instabox 0.6.3 → 0.7.0

package/skills/instabox-basic-setup/scripts/scan.mjs

@@ -13,7 +13,8 @@ import {
   MACOS_ONLY,
   SECRET_VALUE,
   FILE_MAX_VALUE,
-  WELL_KNOWN,
+  FORMAT,
+  TOKEN_HOSTS,
   hasCommand,
   isMain,
   isSecretName,
@@ -76,7 +77,6 @@ function scanTokens({ home, env, procEnv }) {
     byName.set(name, item);
     items.push(item);
   };
-  const reserved = new Set();
 
   // gh: the token gh keeps (keychain or hosts.yml), read with `gh auth token` at push time.
   if (hasCommand('gh', env)) {
@@ -84,42 +84,54 @@ function scanTokens({ home, env, procEnv }) {
     if (st.ok) {
       const who = (st.stdout + st.stderr).match(/account (\S+)/)?.[1] || null;
       add('GH_TOKEN', { type: 'cmd', argv: ['gh', 'auth', 'token', '--hostname', 'github.com'] }, '`gh auth token`', {
-        note: `${who ? `GitHub account ${who}; ` : ''}gh, and git over HTTPS to GitHub, use it on the box`,
+        note: `${who ? `GitHub account ${who}; ` : ''}gh uses it on the box; git over HTTPS needs its own sign-in`,
       });
     }
   }
 
-  // Shell startup files: exported tokens.
+  // Shell startup files: exported tokens. Only names in TOKEN_HOSTS can be saved; any other
+  // credential-looking export is a manual step.
+  const listed = new Set();
+  const listManual = (name, place, why, todo) => {
+    if (listed.has(name)) return;
+    listed.add(name);
+    manual.push({ what: `${name} (${place})`, why, todo });
+  };
   for (const f of SHELL_RC) {
     const text = readText(join(home, f));
     if (text === null) continue;
     for (const a of shellAssignments(text)) {
-      if (!WELL_KNOWN.has(a.name) && !isSecretName(a.name) && !a.secretValue) continue;
+      if (!TOKEN_HOSTS.has(a.name) && !isSecretName(a.name) && !a.secretValue) continue;
+      const place = `~/${f}:${a.line}`;
       if (!secretNameOK(a.name)) {
-        if (!reserved.has(a.name)) {
-          reserved.add(a.name);
-          manual.push({
-            what: `${a.name} (~/${f}:${a.line})`,
-            why: 'Secrets reserve this variable name for sandbox or trust configuration',
-            todo: `if a box needs it, set it there by hand`,
-          });
-        }
+        listManual(
+          a.name,
+          place,
+          'Secrets reserve this variable name for sandbox or trust configuration',
+          'if a box needs it, set it there by hand',
+        );
+        continue;
+      }
+      if (!TOKEN_HOSTS.has(a.name)) {
+        listManual(
+          a.name,
+          place,
+          'this skill does not know which HTTPS API hosts it is for',
+          `if its client sends it in an HTTPS header, \`instabox secrets set ${a.name} --org <org> --host <api-host>\` and select it on the box; other credentials need their own setup there`,
+        );
         continue;
       }
       const extra = {};
       if (a.keychain) {
         extra.checked = false;
         extra.reason = 'your shell reads it from the macOS keychain: checking it runs that lookup once, at push time';
-      } else if (!WELL_KNOWN.has(a.name)) {
-        extra.checked = false;
-        extra.reason = 'not a well-known model or service token: check it only for the org and sandboxes in the plan';
       }
-      add(a.name, { type: 'rc', file: join(home, f), name: a.name }, `~/${f}:${a.line}`, extra);
+      add(a.name, { type: 'rc', file: join(home, f), name: a.name }, place, extra);
     }
   }
-  // Well-known tokens in the environment the scan runs in (set some other way than a shell file).
+  // Known tokens in the environment the scan runs in (set some other way than a shell file).
   for (const name of Object.keys(procEnv).sort()) {
-    if (!WELL_KNOWN.has(name) || !procEnv[name]) continue;
+    if (!TOKEN_HOSTS.has(name) || !procEnv[name]) continue;
     add(name, { type: 'env', name }, 'this shell’s environment');
   }
 
@@ -127,23 +139,20 @@ function scanTokens({ home, env, procEnv }) {
     manual.push({
       what: 'GitHub token (GH_TOKEN)',
       why: hasCommand('gh', env) ? 'gh is not signed in on this machine' : 'gh is not installed on this machine',
-      todo: 'sign in here with `gh auth login` and run this again; or put a token in yourself: `instabox secrets set GH_TOKEN --org <org> --delivery env` (it prompts without echo)',
-    });
-  if (!byName.has('CLAUDE_CODE_OAUTH_TOKEN'))
-    manual.push({
-      what: 'Claude Code sign-in (CLAUDE_CODE_OAUTH_TOKEN)',
-      why: 'not found in your shell files; the sign-in on this machine is in the macOS keychain, and is never read',
-      todo:
-        'run `claude setup-token` yourself, then `instabox secrets set CLAUDE_CODE_OAUTH_TOKEN --org <org> --delivery env` and paste it at the prompt' +
-        (byName.has('ANTHROPIC_API_KEY')
-          ? ' (or skip it: ANTHROPIC_API_KEY is in the plan, and Claude Code uses that)'
-          : '; or `claude`, then /login, on each box'),
+      todo: 'sign in here with `gh auth login` and run this again; or put a token in yourself: `instabox secrets set GH_TOKEN --org <org> --host api.github.com` (it prompts without echo)',
     });
+  manual.push({
+    what: 'Claude Code sign-in',
+    why: 'the sign-in on this machine is in the macOS keychain, and is never read',
+    todo: byName.has('ANTHROPIC_API_KEY')
+      ? 'skip it: ANTHROPIC_API_KEY is in the plan, and Claude Code uses that; or run `claude`, then /login, on each box'
+      : 'run `claude`, then /login, on each box',
+  });
   if (!byName.has('OPENAI_API_KEY') && (hasCommand('codex', env) || statOrNull(join(home, '.codex'))))
     manual.push({
       what: 'Codex sign-in',
       why: 'no OPENAI_API_KEY in your shell files; a ChatGPT sign-in cannot be copied (its refresh token rotates)',
-      todo: 'on each box: `codex login --device-auth`; or `instabox secrets set OPENAI_API_KEY --org <org> --delivery env`, then select it explicitly for each intended sandbox',
+      todo: 'on each box: `codex login --device-auth`; or `instabox secrets set OPENAI_API_KEY --org <org> --host api.openai.com`, then select it on each box',
     });
   return { items, manual };
 }
@@ -259,7 +268,7 @@ export function scan(opts = {}) {
   const home = resolve(opts.home || env.HOME);
   const tokens = scanTokens({ home, env, procEnv: opts.procEnv || env });
   const items = [...tokens.items, ...scanGit({ home, env }), ...scanEditor({ home })];
-  return { version: 3, home, platform: opts.platform || process.platform, items, manual: tokens.manual };
+  return { version: FORMAT, home, platform: opts.platform || process.platform, items, manual: tokens.manual };
 }
 
 function main() {

package/skills/instabox-move-repo/SKILL.md

@@ -20,16 +20,16 @@ Three scripts in `scripts/` next to this file do the parts that must be exact (N
 What goes over:
 
 - All of the main checkout's `.git` (branches, tags, stashes, unpushed commits, the index so staged changes stay staged, each worktree's own HEAD and index), every tracked file, and every untracked file git does not ignore, in the main checkout and in each linked worktree.
-- **Never build output or dependencies**, even when the repo forgot to ignore them: `node_modules`, `target`, `dist`, `build`, `out`, `.next`, `.nuxt`, `.svelte-kit`, `.turbo`, `.cache`, `coverage`, `__pycache__`, `.venv`, `venv`, `.tox`, `.mypy_cache`, `.pytest_cache`, `.gradle`, `bazel-*`, `*.egg-info`, `*.o`, `*.so`, `*.pyc`, `*.class`, ... (the full list is `EXCLUDED_DIRS` and `EXCLUDED_FILES` in `repo-files.mjs`). Files git ignores stay too. A **tracked** file always goes, even under such a name, so `git status` matches. `--keep NAME` copies an excluded name anyway, for a repo whose source really lives in, say, `build/` (pass it to every `repo-files.mjs` run, step 1 and step 3, through `KEEP`). It does not bring back an untracked `.env`: their values need explicit Secret import and selection (step 7).
+- **Never build output or dependencies**, even when the repo forgot to ignore them: `node_modules`, `target`, `dist`, `build`, `out`, `.next`, `.nuxt`, `.svelte-kit`, `.turbo`, `.cache`, `coverage`, `__pycache__`, `.venv`, `venv`, `.tox`, `.mypy_cache`, `.pytest_cache`, `.gradle`, `bazel-*`, `*.egg-info`, `*.o`, `*.so`, `*.pyc`, `*.class`, ... (the full list is `EXCLUDED_DIRS` and `EXCLUDED_FILES` in `repo-files.mjs`). Files git ignores stay too. A **tracked** file always goes, even under such a name, so `git status` matches. `--keep NAME` copies an excluded name anyway, for a repo whose source really lives in, say, `build/` (pass it to every `repo-files.mjs` run, step 1 and step 3, through `KEEP`). It does not bring back an untracked `.env`: those stay behind (step 7 lists them).
 - Claude Code and Codex conversations for the repo and its worktrees (on by default, the user can opt out).
 
-Not moved: `.env` files that are not committed (their values can be imported as Secrets in step 7), credentials stored outside the repo (git credential helpers, gh, cloud, API keys in your environment), other local tools and config, other repos. A `.env` that is committed or staged is in `.git` and goes with it. Everything inside `.git` goes, including `.git/config` and so a remote URL with a token embedded in it (`https://x-access-token:TOKEN@...`); and only `.env`-named untracked files are held back, so an untracked `.npmrc` with a token, a `*.pem` or a `secrets.yaml` that git does not ignore goes too.
+Not moved: `.env` files that are not committed, credentials stored outside the repo (git credential helpers, gh, cloud, API keys in your environment), other local tools and config, other repos. A `.env` that is committed or staged is in `.git` and goes with it. Everything inside `.git` goes, including `.git/config` and so a remote URL with a token embedded in it (`https://x-access-token:TOKEN@...`); and only `.env`-named untracked files are held back, so an untracked `.npmrc` with a token, a `*.pem` or a `secrets.yaml` that git does not ignore goes too.
 
 **Never read, print or paste a credential value yourself**: not a `.env`, not `gh auth token`, not `echo $SOME_KEY`.
 
 Before starting, tell the user plainly:
 
-- **git push/pull from the box will not work until they set up credentials there** (for example `instabox ssh <box>` then `gh auth login`; org Secrets support key=value credentials, while git configuration must be set up separately).
+- **git push/pull from the box will not work until they set up credentials there** (for example `instabox ssh <box>` then `gh auth login`; org Secrets cover HTTP API keys only, so git sign-in is set up separately).
 - **The copied conversation history may contain secrets they pasted earlier** (tokens, keys, passwords). It goes by default; ask whether to skip it (or only Codex / only Claude Code).
 - Their local copy stays as it is, and nothing keeps the two in sync afterwards.
 
@@ -72,7 +72,7 @@ BOX=<box>
 instabox create --name "$BOX" --meta repo="$(basename "$DEST")"
 ```
 
-Box names are lowercase letters, digits and `-`. The box gets the default size, 4 vCPU / 8 GB (the instabox skill's Sizes lists the others a plan offers). The default template (`agent-browser`, shown as standard in the dashboard) has git, Node.js 22, Python (uv), Go, Rust, a C toolchain, Docker and a desktop with Chromium. This box is meant to stay; it pauses itself after 30 idle minutes. The `repo=` label can match existing Vault selectors; it does not select org Secrets. Without Secret selection flags the box keeps the existing Vault behavior. Opt into org Secrets explicitly with `--secrets` or `--env-secrets`; at creation, `--env-secrets` alone also selects all org proxy Secrets. Use `--no-vault --secrets none --env-secrets none` when neither store should deliver credentials.
+Box names are lowercase letters, digits and `-`. The box gets the default size, 4 vCPU / 8 GB (the instabox skill's Sizes lists the others a plan offers). The default template (`agent-browser`, shown as standard in the dashboard) has git, Node.js 22, Python (uv), Go, Rust, a C toolchain, Docker and a desktop with Chromium. This box is meant to stay; it pauses itself after 30 idle minutes. The `repo=` label can match a user's existing Vault selectors (the Vault is legacy and will be retired; never save credentials there); it does not select org Secrets. Without `--secrets` the box still gets such existing Vault items. Opt into org Secrets explicitly with `--secrets NAME,NAME`. Use `--no-vault --secrets none` when neither store should deliver credentials.
 
 ## 3. Copy the repo and its worktrees
 
@@ -111,7 +111,7 @@ done
 git worktree list; instabox exec "$BOX" --cwd "$DEST" -- git worktree list
 ```
 
-The only allowed differences are `<` lines starting with `??` for what the plan left out (a build directory, an untracked `.env`, or a whole `?? dir/` that held only those), and ` M <submodule>` for a submodule with uncommitted changes inside it (those are not copied: note it for step 8). A name passed with `--keep` must not show up as a `??` difference: it was meant to go. HEADs must match, and the box's `git worktree list` must show the same branches, detached HEADs and `locked` marks at the box paths, without the worktrees left behind. Anything else: stop and look before going on.
+The only allowed differences are `<` lines starting with `??` for what the plan left out (a build directory, an untracked `.env`, or a whole `?? dir/` that held only those), and ` M <submodule>` for a submodule with uncommitted changes inside it (those are not copied: note it for step 7). A name passed with `--keep` must not show up as a `??` difference: it was meant to go. HEADs must match, and the box's `git worktree list` must show the same branches, detached HEADs and `locked` marks at the box paths, without the worktrees left behind. Anything else: stop and look before going on.
 
 ## 4. Conversation history (unless the user opted out)
 
@@ -165,36 +165,13 @@ instabox exec "$BOX" --cwd "$DEST" -- 'git status --porcelain | sort; git rev-pa
 
 Compare with step 3. New `??` lines from the installs (for example a lockfile the project does not commit) are worth a mention; a modified tracked file is not expected: find which step did it.
 
-## 7. `.env` values: explicit Secret import and selection
-
-The plan's `envLeftOut` lists excluded files by name (`jq -r '.main.envLeftOut, (.worktrees[] | select(.move) | .envLeftOut) | .[]' "$W/plan.json"`). Do not print their contents. The new Secret model stores individual key=value entries, not files, and does not create or link a `.env` in the repo.
-
-For a project that needs the real values, explain that env delivery makes them readable by code in the box. Use the user's authorization to import the intended file and select its names for this box. Import is org-wide and replaces existing entries with the same names: resolve conflicts and confirm any intended replacement before importing. Different projects needing different values under the same variable name should use separate orgs, or configure their applications to use distinct names; do not silently rename or overwrite a shared credential.
-
-After that choice, per approved file (the CLI reads values; saved JSON contains metadata only):
-
-```bash
-BOX_ORG=$(instabox get "$BOX" --json | jq -r '.orgId')
-instabox secrets show "$BOX" --json > "$W/selected-secrets.json"
-instabox secrets import "<local .env path>" --org "$BOX_ORG" --delivery env --json > "$W/imported-secrets.json"
-ENV_NAMES=$(jq -c -s '.[0].envSecrets + [.[1].items[].name] | unique' "$W/selected-secrets.json" "$W/imported-secrets.json")
-instabox secrets select "$BOX" --env-secrets "$ENV_NAMES"
-instabox secrets push "$BOX"
-```
-
-This merges the approved env names with the box's current env selection and leaves its proxy selection unchanged. Import alone grants no env access to any box. Start a new login shell, or restart/reconfigure the application, to load the updated environment. Use silent presence checks; do not print values to verify delivery.
-
-For credentials sent literally in HTTPS headers, save them with `--delivery proxy --host <approved-host>` instead, and select the corresponding proxy names. Every entry in one import shares its delivery mode and host scope, so do not import a mixed `.env` as proxy credentials without separating those decisions. A native database client or a client that computes signatures needs an explicitly selected env value.
-
-If the application requires a physical `.env` or another credential file, it needs a separate, explicitly authorized file-transfer or guest-generation workflow with restricted file permissions. Such a file is readable in the guest and may be included in snapshots; it has no Secret-managed file cleanup. Report this requirement rather than claiming Secret import recreates the original file. Tokens and local editor or git configuration are separate setup decisions; metadata labels do not grant credentials.
-
-## 8. Tell the user
+## 7. Tell the user
 
 - The box name and where the repo is: `instabox ssh <box>`, then `cd /data/workspace/<name>`; each worktree with its box path and branch; worktrees left behind and why.
 - Uncommitted work inside a submodule (a ` M <submodule>` line in step 3) did not come over: name each such submodule so the user can commit or copy that work themselves.
 - Sizes: on disk before, sent after, and the biggest things left out (they were rebuilt or reinstalled on the box).
 - What was installed, whether build and tests pass, and anything left to do (each FAILED step and note from `deps.sh` that is not fixed).
-- Again: git push/pull needs credentials set up on the box. State which Secret names and delivery modes were selected, if any; never include values. Ignored files, build output and untracked `.env` files were not copied. Secrets in committed or staged files, anywhere in `.git` (such as a token in a remote URL in `.git/config`), in untracked files not named `.env*`, or in the copied history, did go over.
+- Again: git push/pull needs credentials set up on the box. Ignored files and build output were not copied. Untracked `.env` files were left behind: list them by name from the plan (`jq -r '.main.envLeftOut, (.worktrees[] | select(.move) | .envLeftOut) | .[]' "$W/plan.json"`), never their contents. For an HTTP API key the project needs, the user can run `instabox secrets set NAME --host <api-host>` and select it on the box with `instabox secrets select`; database URLs and other credentials need their own setup on the box. Secrets in committed or staged files, anywhere in `.git` (such as a token in a remote URL in `.git/config`), in untracked files not named `.env*`, or in the copied history, did go over.
 - How to pick up old conversations, kept short, with the session ids from step 4:
   - Claude Code, in the repo (or worktree) directory on the box: `claude --continue` (latest) or `claude --resume` (picker, or `claude --resume <id>`).
   - Codex, in that directory: `codex resume` (picker for this directory), `codex resume --last`, or `codex resume <id>`.

package/skills/instabox-move-repo/scripts/deps.sh

@@ -325,7 +325,7 @@ project() { # dir label
       note "$L: has a compose file; its services were not started (docker compose up -d)"
     for f in .env.example .env.sample .env.template; do
       if [ -f "$f" ] && [ ! -e .env ]; then
-        note "$L: expects a .env (see $f); .env files are not copied: bring it through the Vault (instabox-move-repo skill, .env files)"
+        note "$L: expects a .env (see $f); .env files are not copied: the user sets it up (instabox-move-repo skill, step 7)"
         break
       fi
     done

package/skills/instabox-move-repo/scripts/repo-files.mjs

@@ -10,7 +10,7 @@
 //                                                              relative to PATH
 //   --skip-worktree PATH   leave a linked worktree behind (repeatable; pass it to --list0 runs too)
 //   --keep NAME            copy an excluded name anyway (repeatable): --keep build (not an untracked
-//                          .env: those go through the Vault)
+//                          .env: those always stay behind)
 //
 // What goes: all of the main checkout's .git (branches, stashes, the index, unpushed commits, the
 // worktrees' own HEAD and index under .git/worktrees/), every tracked file that exists, and every
@@ -108,7 +108,7 @@ export const EXCLUDED_FILES = [
   '.DS_Store',
 ];
 
-// Untracked .env files never go (secrets belong in the Vault). Templates do.
+// Untracked .env files never go: the final report lists them as left behind. Templates do.
 const ENV_FILE = /^\.env(?:\..+)?$/;
 const ENV_TEMPLATE = /^\.env\.(?:example|sample|template|dist|defaults)$/;
 const isEnvName = (f) => {

package/skills/instabox-snapshots/SKILL.md

@@ -18,7 +18,7 @@ instabox snapshot save work --name work-ready --description "deps installed, rep
 - A running box is saved live, without stopping it: the snapshot is `pending` in `instabox snapshot ls` until its disks finish uploading (`--no-wait` returns at once).
 - Do not stop the box first: `stop` ends every process in it. A live snapshot is like a clean power cut: what is on disk is kept, what programs hold only in memory is not. Only if the server answers that this box must be stopped, or if a program must write its data to disk first (a database mid-write), run `instabox stop work`, save, then `instabox start work`.
 - `--root-only` saves just the root disk (smaller; `/data` is not included).
-- A disk snapshot includes credential files written by applications, tool sign-ins, and historical Vault files. The managed Secret environment lives on tmpfs, but applications can copy real env values to disk; a suspend snapshot can also retain them in process memory. Do not describe snapshots as credential-free. Review copied credentials and rotate upstream when required before sharing or retaining them.
+- A disk snapshot includes credential files written by applications, tool sign-ins, and historical Vault files; a suspend snapshot can also retain credentials in process memory. Org Secrets reach the box only as placeholders, so a snapshot holds none of their values, but anything an app or a person wrote to disk is kept. Do not describe snapshots as credential-free. Review copied credentials and rotate upstream when required before sharing or retaining them.
 - Pick names that say what is inside (`node20-playwright`, `api-db-seeded`); names must be unique among your snapshots.
 
 ## Load
@@ -50,13 +50,13 @@ instabox create --name work2 --snapshot work-copy
 instabox snapshot rm work-copy                          # optional; work2 is not affected
 ```
 
-The copy gets a new sandbox identity and the selections in its creation request. Without Secret selection flags it keeps the existing Vault behavior and does not enroll in org Secrets; it does not inherit the source's explicit grants or exclusions. To disable new delivery from both stores, use:
+The copy gets a new sandbox identity and the Secret selection in its creation request. Without `--secrets` it keeps the existing Vault behavior and does not enroll in org Secrets; it does not inherit the source's selection. To give it neither store's credentials, use:
 
 ```sh
-instabox create --name work2 --snapshot work-copy --no-vault --secrets none --env-secrets none
+instabox create --name work2 --snapshot work-copy --no-vault --secrets none
 ```
 
-To provide a database credential, select its env Secret explicitly with `--env-secrets DATABASE_URL`. At creation that flag alone also selects all org proxy Secrets; add `--secrets none` or specific names to narrow proxy access. Copied placeholders cannot authorize use as the source sandbox. New selections do not erase real credentials already present in copied files; a new proxy identity does not make those files safe to share.
+To give the copy API credentials, name them with `--secrets NAME,NAME`. Placeholders copied from the source box do not work for the new one. New selections do not erase credentials that apps or people already wrote into files on the copied disks; review those before sharing the snapshot or the box.
 
 ## Clean up