind. Anything else: stop and look before going on.
+The only allowed differences are `<` lines starting with `??` for what the plan left out (a build directory, an untracked `.env`, or a whole `?? dir/` that held only those), and ` M <submodule>` for a submodule with uncommitted changes inside it (those are not copied: note it for step 7). A name passed with `--keep` must not show up as a `??` difference: it was meant to go. HEADs must match, and the box's `git worktree list` must show the same branches, detached HEADs and `locked` marks at the box paths, without the worktrees left behind. Anything else: stop and look before going on.
 
 ## 4. Conversation history (unless the user opted out)
 
@@ -165,36 +165,13 @@ instabox exec "$BOX" --cwd "$DEST" -- 'git status --porcelain | sort; git rev-pa
 
 Compare with step 3. New `??` lines from the installs (for example a lockfile the project does not commit) are worth a mention; a modified tracked file is not expected: find which step did it.
 
-## 7. `.env` values: explicit Secret import and selection
-
-The plan's `envLeftOut` lists excluded files by name (`jq -r '.main.envLeftOut, (.worktrees[] | select(.move) | .envLeftOut) | .[]' "$W/plan.json"`). Do not print their contents. The new Secret model stores individual key=value entries, not files, and does not create or link a `.env` in the repo.
-
-For a project that needs the real values, explain that env delivery makes them readable by code in the box. Use the user's authorization to import the intended file and select its names for this box. Import is org-wide and replaces existing entries with the same names: resolve conflicts and confirm any intended replacement before importing. Different projects needing different values under the same variable name should use separate orgs, or configure their applications to use distinct names; do not silently rename or overwrite a shared credential.
-
-After that choice, per approved file (the CLI reads values; saved JSON contains metadata only):
-
-```bash
-BOX_ORG=$(instabox get "$BOX" --json | jq -r '.orgId')
-instabox secrets show "$BOX" --json > "$W/selected-secrets.json"
-instabox secrets import "<local .env path>" --org "$BOX_ORG" --delivery env --json > "$W/imported-secrets.json"
-ENV_NAMES=$(jq -c -s '.[0].envSecrets + [.[1].items[].name] | unique' "$W/selected-secrets.json" "$W/imported-secrets.json")
-instabox secrets select "$BOX" --env-secrets "$ENV_NAMES"
-instabox secrets push "$BOX"
-```
-
-This merges the approved env names with the box's current env selection and leaves its proxy selection unchanged. Import alone grants no env access to any box. Start a new login shell, or restart/reconfigure the application, to load the updated environment. Use silent presence checks; do not print values to verify delivery.
-
-For credentials sent literally in HTTPS headers, save them with `--delivery proxy --host <approved-host>` instead, and select the corresponding proxy names. Every entry in one import shares its delivery mode and host scope, so do not import a mixed `.env` as proxy credentials without separating those decisions. A native database client or a client that computes signatures needs an explicitly selected env value.
-
-If the application requires a physical `.env` or another credential file, it needs a separate, explicitly authorized file-transfer or guest-generation workflow with restricted file permissions. Such a file is readable in the guest and may be included in snapshots; it has no Secret-managed file cleanup. Report this requirement rather than claiming Secret import recreates the original file. Tokens and local editor or git configuration are separate setup decisions; metadata labels do not grant credentials.
-
-## 8. Tell the user
+## 7. Tell the user
 
 - The box name and where the repo is: `instabox ssh <box>`, then `cd /data/workspace/<name>`; each worktree with its box path and branch; worktrees left behind and why.
 - Uncommitted work inside a submodule (a ` M <submodule>` line in step 3) did not come over: name each such submodule so the user can commit or copy that work themselves.
 - Sizes: on disk before, sent after, and the biggest things left out (they were rebuilt or reinstalled on the box).
 - What was installed, whether build and tests pass, and anything left to do (each FAILED step and note from `deps.sh` that is not fixed).
-- Again: git push/pull needs credentials set up on the box. State which Secret names and delivery modes were selected, if any; never include values. Ignored files, build output and untracked `.env` files were not copied. Secrets in committed or staged files, anywhere in `.git` (such as a token in a remote URL in `.git/config`), in untracked files not named `.env*`, or in the copied history, did go over.
+- Again: git push/pull needs credentials set up on the box. Ignored files and build output were not copied. Untracked `.env` files were left behind: list them by name from the plan (`jq -r '.main.envLeftOut, (.worktrees[] | select(.move) | .envLeftOut) | .[]' "$W/plan.json"`), never their contents. For an HTTP API key the project needs, the user can run `instabox secrets set NAME --host <api-host>` and select it on the box with `instabox secrets select`; database URLs and other credentials need their own setup on the box. Secrets in committed or staged files, anywhere in `.git` (such as a token in a remote URL in `.git/config`), in untracked files not named `.env*`, or in the copied history, did go over.
 - How to pick up old conversations, kept short, with the session ids from step 4:
   - Claude Code, in the repo (or worktree) directory on the box: `claude --continue` (latest) or `claude --resume` (picker, or `claude --resume <id>`).
   - Codex, in that directory: `codex resume` (picker for this directory), `codex resume --last`, or `codex resume <id>`.

package/skills/instabox-move-repo/scripts/deps.sh

@@ -325,7 +325,7 @@ project() { # dir label
       note "$L: has a compose file; its services were not started (docker compose up -d)"
     for f in .env.example .env.sample .env.template; do
       if [ -f "$f" ] && [ ! -e .env ]; then
-        note "$L: expects a .env (see $f); .env files are not copied: bring it through the Vault (instabox-move-repo skill, .env files)"
+        note "$L: expects a .env (see $f); .env files are not copied: the user sets it up (instabox-move-repo skill, step 7)"
         break
       fi
     done

package/skills/instabox-move-repo/scripts/repo-files.mjs

@@ -10,7 +10,7 @@
 //                                                              relative to PATH
 //   --skip-worktree PATH   leave a linked worktree behind (repeatable; pass it to --list0 runs too)
 //   --keep NAME            copy an excluded name anyway (repeatable): --keep build (not an untracked
-//                          .env: those go through the Vault)
+//                          .env: those always stay behind)
 //
 // What goes: all of the main checkout's .git (branches, stashes, the index, unpushed commits, the
 // worktrees' own HEAD and index under .git/worktrees/), every tracked file that exists, and every
@@ -108,7 +108,7 @@ export const EXCLUDED_FILES = [
   '.DS_Store',
 ];
 
-// Untracked .env files never go (secrets belong in the Vault). Templates do.
+// Untracked .env files never go: the final report lists them as left behind. Templates do.
 const ENV_FILE = /^\.env(?:\..+)?$/;
 const ENV_TEMPLATE = /^\.env\.(?:example|sample|template|dist|defaults)$/;
 const isEnvName = (f) => {

package/skills/instabox-snapshots/SKILL.md

@@ -18,7 +18,7 @@ instabox snapshot save work --name work-ready --description "deps installed, rep
 - A running box is saved live, without stopping it: the snapshot is `pending` in `instabox snapshot ls` until its disks finish uploading (`--no-wait` returns at once).
 - Do not stop the box first: `stop` ends every process in it. A live snapshot is like a clean power cut: what is on disk is kept, what programs hold only in memory is not. Only if the server answers that this box must be stopped, or if a program must write its data to disk first (a database mid-write), run `instabox stop work`, save, then `instabox start work`.
 - `--root-only` saves just the root disk (smaller; `/data` is not included).
-- A disk snapshot includes credential files written by applications, tool sign-ins, and historical Vault files. The managed Secret environment lives on tmpfs, but applications can copy real env values to disk; a suspend snapshot can also retain them in process memory. Do not describe snapshots as credential-free. Review copied credentials and rotate upstream when required before sharing or retaining them.
+- A disk snapshot includes credential files written by applications, tool sign-ins, and historical Vault files; a suspend snapshot can also retain credentials in process memory. Org Secrets reach the box only as placeholders, so a snapshot holds none of their values, but anything an app or a person wrote to disk is kept. Do not describe snapshots as credential-free. Review copied credentials and rotate upstream when required before sharing or retaining them.
 - Pick names that say what is inside (`node20-playwright`, `api-db-seeded`); names must be unique among your snapshots.
 
 ## Load
@@ -50,13 +50,13 @@ instabox create --name work2 --snapshot work-copy
 instabox snapshot rm work-copy                          # optional; work2 is not affected
 ```
 
-The copy gets a new sandbox identity and the selections in its creation request. Without Secret selection flags it keeps the existing Vault behavior and does not enroll in org Secrets; it does not inherit the source's explicit grants or exclusions. To disable new delivery from both stores, use:
+The copy gets a new sandbox identity and the Secret selection in its creation request. Without `--secrets` it keeps the existing Vault behavior and does not enroll in org Secrets; it does not inherit the source's selection. To give it neither store's credentials, use:
 
 ```sh
-instabox create --name work2 --snapshot work-copy --no-vault --secrets none --env-secrets none
+instabox create --name work2 --snapshot work-copy --no-vault --secrets none
 ```
 
-To provide a database credential, select its env Secret explicitly with `--env-secrets DATABASE_URL`. At creation that flag alone also selects all org proxy Secrets; add `--secrets none` or specific names to narrow proxy access. Copied placeholders cannot authorize use as the source sandbox. New selections do not erase real credentials already present in copied files; a new proxy identity does not make those files safe to share.
+To give the copy API credentials, name them with `--secrets NAME,NAME`. Placeholders copied from the source box do not work for the new one. New selections do not erase credentials that apps or people already wrote into files on the copied disks; review those before sharing the snapshot or the box.
 
 ## Clean up