instabox 0.6.3 → 0.7.0

package/skills/instabox-basic-setup/scripts/content.mjs

@@ -1,7 +1,7 @@
 // What a directly copied configuration file becomes: the local file with this
 // machine's HOME rewritten to the box's, lines that look like credentials
 // removed and macOS-only lines commented out. ~/.gitconfig also gets a few
-// changes so git works on a box that has GH_TOKEN and no SSH key.
+// changes so git works on a box that has no signing or SSH key.
 //
 // Used by plan.mjs (for sizes) and push.mjs (for the upload). Nothing here
 // prints a file's content.
@@ -40,25 +40,11 @@ export function scrubText(text, { path, home }) {
   return { text: out.join('\n'), secrets, macos };
 }
 
-// The credential helper `gh auth setup-git` writes: git over HTTPS uses GH_TOKEN through gh.
-export const GH_HELPER = [
-  '',
-  `# ${TAG}: git over HTTPS to GitHub uses an explicitly selected env GH_TOKEN through gh`,
-  '[credential "https://github.com"]',
-  '\thelper =',
-  '\thelper = !gh auth git-credential',
-  '[credential "https://gist.github.com"]',
-  '\thelper =',
-  '\thelper = !gh auth git-credential',
-  '',
-].join('\n');
-
-// ~/.gitconfig for the box. ghToken: GH_TOKEN is explicitly selected for env delivery, so the gh helper is added.
-// Changes, besides scrubText's:
+// ~/.gitconfig for the box. Changes, besides scrubText's:
 //  - commit/tag signing is turned off: the signing key (GPG, SSH, 1Password) is not on the box;
 //  - url.<ssh>.insteadOf rewrites are commented out: the box has no SSH key, and they would
 //    send HTTPS remotes over SSH.
-export function gitconfigText(text, { home, ghToken }) {
+export function gitconfigText(text, { home }) {
   const r = scrubText(text, { path: '.gitconfig', home });
   let section = '';
   let signing = 0;
@@ -77,13 +63,11 @@ export function gitconfigText(text, { home, ghToken }) {
     }
     return line;
   });
-  let out = lines.join('\n');
-  if (ghToken) out = out.replace(/\n*$/, '\n') + GH_HELPER;
-  return { text: out, secrets: r.secrets, macos: r.macos, signing, insteadOf };
+  return { text: lines.join('\n'), secrets: r.secrets, macos: r.macos, signing, insteadOf };
 }
 
 // The content of one file of a file item, or {error}. f: {path, src, transform}.
-export function fileContent(f, { home, ghToken = false } = {}) {
+export function fileContent(f, { home } = {}) {
   let buf;
   try {
     buf = readFileSync(f.src);
@@ -93,7 +77,7 @@ export function fileContent(f, { home, ghToken = false } = {}) {
   if (buf.includes(0)) return { error: `${f.src}: a binary file (config copying supports UTF-8 text only)` };
   const text = buf.toString('utf8');
   if (!Buffer.from(text).equals(buf)) return { error: `${f.src}: invalid UTF-8 text` };
-  if (f.transform === 'gitconfig') return gitconfigText(text, { home, ghToken });
+  if (f.transform === 'gitconfig') return gitconfigText(text, { home });
   if (f.transform === 'raw') {
     if (SECRET_VALUE.test(text) || text.split('\n').some((line) => SECRET_KEY_LINE.test(line)))
       return { error: `${f.src}: possible credential in structured config; review it separately` };

package/skills/instabox-basic-setup/scripts/lib.mjs

@@ -3,7 +3,6 @@
 // The one rule every function here keeps: a credential's value is never
 // returned to the agent, stored in a file or printed. Code that looks at a
 // secret returns names, places and sizes only.
-import { isIP } from 'node:net';
 import { spawnSync } from 'node:child_process';
 import { lstatSync, readdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
@@ -38,50 +37,55 @@ export const SECRET_VALUE = new RegExp(
 export const SECRET_KEY_LINE =
   /(?:^|[\s{,;:])["']?[\w.-]*(?:token|password|passwd|secret|api[_-]?key|apikey|_auth|authorization|extraheader|private[_-]?key)[\w.-]*["']?\s*[=:]\s*["']?(?![0-9.]+\b|true\b|false\b)[^\s"',}]/i;
 
-// Model-provider and developer-service tokens: moved by default when found. Any other
-// credential-looking variable exported in a shell file is listed unchecked.
-export const WELL_KNOWN = new Set([
-  'GH_TOKEN',
-  'GITHUB_TOKEN',
-  'CLAUDE_CODE_OAUTH_TOKEN',
-  'ANTHROPIC_API_KEY',
-  'OPENAI_API_KEY',
-  'GEMINI_API_KEY',
-  'GOOGLE_API_KEY',
-  'GOOGLE_GENERATIVE_AI_API_KEY',
-  'OPENROUTER_API_KEY',
-  'GROQ_API_KEY',
-  'MISTRAL_API_KEY',
-  'DEEPSEEK_API_KEY',
-  'XAI_API_KEY',
-  'TOGETHER_API_KEY',
-  'FIREWORKS_API_KEY',
-  'PERPLEXITY_API_KEY',
-  'COHERE_API_KEY',
-  'VOYAGE_API_KEY',
-  'REPLICATE_API_TOKEN',
-  'ELEVENLABS_API_KEY',
-  'TAVILY_API_KEY',
-  'EXA_API_KEY',
-  'FIRECRAWL_API_KEY',
-  'BRAVE_API_KEY',
-  'PINECONE_API_KEY',
-  'HF_TOKEN',
-  'HUGGING_FACE_HUB_TOKEN',
-  'NPM_TOKEN',
-  'VERCEL_TOKEN',
-  'NETLIFY_AUTH_TOKEN',
-  'CLOUDFLARE_API_TOKEN',
-  'SUPABASE_ACCESS_TOKEN',
-  'FLY_API_TOKEN',
-  'RAILWAY_TOKEN',
-  'RENDER_API_KEY',
-  'NEON_API_KEY',
-  'SENTRY_AUTH_TOKEN',
-  'LINEAR_API_KEY',
-  'GITLAB_TOKEN',
-  'DIGITALOCEAN_ACCESS_TOKEN',
-]);
+// The tokens this skill saves, each with the HTTPS API hosts its usual client sends it to in a
+// request header. The box gets a placeholder and the outbound proxy fills in the token only for
+// these hosts. A token whose client signs with it, sends it in a body or URL, or talks to hosts
+// that cannot be named exactly is left out: the scan lists it as a manual step.
+// FORMAT is the scan and approved-selection format. 4: proxy-only Secrets, hosts from
+// TOKEN_HOSTS. Older files approved env delivery or other hosts; they are refused, never
+// reinterpreted, so an approval cannot widen a credential's reach.
+export const FORMAT = 4;
+
+export const TOKEN_HOSTS = new Map(
+  Object.entries({
+    GH_TOKEN: ['api.github.com'],
+    GITHUB_TOKEN: ['api.github.com'],
+    ANTHROPIC_API_KEY: ['api.anthropic.com'],
+    OPENAI_API_KEY: ['api.openai.com'],
+    GEMINI_API_KEY: ['generativelanguage.googleapis.com'],
+    GOOGLE_API_KEY: ['generativelanguage.googleapis.com'],
+    GOOGLE_GENERATIVE_AI_API_KEY: ['generativelanguage.googleapis.com'],
+    OPENROUTER_API_KEY: ['openrouter.ai'],
+    GROQ_API_KEY: ['api.groq.com'],
+    MISTRAL_API_KEY: ['api.mistral.ai'],
+    DEEPSEEK_API_KEY: ['api.deepseek.com'],
+    XAI_API_KEY: ['api.x.ai'],
+    TOGETHER_API_KEY: ['api.together.ai', 'api.together.xyz'],
+    FIREWORKS_API_KEY: ['api.fireworks.ai'],
+    PERPLEXITY_API_KEY: ['api.perplexity.ai'],
+    COHERE_API_KEY: ['api.cohere.ai', 'api.cohere.com'],
+    VOYAGE_API_KEY: ['api.voyageai.com'],
+    REPLICATE_API_TOKEN: ['api.replicate.com'],
+    ELEVENLABS_API_KEY: ['api.elevenlabs.io'],
+    TAVILY_API_KEY: ['api.tavily.com'],
+    EXA_API_KEY: ['api.exa.ai'],
+    FIRECRAWL_API_KEY: ['api.firecrawl.dev'],
+    BRAVE_API_KEY: ['api.search.brave.com'],
+    HF_TOKEN: ['huggingface.co', 'router.huggingface.co'],
+    HUGGING_FACE_HUB_TOKEN: ['huggingface.co', 'router.huggingface.co'],
+    NPM_TOKEN: ['registry.npmjs.org'],
+    VERCEL_TOKEN: ['api.vercel.com'],
+    NETLIFY_AUTH_TOKEN: ['api.netlify.com'],
+    CLOUDFLARE_API_TOKEN: ['api.cloudflare.com'],
+    SUPABASE_ACCESS_TOKEN: ['api.supabase.com'],
+    RENDER_API_KEY: ['api.render.com'],
+    NEON_API_KEY: ['console.neon.tech'],
+    SENTRY_AUTH_TOKEN: ['sentry.io'],
+    LINEAR_API_KEY: ['api.linear.app'],
+    GITLAB_TOKEN: ['gitlab.com'],
+    DIGITALOCEAN_ACCESS_TOKEN: ['api.digitalocean.com'],
+  }),
+);
 
 // Reserved Secret variable names (internal/secrets/validate.go).
 const RESERVED = new Set([
@@ -206,28 +210,6 @@ export function configPathOK(p) {
   return p.split('/').every((c) => c !== '' && c !== '.' && !c.startsWith('..'));
 }
 
-export function deliveryPolicy(delivery, hosts = []) {
-  if (!['env', 'proxy'].includes(delivery) || !Array.isArray(hosts)) throw new Error('delivery must be env or proxy');
-  if (delivery === 'env' && hosts.length) throw new Error('env delivery cannot enforce hosts; use -');
-  if (delivery === 'proxy' && (!hosts.length || hosts.length > 32))
-    throw new Error('proxy delivery requires 1-32 exact hosts');
-  const normalized = hosts.map((name) => {
-    if (typeof name !== 'string') throw new Error('hosts must be exact public DNS names');
-    const h = name.toLowerCase().replace(/\.$/, '');
-    if (
-      h.length > 253 ||
-      !h.includes('.') ||
-      isIP(h) ||
-      /(?:^|\.)(?:local|localhost)$/.test(h) ||
-      h.split('.').some((label) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))
-    ) {
-      throw new Error('hosts must be exact public DNS names without a scheme, port, path, IP address or wildcard');
-    }
-    return h;
-  });
-  return { delivery, hosts: [...new Set(normalized)].sort() };
-}
-
 export function validID(s) {
   return typeof s === 'string' && /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(s);
 }
@@ -237,7 +219,6 @@ export function secretIdentity(s) {
     name: s.name,
     orgId: s.orgId,
     version: s.version,
-    delivery: s.delivery,
     hosts: [...(s.hosts || [])].sort(),
   };
 }

package/skills/instabox-basic-setup/scripts/plan.mjs

@@ -11,7 +11,8 @@ import {
   FILE_MAX_VALUE,
   FILE_MAX_TOTAL,
   configPathOK,
-  deliveryPolicy,
+  FORMAT,
+  TOKEN_HOSTS,
   human,
   isMain,
   sameSecret,
@@ -60,30 +61,29 @@ export class PlanError extends Error {
 }
 
 function checkContext(scan, secrets, orgId) {
-  if (scan.version !== 3 || !Array.isArray(scan.items))
+  if (
+    scan.version !== FORMAT ||
+    !Array.isArray(scan.items) ||
+    scan.items.some((it) => it.kind === 'env' && !TOKEN_HOSTS.has(it.name))
+  )
     throw new PlanError(['scan format changed; run scan.mjs again']);
   if (!validID(orgId)) throw new PlanError(['an explicit org ID is required']);
   if (!Array.isArray(secrets) || secrets.some((s) => s.orgId !== orgId || !s.id || !Number.isSafeInteger(s.version)))
     throw new PlanError(['Secret metadata must belong to the selected org and include IDs and versions']);
 }
 
-export function writePlan(
-  scan,
-  { secrets = [], manifest = { secrets: [] }, orgId, sandboxes = [], delivery = 'env', hosts = [] } = {},
-) {
+export function writePlan(scan, { secrets = [], manifest = { secrets: [] }, orgId, sandboxes = [] } = {}) {
   checkContext(scan, secrets, orgId);
   if (sandboxes.some((id) => !validID(id) || !id.startsWith('m_')))
     throw new PlanError(['sandboxes must use stable m_ IDs']);
-  const policy = deliveryPolicy(delivery, hosts);
   const out = [
     '# instabox basic setup: plan',
     '',
     'Check `[x]` the items to save or copy. Do not change IDs or delete lines.',
-    'Tokens become encrypted org Secrets. Each Delivery line explicitly chooses env (real values) or proxy (HTTPS-header placeholders with allowed hosts).',
-    'This run adds env grants only to the sandbox IDs below; an empty list adds no grants. Existing grants remain in force.',
-    'Proxy Secrets also become available to other org sandboxes whose proxy selection is all, including future sandboxes.',
+    'Tokens become encrypted org Secrets. A box sees a placeholder; the outbound proxy puts the token into HTTPS headers sent to the hosts listed for each token, and nowhere else.',
+    'This run selects them only on the sandbox IDs below; an empty list changes no selection. Existing selections remain in force.',
+    'Saved Secrets also become available to other org sandboxes whose selection is all, including future sandboxes.',
     'Replacing an existing Secret affects its other authorized sandboxes. Config files are copied once to the named running sandboxes and may overwrite those paths; they are not Secrets.',
-    'Env values can be copied into files, processes or snapshots; removing a selection cannot recover those copies.',
     '',
     `Org: \`${orgId}\``,
     `Sandboxes: \`${[...new Set(sandboxes)].join(',') || '-'}\``,
@@ -104,7 +104,7 @@ export function writePlan(
       const checked = it.checked && !other && (it.kind === 'env' || sandboxes.length > 0);
       let description =
         it.kind === 'env'
-          ? `${it.name} from ${it.from}`
+          ? `${it.name} from ${it.from}, for ${TOKEN_HOSTS.get(it.name).join(', ')}`
           : `~/${it.path}: ${it.files.length} file(s), ${human(it.bytes)}`;
       if (it.reason) description += `; off by default: ${it.reason}`;
       if (it.note) description += `; ${it.note}`;
@@ -112,12 +112,6 @@ export function writePlan(
       else if (ex.length) description += '; replaces the unchanged Secret from your previous run';
       if (it.kind === 'file' && !sandboxes.length) description += '; select running sandbox IDs before checking this';
       out.push(`- [${checked ? 'x' : ' '}] \`${it.id}\` ${description}`);
-      if (it.kind === 'env') {
-        // Preserve an existing mode as a starting point; never silently change
-        // a proxy credential into a real-value env credential on a repeat run.
-        const p = ex.length ? deliveryPolicy(ex[0].item.delivery, ex[0].item.hosts || []) : policy;
-        out.push(`Delivery \`${it.id}\`: \`${p.delivery}\` hosts \`${p.hosts.join(',') || '-'}\``);
-      }
     }
   }
   out.push('', '## Manual setup', '', 'These entries have no checkbox; no credentials are read for them.', '');
@@ -129,8 +123,7 @@ export function parsePlan(scan, text, { secrets = [], manifest = { secrets: [] }
   checkContext(scan, secrets, orgId);
   const errors = [];
   const byId = new Map(scan.items.map((it) => [it.id, it]));
-  const states = new Map(),
-    policies = new Map();
+  const states = new Map();
   let planOrg, sandboxes, digest;
   for (const [index, raw] of text.split('\n').entries()) {
     const line = raw.replace(/\r$/, ''),
@@ -155,20 +148,6 @@ export function parsePlan(scan, text, { secrets = [], manifest = { secrets: [] }
       }
       continue;
     }
-    if (/^Delivery\b/.test(line)) {
-      const m = line.match(/^Delivery `([^`]+)`: `([^`]+)` hosts `([^`]*)`$/);
-      if (!m || byId.get(m[1])?.kind !== 'env') {
-        errors.push(`line ${n}: invalid Delivery line`);
-        continue;
-      }
-      if (policies.has(m[1])) errors.push(`line ${n}: duplicate delivery for ${m[1]}`);
-      try {
-        policies.set(m[1], deliveryPolicy(m[2], m[3] === '-' ? [] : m[3].split(',').map((h) => h.trim())));
-      } catch (e) {
-        errors.push(`line ${n}: ${e.message}`);
-      }
-      continue;
-    }
     if (/^Selector:/.test(line)) errors.push(`line ${n}: legacy selectors are retired`);
     const d = line.match(/^<!-- plan ([0-9a-f]+):/);
     if (d) {
@@ -195,27 +174,21 @@ export function parsePlan(scan, text, { secrets = [], manifest = { secrets: [] }
     errors.push('different scan or org Secret state; scan, list Secrets and write a new plan');
   for (const it of scan.items) {
     if (!states.has(it.id)) errors.push(`\`${it.id}\` is missing from the plan`);
-    if (it.kind === 'env' && !policies.has(it.id))
-      errors.push(`\`${it.id}\` needs an explicit delivery mode and hosts line`);
   }
   if (errors.length) throw new PlanError(errors);
 
   const picked = scan.items.filter((it) => states.get(it.id));
-  const ghToken = picked.some(
-    (it) => it.kind === 'env' && it.name === 'GH_TOKEN' && policies.get(it.id).delivery === 'env',
-  );
   const items = picked.map((it) => {
     const item = { ...it };
     delete item.checked;
     if (it.kind === 'env') {
-      Object.assign(item, policies.get(it.id));
       item.expected = secrets.find((s) => s.name === it.name);
       item.expected = item.expected ? secretIdentity(item.expected) : null;
     } else {
       if (!sandboxes.length) errors.push(`\`${it.id}\`: config copying requires explicit running sandbox IDs`);
       item.files = it.files.map((f) => {
         if (!configPathOK(f.path)) errors.push(`\`${it.id}\`: invalid config path`);
-        const c = fileContent(f, { home: scan.home, ghToken });
+        const c = fileContent(f, { home: scan.home });
         if (c.error) errors.push(`\`${it.id}\`: ${c.error}`);
         const bytes = c.error ? 0 : Buffer.byteLength(c.text);
         if (bytes > FILE_MAX_VALUE) errors.push(`\`${it.id}\`: file exceeds the config-copy limit of 64 KiB`);
@@ -249,11 +222,10 @@ export function parsePlan(scan, text, { secrets = [], manifest = { secrets: [] }
   if (fileBytes > FILE_MAX_TOTAL)
     throw new PlanError(['config copies exceed 512 KiB; uncheck files or transfer them separately'], 3);
   return {
-    version: 3,
+    version: FORMAT,
     home: scan.home,
     orgId,
     sandboxes,
-    ghToken,
     items,
     manual: scan.manual,
     skipped: scan.items.filter((it) => !states.get(it.id)).map((it) => it.id),
@@ -285,14 +257,11 @@ function main() {
     const secrets = JSON.parse(readFileSync(secretsFile, 'utf8')).items;
     if (!Array.isArray(secrets)) throw new Error('metadata must be instabox secrets ls --json output');
     if (command === 'write') {
-      const sandboxes = [],
-        hosts = [];
+      const sandboxes = [];
       let value;
       while ((value = opt('--sandbox')) !== undefined) sandboxes.push(value);
-      while ((value = opt('--host')) !== undefined) hosts.push(value);
-      const delivery = opt('--delivery') || 'env';
       if (args.length) throw new Error('unknown write arguments');
-      process.stdout.write(writePlan(scan, { secrets, orgId, manifest, sandboxes, delivery, hosts }));
+      process.stdout.write(writePlan(scan, { secrets, orgId, manifest, sandboxes }));
     } else if (command === 'parse') {
       const limitFile = opt('--limits');
       const limits = limitFile ? JSON.parse(readFileSync(limitFile, 'utf8')) : {};

package/skills/instabox-basic-setup/scripts/push.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-// Save reviewed org Secrets, select them for named sandboxes, and copy ordinary
-// config files separately. Credential values are held only in memory/stdin.
+// Save reviewed org Secrets for their registry hosts, select them for named sandboxes, and copy
+// ordinary config files separately. Credential values are held only in memory/stdin.
 import { spawnSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
@@ -13,7 +13,8 @@ import {
   FILE_MAX_VALUE,
   FILE_MAX_TOTAL,
   configPathOK,
-  deliveryPolicy,
+  FORMAT,
+  TOKEN_HOSTS,
   human,
   isMain,
   run,
@@ -107,8 +108,8 @@ function validSource(it, home) {
 }
 
 function checkSelection(sel) {
-  if (sel.version !== 3 || Object.hasOwn(sel, 'selector'))
-    throw new Error('legacy selection format is retired; scan and approve a new org Secret plan');
+  if (sel.version !== FORMAT || Object.hasOwn(sel, 'selector'))
+    throw new Error('this selection was approved in an older format; scan and approve a new org Secret plan');
   if (
     !validID(sel.orgId) ||
     !Array.isArray(sel.sandboxes) ||
@@ -124,12 +125,15 @@ function checkSelection(sel) {
     if (ids.has(it.id)) throw new Error('duplicate selection ID');
     ids.add(it.id);
     if (it.kind === 'env') {
-      if (!secretNameOK(it.name) || names.has(it.name) || !validSource(it, sel.home) || !Object.hasOwn(it, 'expected'))
+      if (
+        !TOKEN_HOSTS.has(it.name) ||
+        !secretNameOK(it.name) ||
+        names.has(it.name) ||
+        !validSource(it, sel.home) ||
+        !Object.hasOwn(it, 'expected')
+      )
         throw new Error('invalid Secret selection or source');
       names.add(it.name);
-      const policy = deliveryPolicy(it.delivery, it.hosts);
-      if (JSON.stringify(policy.hosts) !== JSON.stringify(it.hosts))
-        throw new Error('hosts must use the normalized policy from the approved plan');
     } else if (it.kind === 'file') {
       if (!sel.sandboxes.length || !Array.isArray(it.files))
         throw new Error('config copying needs explicit sandbox IDs');
@@ -191,7 +195,7 @@ export function push(
       if (sel.items.some((it) => it.kind === 'file') && box.state !== 'running')
         throw new Error(`${id}: start the sandbox before copying config files`);
       const selection = json(['secrets', 'show', id]);
-      if (!Array.isArray(selection.envSecrets) || (selection.secrets !== 'all' && !Array.isArray(selection.secrets)))
+      if (selection.secrets !== 'all' && !Array.isArray(selection.secrets))
         throw new Error('sandbox returned invalid Secret selections');
       return box;
     });
@@ -211,7 +215,6 @@ export function push(
 
   const tokens = [],
     files = [];
-  const ghToken = sel.items.some((it) => it.kind === 'env' && it.name === 'GH_TOKEN' && it.delivery === 'env');
   const rcNames = new Map(),
     rcValues = new Map();
   for (const it of sel.items)
@@ -229,13 +232,13 @@ export function push(
         typeof value !== 'string' ||
         value.includes('\0') ||
         Buffer.byteLength(value) > SECRET_MAX_VALUE ||
-        (it.delivery === 'proxy' && /[\x00-\x08\x0a-\x1f\x7f]/.test(value))
+        /[\x00-\x08\x0a-\x1f\x7f]/.test(value)
       )
-        return fail(`${it.name}: could not prepare a valid ${it.delivery} value; nothing written`);
-      tokens.push({ item: it, value });
+        return fail(`${it.name}: could not prepare a valid header value; nothing written`);
+      tokens.push({ item: it, hosts: TOKEN_HOSTS.get(it.name), value });
     } else {
       for (const f of it.files) {
-        const got = fileContent(f, { home: sel.home, ghToken });
+        const got = fileContent(f, { home: sel.home });
         if (got.error || Buffer.byteLength(got.text) > FILE_MAX_VALUE)
           return fail(`~/${f.path}: config could not be prepared; nothing written`);
         files.push({ path: f.path, text: got.text });
@@ -267,11 +270,11 @@ export function push(
 
   const manifest = readManifest(manifestPath);
   let ok = true;
-  for (const { item, value } of tokens) {
+  for (const { item, hosts, value } of tokens) {
     const r = {
       name: item.name,
       kind: 'secret',
-      delivery: item.delivery,
+      hosts,
       bytes: Buffer.byteLength(value),
       status: dryRun ? 'would save' : 'failed',
     };
@@ -284,9 +287,7 @@ export function push(
         item.name,
         '--org',
         sel.orgId,
-        '--delivery',
-        item.delivery,
-        ...item.hosts.flatMap((h) => ['--host', h]),
+        ...hosts.flatMap((h) => ['--host', h]),
         '--json',
       ];
       const response = run(args, { env, input: value + '\n' });
@@ -298,8 +299,7 @@ export function push(
           saved.orgId !== sel.orgId ||
           !saved.id ||
           !Number.isSafeInteger(saved.version) ||
-          saved.delivery !== item.delivery ||
-          JSON.stringify(deliveryPolicy(saved.delivery, saved.hosts || []).hosts) !== JSON.stringify(item.hosts)
+          JSON.stringify(unique(saved.hosts || [])) !== JSON.stringify(unique(hosts))
         )
           throw new Error();
         r.status = 'saved';
@@ -310,7 +310,7 @@ export function push(
       }
     }
     log(
-      `${r.status} ${item.name} (${item.delivery}${item.hosts.length ? ', ' + item.hosts.join(',') : ''}, ${r.bytes} bytes) in ${sel.orgId}`,
+      `${r.status} ${item.name} (for ${hosts.join(',')}, ${r.bytes} bytes) in ${sel.orgId}`,
     );
   }
   if (!dryRun && tokens.length) saveManifest(manifestPath, manifest);
@@ -333,17 +333,14 @@ export function push(
     try {
       if (tokens.length) {
         const current = json(['secrets', 'show', box.id]);
-        const envNames = tokens.filter((t) => t.item.delivery === 'env').map((t) => t.item.name);
-        const proxyNames = tokens.filter((t) => t.item.delivery === 'proxy').map((t) => t.item.name);
-        const flags = [];
-        if (envNames.length) flags.push('--env-secrets', JSON.stringify(unique([...current.envSecrets, ...envNames])));
-        if (proxyNames.length && current.secrets !== 'all')
-          flags.push('--secrets', JSON.stringify(unique([...current.secrets, ...proxyNames])));
-        if (flags.length) json(['secrets', 'select', box.id, ...flags]);
+        if (current.secrets !== 'all') {
+          const names = unique([...current.secrets, ...tokens.map((t) => t.item.name)]);
+          json(['secrets', 'select', box.id, '--secrets', JSON.stringify(names)]);
+        }
         if (box.state === 'running') {
           const refreshed = json(['secrets', 'push', box.id]);
           if (refreshed.guest?.state !== 'applied')
-            throw new Error('guest delivery is pending or failed; inspect secrets show and retry');
+            throw new Error('the box has not applied the Secret selection; inspect secrets show and retry');
         }
       }
       if (files.length) {
@@ -377,7 +374,7 @@ export function push(
       }
       result.status = 'configured';
       log(
-        `configured ${box.id}${box.state === 'running' ? '; existing application processes may need a restart' : '; Secret delivery waits for the next start'}`,
+        `configured ${box.id}${box.state === 'running' ? '; existing application processes may need a restart' : '; the Secret selection applies at the next start'}`,
       );
     } catch (e) {
       ok = false;