wealthbox-cli 1.5.1__tar.gz → 2.1.0__tar.gz

{wealthbox_cli-1.5.1 → wealthbox_cli-2.1.0}/.github/workflows/ci.yml

@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: astral-sh/setup-uv@v6
         with:
           python-version: "3.12"
-      - run: pip install -e ".[dev]"
-      - run: ruff check src/ tests/
+      - run: uv sync --extra dev
+      - run: uv run ruff check src/ tests/
 
   test:
     runs-on: ubuntu-latest
@@ -25,14 +25,26 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: astral-sh/setup-uv@v6
         with:
           python-version: ${{ matrix.python-version }}
-      - run: pip install -e ".[dev]"
-      - run: pytest
+      - run: uv sync --extra dev
+      - run: uv run pytest
 
-  publish:
+  skill-ref-drift:
     needs: [lint, test]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: "3.12"
+      - run: uv sync --extra dev
+      - run: uv run wbox internals regen-skill-refs
+      - run: git diff --exit-code -- src/wealthbox_tools/skills/wealthbox-crm/references/
+
+  publish:
+    needs: [lint, test, skill-ref-drift]
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     permissions:
@@ -40,9 +52,8 @@ jobs:
     environment: pypi
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: astral-sh/setup-uv@v6
         with:
           python-version: "3.12"
-      - run: pip install build
-      - run: python -m build
+      - run: uv build
       - uses: pypa/gh-action-pypi-publish@release/v1

wealthbox_cli-2.1.0/.github/workflows/release-binaries.yml

@@ -0,0 +1,220 @@
+# Per-platform PyInstaller build + GitHub Release upload.
+#
+# Triggered on v* tags (and manually via workflow_dispatch for fork
+# validation). Builds a single-file ``wbox`` binary for each of the four
+# supported targets, computes its SHA-256, and uploads the binaries plus
+# a combined manifest as assets on the GitHub Release for the tag.
+#
+# The PyPI publish job lives in ci.yml and is intentionally not touched
+# here — both workflows fire on ``v*`` tags but operate independently.
+#
+# ----------------------------------------------------------------------
+# Manifest contract (LOCKED — downstream consumers: issue #42 install.sh
+# rewrite, issue #43 install.ps1 parity)
+# ----------------------------------------------------------------------
+# Manifest filename: SHA256SUMS.txt
+# Format:            standard sha256sum-compatible. One record per line:
+#                    <hex-sha256><two-spaces><filename>
+# Sort order:        ASCII-sorted by filename (stable across runs)
+# Binary filenames:
+#   wbox-linux-x64
+#   wbox-macos-arm64
+#   wbox-macos-x64
+#   wbox-windows-x64.exe
+# Manifest assets are attached to the same GitHub Release as the four
+# binaries. Install scripts can fetch SHA256SUMS.txt and a single binary
+# from the same release URL prefix and verify the binary against the
+# matching line.
+# ----------------------------------------------------------------------
+
+name: Release Binaries
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: linux-x64
+            binary: wbox-linux-x64
+          - os: macos-15-intel    # Intel runner (x86_64) — macos-13 was retired Dec 2025
+            target: macos-x64
+            binary: wbox-macos-x64
+          - os: macos-14          # Apple Silicon runner (arm64)
+            target: macos-arm64
+            binary: wbox-macos-arm64
+          - os: windows-latest
+            target: windows-x64
+            binary: wbox-windows-x64.exe
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install runtime + build deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install .
+          pip install pyinstaller
+
+      - name: Build single-file binary (Unix)
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          pyinstaller \
+            --onefile \
+            --name "${{ matrix.binary }}" \
+            --noconfirm \
+            --collect-data wealthbox_tools \
+            --copy-metadata wealthbox-cli \
+            scripts/wbox_entry.py
+          test -f "dist/${{ matrix.binary }}"
+          chmod +x "dist/${{ matrix.binary }}"
+
+      - name: Build single-file binary (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          pyinstaller `
+            --onefile `
+            --name "${{ matrix.binary }}" `
+            --noconfirm `
+            --collect-data wealthbox_tools `
+            --copy-metadata wealthbox-cli `
+            scripts/wbox_entry.py
+          if (-not (Test-Path "dist/${{ matrix.binary }}")) {
+            throw "expected dist/${{ matrix.binary }} to exist"
+          }
+
+      - name: Smoke-test binary
+        # `--version` only proves the entry point runs. `skills install`
+        # exercises bundled package data — it reads
+        # wealthbox_tools/skills/wealthbox-crm via importlib.resources — so
+        # this fails loudly if --collect-data wealthbox_tools didn't bundle
+        # the skill template. Runs against the fresh runner HOME with
+        # --no-bootstrap to skip the post-install confirm prompt.
+        run: |
+          ./dist/${{ matrix.binary }} --version
+          ./dist/${{ matrix.binary }} skills install --platform claude-code-user --no-bootstrap
+
+      - name: Compute SHA-256 (Unix)
+        if: runner.os != 'Windows'
+        shell: bash
+        working-directory: dist
+        run: |
+          if command -v sha256sum >/dev/null 2>&1; then
+            sha256sum "${{ matrix.binary }}" > "${{ matrix.binary }}.sha256"
+          else
+            # macOS: shasum -a 256 emits sha256sum-compatible "<hash>  <name>"
+            shasum -a 256 "${{ matrix.binary }}" > "${{ matrix.binary }}.sha256"
+          fi
+          cat "${{ matrix.binary }}.sha256"
+
+      - name: Compute SHA-256 (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        working-directory: dist
+        run: |
+          $hash = (Get-FileHash -Algorithm SHA256 "${{ matrix.binary }}").Hash.ToLower()
+          # sha256sum format: "<hex>  <filename>" (two spaces, LF line ending)
+          $line = "$hash  ${{ matrix.binary }}`n"
+          [System.IO.File]::WriteAllText(
+            (Join-Path $PWD "${{ matrix.binary }}.sha256"),
+            $line
+          )
+          Get-Content "${{ matrix.binary }}.sha256"
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: wbox-${{ matrix.target }}
+          path: |
+            dist/${{ matrix.binary }}
+            dist/${{ matrix.binary }}.sha256
+          if-no-files-found: error
+          retention-days: 7
+
+  manifest-and-release:
+    name: Combine manifest and upload to release
+    needs: [build]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download all build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Stage release files
+        shell: bash
+        run: |
+          mkdir -p release
+          # Each artifact directory contains one binary + one .sha256 file.
+          find artifacts -type f \( -name 'wbox-*' -a ! -name '*.sha256' \) -exec cp -v {} release/ \;
+          find artifacts -type f -name '*.sha256' -exec cp -v {} release/ \;
+          ls -la release
+
+      - name: Build combined SHA256SUMS.txt
+        shell: bash
+        working-directory: release
+        run: |
+          # Concatenate per-binary sums into a single sha256sum-compatible
+          # manifest, ASCII-sorted by filename for stability.
+          # Each .sha256 file is already in "<hex>  <filename>" form.
+          cat *.sha256 | LC_ALL=C sort -k 2 > SHA256SUMS.txt
+          echo "----- SHA256SUMS.txt -----"
+          cat SHA256SUMS.txt
+          echo "--------------------------"
+          # Verify the manifest against the staged binaries as a sanity check.
+          sha256sum -c SHA256SUMS.txt
+
+      - name: Upload combined manifest artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: SHA256SUMS
+          path: release/SHA256SUMS.txt
+          if-no-files-found: error
+
+      - name: Upload assets to GitHub Release
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          GH_REPO: ${{ github.repository }}
+        shell: bash
+        working-directory: release
+        run: |
+          # Ensure a release exists for the tag. If the PyPI publish job in
+          # ci.yml or a manual release-create created it first, --clobber on
+          # upload handles re-runs cleanly.
+          if ! gh release view "$TAG" >/dev/null 2>&1; then
+            gh release create "$TAG" \
+              --title "$TAG" \
+              --notes "Automated release for $TAG. Binaries built by release-binaries.yml; PyPI wheel published by ci.yml."
+          fi
+          # Upload all four binaries + the combined manifest. Per-platform
+          # .sha256 sidecars are intentionally not uploaded — SHA256SUMS.txt
+          # is the single source of truth for installers.
+          gh release upload "$TAG" \
+            wbox-linux-x64 \
+            wbox-macos-arm64 \
+            wbox-macos-x64 \
+            wbox-windows-x64.exe \
+            SHA256SUMS.txt \
+            --clobber

wealthbox_cli-1.5.1/docs/changelog.md → wealthbox_cli-2.1.0/CHANGELOG.md

@@ -1,12 +1,94 @@
 # Changelog
 
-All notable changes to **wealthbox-cli** are documented here.
+All notable changes to `wealthbox-cli` are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
+adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-This project uses [Semantic Versioning](https://semver.org/).
+## [2.1.0] - 2026-05-09
 
----
+Repository simplification release. Drops a runtime dep, retires `.env` support,
+and switches dev tooling to [uv](https://docs.astral.sh/uv/).
 
-## [1.3.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.3.0) — 2026-05-03
+### Breaking
+- **Removed `.env` file support.** Token resolution is now a 3-tier chain:
+  `--token` flag → `WEALTHBOX_TOKEN` env var → config file. Users relying on a
+  working-directory `.env` should migrate to `wbox config set-token` (preferred)
+  or export `WEALTHBOX_TOKEN` in their shell. The `python-dotenv` runtime
+  dependency was dropped.
+
+### Changed
+- Development tooling moved to [uv](https://docs.astral.sh/uv/). `uv sync
+  --extra dev` replaces the manual `python -m venv` + activate + `pip install
+  -e` dance, and `uv run wbox …` replaces direct `.venv/bin/wbox` invocation.
+  CI now uses `astral-sh/setup-uv@v6` and `uv build` for the publish job. Plain
+  `pip install -e ".[dev]"` continues to work — `pyproject.toml` is the source
+  of truth for both tools.
+- `scripts/run-wbox.sh` and `scripts/smoke_test.sh` invoke via `uv run` and no
+  longer source a `.env` file.
+
+### Removed
+- `.env` and `.env.example` files at the repo root.
+- `.python-version` file. `requires-python = ">=3.11"` in `pyproject.toml` is
+  the authoritative interpreter constraint; uv reads it directly.
+
+## [2.0.0] - 2026-05-09
+
+v2 retires the Claude marketplace plugin distribution and ships `wbox` as a
+standalone binary plus a PyPI package. Existing v1 users must reinstall via the
+new bootstrap script or `pip install wealthbox-cli` — see Breaking below.
+
+### Breaking
+- **Retired the Claude marketplace plugin distribution.** `wbox` no longer
+  ships through the Claude marketplace. Install via `pip install wealthbox-cli`
+  or the bootstrap script (`curl -fsSL https://github.com/massive-value/wealthbox-cli/releases/latest/download/install.sh | sh`).
+  v1's `claude plugin install` flow is gone.
+- **Rewrote `install.sh` and `install.ps1`** to fetch a prebuilt binary from
+  GitHub Releases instead of detecting and preferring the Claude marketplace
+  plugin (#42, #43). The installers now verify a checksum manifest before
+  swapping the binary into place.
+- **Removed v1 distribution artifacts** — the in-repo plugin manifest and
+  marketplace metadata are deleted (#27).
+- **Dropped plugin-cache scanning** from the skill platform helpers; `wbox
+  doctor` and `wbox skills list` no longer probe Claude's plugin cache (#28).
+
+### Added
+- `wbox firm export` — end-to-end export of the configured firm's CRM data to
+  a portable JSON snapshot (#31).
+- `wbox firm import` with `--mode overwrite|merge|abort-on-conflict` and
+  `--from-url` for fetching a snapshot directly from a URL (#36, #46, #45).
+- `wbox firm diff` — diff a local snapshot against the live firm to preview
+  what an import would change (#47).
+- Post-import provenance metadata and a 90-day freshness warning surfaced by
+  `wbox doctor` (#48).
+- `wbox doctor` promoted to a top-level command, with a warning when the local
+  install is more than 30 days behind the latest GitHub release (#41).
+- `wbox self upgrade` — happy-path binary self-update (#32), Windows
+  deferred-swap support (#67), and a subprocess hand-off so a fresh `wbox`
+  upgrades bundled skills after the binary swap (#40).
+- `wbox prefs` — user-preferences slot for per-user defaults (#29).
+- Per-platform PyInstaller build + release workflow that publishes Linux,
+  macOS, and Windows binaries plus a checksum manifest to GitHub Releases (#33).
+- Skill-reference auto-generation markers across the bundled skill (#30, #85)
+  and a CI drift-detection job that fails when generated skill blocks fall out
+  of sync (#86).
+- Bootstrap Q&A skips the onboarding prompts when an imported firm snapshot
+  already carries an `onboarded_at` timestamp (#49).
+- `wbox firm apply` and `wbox doctor` now sweep stale `.old.<ts>` backup files
+  left behind by interrupted upgrades (#39).
+
+### Changed
+- Rewrote the README around the v2 install flow — bootstrap script first, PyPI
+  second, no marketplace path (#83).
+- Documented the three-layer config resolution (flag > env > config file) and
+  the new `prefs` commands inside the bundled skill (#34).
+
+### Fixed
+- `wbox self upgrade` now reads the checksum manifest under its release-asset
+  filename, fixing the post-#33 break (#82).
+- Pytest no longer clobbers the developer's real `~/.wbox_rate_limit.json`;
+  the rate-limit state file is isolated per test session (#56).
+
+## [1.3.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.3.0) - 2026-05-03
 
 ### Added
 
@@ -20,9 +102,7 @@ This project uses [Semantic Versioning](https://semver.org/).
 - Bootstrap `install.sh` no longer hangs at startup. The previous version did `exec </dev/tty` at the top, which cut off bash's source of piped script content (`curl … | bash`) and waited forever for the rest of the script to arrive on the user's keyboard. The whole body is now wrapped in a `main()` function so bash reads it fully before executing.
 - Bootstrap `install.ps1` no longer auto-closes its window on error. Wrapped in try/catch/finally with explicit step headers and a "Press Enter to close" pause so a transient PowerShell host stays open long enough to show the actual error.
 
----
-
-## [1.2.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.2.0) — 2026-05-02
+## [1.2.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.2.0) - 2026-05-02
 
 ### Changed
 
@@ -45,9 +125,7 @@ This project uses [Semantic Versioning](https://semver.org/).
 
 - `--platform` flag on `bootstrap`, `refresh`, and `mark-onboarded` is accepted but ignored, with a warning. Firm operations are no longer scoped per platform.
 
----
-
-## [1.1.6](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.1.6) — 2026-05-01
+## [1.1.6](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.1.6) - 2026-05-01
 
 ### Fixed
 - `wbox skills bootstrap` and `wbox skills refresh` now paginate every API call. Previously they fetched a single page (default `per_page=25`) for each category type, custom-field document type, and the user list, silently truncating any workspace with more than 25 entries per group. Generated `firm/categories.md`, `firm/custom-fields.md`, and `firm/users.md` are now complete.
@@ -58,9 +136,7 @@ This project uses [Semantic Versioning](https://semver.org/).
 - `wbox skills mark-onboarded` — stamps `firm.onboarded_at` in the skill's `_meta.json`. The agent invokes this as the last step of `bootstrap.md`; users typically don't need to run it manually.
 - `wbox skills list` and `wbox skills doctor` now report onboarded status (`bootstrapped (qualitative pending)` vs `onboarded`).
 
----
-
-## [1.1.5](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.1.5) — 2026-05-01
+## [1.1.5](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.1.5) - 2026-05-01
 
 ### Fixed
 - `wbox skills install`, `wbox skills bootstrap`, and `wbox skills refresh` now honor every token source the rest of the CLI does. Previously these commands only looked at the `--token` flag and `WEALTHBOX_TOKEN` env var, ignoring tokens stored via `wbox config set-token` and `.env` files. Users running `wbox skills install` after `wbox config set-token` saw "Wealthbox token required" errors despite having a token set.
@@ -69,9 +145,7 @@ This project uses [Semantic Versioning](https://semver.org/).
 ### Added
 - `wbox skills install` accepts `--token` (matching `bootstrap`, `refresh`, and `doctor`), so a token can be supplied inline for the post-install bootstrap step.
 
----
-
-## [1.1.4](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.1.4) — 2026-05-01
+## [1.1.4](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.1.4) - 2026-05-01
 
 ### Added
 - Workspace-level aliases for every resource-scoped category lookup. `wbox categories contact-types`, `wbox categories contact-roles`, `wbox categories event-categories`, `wbox categories task-categories`, and the rest now work alongside their existing `wbox <resource> categories` forms. Both routes call the same API endpoint.
@@ -79,25 +153,19 @@ This project uses [Semantic Versioning](https://semver.org/).
 ### Docs
 - Skill references (`lookups.md`, `contacts.md`) and `docs/cli-reference.md` updated to surface the workspace-level form as the primary listing.
 
----
-
-## [1.0.2](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.0.2) — 2026-03-30
+## [1.0.2](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.0.2) - 2026-03-30
 
 ### Changed
 - Redesigned comment handling — comments are now embedded in `get` commands
 - Added ID shorthand for resource lookups
 
----
-
-## [1.0.1](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.0.1) — 2026-03-30
+## [1.0.1](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.0.1) - 2026-03-30
 
 ### Changed
 - Updated README with API token instructions and config commands
 - Added deploy workflow documentation
 
----
-
-## [1.0.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.0.0) — 2026-03-29
+## [1.0.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v1.0.0) - 2026-03-29
 
 ### Added
 - Full CRUD for contacts (person, household, organization, trust), tasks, events, and notes
@@ -115,76 +183,56 @@ This project uses [Semantic Versioning](https://semver.org/).
 - GitHub Actions CI (lint + test across Python 3.11, 3.12, 3.13)
 - PyPI publishing via trusted publishers (OIDC)
 
----
-
 ## [0.8.5](https://github.com/massive-value/wealthbox-cli/releases/tag/v0.8.5)
 
 ### Changed
 - Standardized CLI help text across all commands
 
----
-
 ## [0.8.4](https://github.com/massive-value/wealthbox-cli/releases/tag/v0.8.4)
 
 ### Added
 - PyPI badges and install instructions
 
----
-
 ## [0.8.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v0.8.0)
 
 ### Added
 - Events CRUD support
 - Notes CRUD support (create, read, update — delete not supported by API)
 
----
-
 ## [0.7.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v0.7.0)
 
 ### Added
 - Tasks CRUD support
 - Task categories
 
----
-
 ## [0.6.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v0.6.0)
 
 ### Added
 - Household member management commands
 
----
-
 ## [0.5.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v0.5.0)
 
 ### Added
 - Contact CRUD operations
 - Contact categories and metadata lookups
 
----
-
 ## [0.4.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v0.4.0)
 
 ### Added
 - Output format support (`--format json|table|csv|tsv`)
 
----
-
 ## [0.3.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v0.3.0)
 
 ### Added
 - User listing and `me` command
 - Activity feed with cursor-based pagination
 
----
-
 ## [0.2.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v0.2.0)
 
 ### Added
 - Rate limiting (sliding-window, 300 req / 5-min)
 - Token configuration (`--token`, env var, `.env`)
 
----
-
 ## [0.1.0](https://github.com/massive-value/wealthbox-cli/releases/tag/v0.1.0)
 
 ### Added

{wealthbox_cli-1.5.1 → wealthbox_cli-2.1.0}/CONTRIBUTING.md

@@ -6,38 +6,46 @@ Thank you for your interest in contributing to **wealthbox-cli**!
 
 ## Development Setup
 
+This project uses [uv](https://docs.astral.sh/uv/) for dependency management. Install it first if you don't have it:
+
 ```bash
-git clone https://github.com/massive-value/wealthbox-cli
-cd wealthbox-cli
-python -m venv .venv
+# macOS / Linux
+curl -LsSf https://astral.sh/uv/install.sh | sh
+
+# Windows (PowerShell)
+irm https://astral.sh/uv/install.ps1 | iex
 ```
 
-Activate the virtual environment:
+Then clone and sync:
 
-| Platform | Command |
-|----------|---------|
-| macOS/Linux | `source .venv/bin/activate` |
-| Windows (PowerShell) | `.venv\Scripts\Activate.ps1` |
-| Windows (Command Prompt) | `.venv\Scripts\activate.bat` |
+```bash
+git clone https://github.com/massive-value/wealthbox-cli
+cd wealthbox-cli
+uv sync --extra dev
+```
 
-Then install with dev dependencies:
+`uv sync` creates a project-local `.venv/` and installs the package in editable mode with dev dependencies. There is nothing to "activate" — prefix commands with `uv run`:
 
 ```bash
-pip install -e ".[dev]"
+uv run wbox --version
+uv run pytest
+uv run ruff check src/ tests/
 ```
 
 Configure your Wealthbox API token (optional — tests don't require a real token):
 
 ```bash
-wbox config set-token
+uv run wbox config set-token
 ```
 
+> Prefer plain `pip`? `pip install -e ".[dev]"` still works — `pyproject.toml` is the source of truth for both tools.
+
 ---
 
 ## Running Tests
 
 ```bash
-pytest
+uv run pytest
 ```
 
 Tests use [respx](https://lundberg.github.io/respx/) to mock HTTP at the transport layer — no real API calls are made.
@@ -45,7 +53,7 @@ Tests use [respx](https://lundberg.github.io/respx/) to mock HTTP at the transpo
 ## Code Style
 
 ```bash
-ruff check src/ tests/
+uv run ruff check src/ tests/
 ```
 
 - **ruff** for linting (E, F, I rules; 120-char line length)

{wealthbox_cli-1.5.1 → wealthbox_cli-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wealthbox-cli
-Version: 1.5.1
+Version: 2.1.0
 Summary: CLI and client library for the Wealthbox CRM API
 Project-URL: Homepage, https://github.com/massive-value/wealthbox-cli
 Project-URL: Documentation, https://massive-value.github.io/wealthbox-cli/
@@ -28,7 +28,6 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: pydantic<3.0,>=2.0
-Requires-Dist: python-dotenv<2.0,>=1.0
 Requires-Dist: tabulate<1.0,>=0.9
 Requires-Dist: typer<1.0,>=0.12
 Provides-Extra: dev
@@ -57,9 +56,9 @@ Description-Content-Type: text/markdown
 | **Windows** (PowerShell) | `irm https://raw.githubusercontent.com/massive-value/wealthbox-cli/main/scripts/install.ps1 \| iex` |
 
 The installer:
-1. Sets up the tools it needs (Python, etc. — handled automatically).
-2. Asks for your **Wealthbox API token**. *Where to find it:* in Wealthbox, click your initials in the top right → **Settings** → **API Access** → **Create Access Token**. Paste the token when prompted.
-3. Installs the AI agent skill into [Claude Code](https://claude.ai/download) (and Codex, if you have it).
+1. Downloads the prebuilt `wbox` binary from the latest GitHub Release and verifies its SHA-256 checksum (no Python required).
+2. Installs the AI agent skill into [Claude Code](https://claude.ai/download) (and Codex, if you have it).
+3. Asks for your **Wealthbox API token**. *Where to find it:* in Wealthbox, click your initials in the top right → **Settings** → **API Access** → **Create Access Token**. Paste the token when prompted.
 
 That's it. Open Claude Code and try one of the prompts below.
 
@@ -104,16 +103,9 @@ You stay in control: the agent shows you what it's about to do before it does it
 
 ------------------------------------------------------------------------
 
-## Already a Claude Code user?
+## What gets installed, where
 
-You can install the skill directly from the plugin marketplace inside Claude Code:
-
-```
-/plugin marketplace add massive-value/wealthbox-cli
-/plugin install wealthbox-crm@massive-value
-```
-
-The plugin auto-updates daily. Firm data lives at `~/.config/wbox/firm/` (Mac/Linux) or `%APPDATA%\wbox\firm\` (Windows) and survives plugin updates. Run `wbox doctor` to see your install status anytime.
+The installer drops a single prebuilt `wbox` binary onto your PATH (`~/.local/bin/wbox` on Mac/Linux, `%LOCALAPPDATA%\Programs\wbox\wbox.exe` on Windows), then registers the AI agent skill with Claude Code (and Codex, if it's installed). Firm data lives at `~/.config/wbox/firm/` (Mac/Linux) or `%APPDATA%\wbox\firm\` (Windows) and survives reinstalls and upgrades. Run `wbox doctor` to see your install status anytime, and `wbox skills upgrade` to pull the latest skill template.
 
 ------------------------------------------------------------------------
 
@@ -155,7 +147,7 @@ wbox skills uninstall      # remove the skill template (firm data is preserved)
 wbox doctor                # comprehensive health check
 ```
 
-The marketplace plugin path (above) is recommended for Claude Code. The legacy `wbox skills install` path remains for Codex users (until OpenAI's marketplace lands), project-scoped installs, or air-gapped setups without the `claude` CLI.
+The one-line installer (top of this README) wires up Claude Code automatically. These commands are for the cases the installer doesn't cover: re-running on a different host, swapping platforms, project-scoped installs, or air-gapped setups where you've placed the `wbox` binary by hand.
 </details>
 
 <details>