diff --git a/.github/workflows/publish-cli.yml b/.github/workflows/ci.yml
similarity index 51%
rename from .github/workflows/publish-cli.yml
rename to .github/workflows/ci.yml
index c1cc269..674c987 100644
--- a/.github/workflows/publish-cli.yml
+++ b/.github/workflows/ci.yml
@@ -1,30 +1,16 @@
-name: Publish CLI
+name: CI
 
-# CI + npm publish for @simular-ai/box (cli/). Modeled on simular-ai/sai-sdk's publish-sai-mcp.yml.
+# Checks this repo's plugins and the box CLI they use, against real clients. The CLI itself is the
+# Rust simular-box, built and published to npm as @simular-ai/box from simular-ai/box-cli; this
+# repo publishes nothing to npm (the old JavaScript CLI that lived in cli/ was retired).
 #
-# Every non-draft PR that touches the CLI or a plugin folder runs:
-#   check    lint, unit tests, smoke test on Linux, macOS and Windows (plus Node 18 on Linux)
-#   plugins  each agent's own validator over the plugin folders
-#   clients  Layer 1: the real CLI against each real, installed client in an isolated HOME
-#            (versions pinned in cli/e2e/clients.json). No secrets.
+# Every non-draft PR that touches a plugin folder or e2e/ runs:
+#   plugins  each agent's own validator over the plugin folders, and the Claude plugin's CLI pin
+#   clients  Layer 1: the pinned CLI against each real, installed client in an isolated HOME
+#            (versions pinned in e2e/clients.json). No secrets.
 #   live     Layer 2: a real staging key (secret BOX_CI_KEY, variable BOX_CI_MCP_URL) proves the
 #            headless clients reach box and list its tools. Never on PRs from forks.
-# Publishing happens only when a tag `cli-vX.Y.Z` (or `cli-vX.Y.Z-rc.N`, dist-tag "next") is pushed.
-#
-# Since @simular-ai/box 1.0.0 (the Rust CLI from simular-ai/box-cli) this repo no longer
-# publishes the CLI: its npm trusted publisher was removed, so do not push cli-v* tags. The
-# publish job below is kept only until cli/ is retired.
-#
-# Auth: npm trusted publishing (OIDC). The publish job's `id-token: write` lets the npm CLI swap
-# a GitHub OIDC token for a short-lived publish token, so no long-lived npm token is stored.
-# Requires the trusted-publisher config on npmjs.com (package @simular-ai/box -> Settings ->
-# Trusted Publisher): organization "simular-ai", repository "box-plugin", workflow filename
-# "publish-cli.yml", environment "npm". npm only lets you configure it on a package that already
-# exists, so the very first version is published once by hand (see cli/README.md).
-#
-# Gating: the publish job runs in the GitHub environment "npm" (add required reviewers there)
-# and refuses a tag whose commit is not on main. A tag ruleset on `cli-v*` limits who can push one.
-# The repo is public, so npm attaches a provenance attestation.
+# The CLI under test is `npx -y @simular-ai/box@X.Y.Z` at the version claude/ pins (e2e/cli.mjs).
 #
 # TODO(layer 3): nightly run against the latest client versions plus a real agent task on a box.
 
@@ -32,20 +18,20 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
     paths:
-      - 'cli/**'
+      - 'e2e/**'
       - 'claude/**'
       - 'dsh/**'
       - 'hermes/**'
       - 'openclaw/**'
       - '.claude-plugin/**'
-      - '.github/workflows/publish-cli.yml'
+      - '.github/workflows/ci.yml'
   push:
     branches: [main]
     paths:
-      - 'cli/**'
-      - '.github/workflows/publish-cli.yml'
-    tags:
-      - 'cli-v*'
+      - 'e2e/**'
+      - 'claude/**'
+      - '.claude-plugin/**'
+      - '.github/workflows/ci.yml'
   workflow_dispatch:
 
 concurrency:
@@ -60,43 +46,6 @@ defaults:
     shell: bash
 
 jobs:
-  check:
-    name: Check (${{ matrix.os }}, Node ${{ matrix.node }})
-    # Draft PRs run nothing; `ready_for_review` starts the checks. Non-PR events read `draft` as null.
-    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-        node: [24]
-        include:
-          - os: ubuntu-latest
-            node: 18
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 15
-    defaults:
-      run:
-        working-directory: cli
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
-        with:
-          node-version: ${{ matrix.node }}
-          cache: npm
-          cache-dependency-path: cli/package-lock.json
-      - run: npm ci
-      - name: Lint
-        if: matrix.node == 24
-        run: npm run lint
-      - name: Unit tests
-        run: npm test
-      - name: Smoke test
-        run: npm run smoke
-      - name: Pack
-        run: npm pack --dry-run
-
   plugins:
     name: Validate plugin folders
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
@@ -110,12 +59,12 @@ jobs:
         with:
           node-version: 24
       - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
-      - name: Install validators (versions from cli/e2e/clients.json)
+      - name: Install validators (versions from e2e/clients.json)
         run: |
           set -euo pipefail
-          spec() { node -p "require('./cli/e2e/clients.json')['$1'].npm"; }
+          spec() { node -p "require('./e2e/clients.json')['$1'].npm"; }
           npm install -g "$(spec claude-code)" "$(spec openclaw)"
-          tag=$(node -p "require('./cli/e2e/clients.json').hermes.tag")
+          tag=$(node -p "require('./e2e/clients.json').hermes.tag")
           git clone --quiet --depth 1 --branch "$tag" https://github.com/NousResearch/hermes-agent "$RUNNER_TEMP/hermes"
           (cd "$RUNNER_TEMP/hermes" && uv sync --frozen --extra mcp --quiet)
           echo "$RUNNER_TEMP/hermes/.venv/bin" >> "$GITHUB_PATH"
@@ -127,8 +76,8 @@ jobs:
           claude plugin validate ./claude
       - name: Plugin pins the CLI to one exact version that is on npm
         # A range (^1.0.0) lets npx run a version published after review; the Claude directory
-        # review asks for an exact pin. Since 1.0.0 the CLI is the Rust simular-box, released from
-        # simular-ai/box-cli, so the pin follows its npm releases, not cli/package.json.
+        # review asks for an exact pin. The CLI is the Rust simular-box, released from
+        # simular-ai/box-cli, so the pin follows its npm releases. e2e/ tests this same version.
         run: |
           set -euo pipefail
           pins=$(grep -rhoE '@simular-ai/box@[^ `"]*' claude | sort -u)
@@ -177,15 +126,15 @@ jobs:
         with:
           node-version: 24
           cache: npm
-          cache-dependency-path: cli/package-lock.json
+          cache-dependency-path: e2e/package-lock.json
       - run: npm ci
-        working-directory: cli
+        working-directory: e2e
       - name: Install ${{ matrix.client }}
         env:
           CLIENT: ${{ matrix.client }}
         run: |
           set -euo pipefail
-          get() { node -p "(require('./cli/e2e/clients.json')['$CLIENT'] || {})['$1'] || ''"; }
+          get() { node -p "(require('./e2e/clients.json')['$CLIENT'] || {})['$1'] || ''"; }
           if [ -n "$(get npm)" ]; then
             npm install -g "$(get npm)"
           elif [ "$CLIENT" = hermes ]; then
@@ -208,7 +157,6 @@ jobs:
           uv sync --frozen --extra mcp --quiet
           if [ -d .venv/Scripts ]; then echo "$(cygpath -w "$PWD/.venv/Scripts")" >> "$GITHUB_PATH"; else echo "$PWD/.venv/bin" >> "$GITHUB_PATH"; fi
       - name: connect, list, re-run, doctor, remove
-        working-directory: cli
         run: node e2e/install-matrix.mjs ${{ matrix.client }}
 
   live:
@@ -227,85 +175,21 @@ jobs:
         with:
           node-version: 24
           cache: npm
-          cache-dependency-path: cli/package-lock.json
+          cache-dependency-path: e2e/package-lock.json
       - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - run: npm ci
-        working-directory: cli
+        working-directory: e2e
       - name: Install OpenClaw and Hermes
         run: |
           set -euo pipefail
-          npm install -g "$(node -p "require('./cli/e2e/clients.json').openclaw.npm")"
-          git clone --quiet --depth 1 --branch "$(node -p "require('./cli/e2e/clients.json').hermes.tag")" https://github.com/NousResearch/hermes-agent "$RUNNER_TEMP/hermes"
+          npm install -g "$(node -p "require('./e2e/clients.json').openclaw.npm")"
+          git clone --quiet --depth 1 --branch "$(node -p "require('./e2e/clients.json').hermes.tag")" https://github.com/NousResearch/hermes-agent "$RUNNER_TEMP/hermes"
           (cd "$RUNNER_TEMP/hermes" && uv sync --frozen --extra mcp --quiet)
           echo "$RUNNER_TEMP/hermes/.venv/bin" >> "$GITHUB_PATH"
       - name: Key valid, clients connect and list box's tools
-        working-directory: cli
         env:
           BOX_MCP_URL: ${{ vars.BOX_CI_MCP_URL }}
           BOX_TOKEN: ${{ secrets.BOX_CI_KEY }}
         run: |
           echo "::add-mask::$BOX_TOKEN"
           node e2e/live.mjs hermes openclaw
-
-  publish:
-    name: Publish to npm
-    needs: [check, plugins, clients]
-    if: startsWith(github.ref, 'refs/tags/cli-v')
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    environment: npm
-    permissions:
-      contents: write # create the GitHub Release
-      id-token: write # npm trusted publishing (OIDC) and provenance
-    defaults:
-      run:
-        working-directory: cli
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-      - name: Tagged commit is on main
-        run: |
-          set -euo pipefail
-          git fetch --quiet origin main
-          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
-            echo "::error::$GITHUB_REF_NAME points at $GITHUB_SHA, which is not on main. Tag a commit on main." >&2
-            exit 1
-          fi
-      # No `registry-url`: setup-node would write an .npmrc with `_authToken=${NODE_AUTH_TOKEN}`,
-      # which shadows the OIDC handshake. Node 24 ships npm 11 (trusted publishing needs >= 11.5.1).
-      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
-        with:
-          node-version: 24
-          cache: npm
-          cache-dependency-path: cli/package-lock.json
-      - run: npm ci
-      - name: Verify tag matches package version and pick the dist-tag
-        id: release
-        run: |
-          set -euo pipefail
-          TAG_NAME="${GITHUB_REF#refs/tags/}"
-          TAG_VERSION="${TAG_NAME#cli-v}"
-          PKG_VERSION="$(node -p "require('./package.json').version")"
-          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
-            echo "::error::Tag version ($TAG_VERSION) does not match cli/package.json ($PKG_VERSION)." >&2
-            exit 1
-          fi
-          if echo "$TAG_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
-            echo "dist-tag=latest" >> "$GITHUB_OUTPUT"
-          elif echo "$TAG_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$'; then
-            echo "dist-tag=next" >> "$GITHUB_OUTPUT"
-          else
-            echo "::error::Tag '$TAG_NAME' is not a release tag (expected cli-vX.Y.Z or cli-vX.Y.Z-rc.N)." >&2
-            exit 1
-          fi
-      - name: Publish to npmjs.org
-        run: npm publish --provenance --access public --tag "${{ steps.release.outputs.dist-tag }}"
-      - name: Create GitHub Release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG_NAME: ${{ github.ref_name }}
-          PRERELEASE_FLAG: ${{ steps.release.outputs.dist-tag == 'next' && '--prerelease' || '' }}
-        run: |
-          gh release create "$TAG_NAME" --title "$TAG_NAME" --generate-notes --latest=false $PRERELEASE_FLAG
diff --git a/README.md b/README.md
index 6751097..7853501 100644
--- a/README.md
+++ b/README.md
@@ -9,13 +9,13 @@ Most agents need no plugin: add the MCP server `https://mcp.box.simular.ai/mcp`
 | Claude Code and Cowork | [`claude/`](claude/) | OAuth, once in the browser | `/plugin marketplace add simular-ai/box-plugin`, then `/plugin install simular-box@simular-box` |
 | DeepSeek Harness (dsh) | [`dsh/`](dsh/) | Personal key (`cb_...`), pasted on the plugin's page in Plugins | [dsh/README.md](dsh/README.md) |
 | OpenClaw | [`openclaw/`](openclaw/) | OAuth, once from the plugin's page in Settings | `openclaw plugins install @simular-ai/openclaw-box` |
-| Any of Claude Code, Codex, Cursor, OpenCode, Gemini CLI, Hermes, OpenClaw, VS Code (and steps for Claude Desktop) | [`cli/`](cli/) | OAuth; personal key with `--auth key` for Hermes and OpenClaw | `npx @simular-ai/box connect` (check with `npx @simular-ai/box doctor`) |
+| Any of Claude Code, Codex, Cursor, OpenCode, Gemini CLI, Hermes, OpenClaw, VS Code (and steps for Claude Desktop) | [`@simular-ai/box`](https://www.npmjs.com/package/@simular-ai/box) (the box CLI, from [simular-ai/box-cli](https://github.com/simular-ai/box-cli)) | OAuth; personal key with `--auth key` for Hermes and OpenClaw | `npx @simular-ai/box connect` (check with `npx @simular-ai/box doctor`) |
 | Hermes Agent | [`hermes/`](hermes/) | Personal key (`cb_...`) in `MCP_BOX_API_KEY`; OAuth optional | [hermes/README.md](hermes/README.md) |
 | ChatGPT and Codex (OpenAI plugin directory) | [`openai/`](openai/) | OAuth, once in the browser | Listed by OpenAI after review; build the upload with `openai/build-zip.sh` ([openai/README.md](openai/README.md)) |
 
 ## Offload: move a coding task into your box and back
 
-Going offline in the middle of a task? In Claude Code with the plugin, `/simular-box:offload` hands the task to a fresh Claude Code (or Codex, Cursor) session in your box, which keeps working while you are away; `/simular-box:back` brings its commits and its written hand-over home and merges them. Any other agent or a plain terminal uses `npx @simular-ai/box offload` and `npx @simular-ai/box back`. Setup and details: [cli/README.md](cli/README.md#offload).
+Going offline in the middle of a task? In Claude Code with the plugin, `/simular-box:offload` hands the task to a fresh Claude Code (or Codex, Cursor) session in your box, which keeps working while you are away; `/simular-box:back` brings its commits and its written hand-over home and merges them. Any other agent or a plain terminal uses `npx @simular-ai/box offload` and `npx @simular-ai/box back`. Setup and details: [the CLI's README](https://www.npmjs.com/package/@simular-ai/box).
 
 ## Adding an agent
 
@@ -29,4 +29,4 @@ Add a folder named after the agent with its own manifest, MCP config and, where
 - `openai/`: bump `version` in `openai/plugin.json` and `publication.release_notes`, run `openai/build-zip.sh`, upload the ZIP at platform.openai.com/plugins.
 - `hermes/`: bump `version` in `hermes/plugin.json`. Users copy the folder by hand until box is in the Hermes plugin catalog.
 - The Claude plugin's CLI pin: since 1.0.0, `@simular-ai/box` on npm is the Rust CLI released from [simular-ai/box-cli](https://github.com/simular-ai/box-cli). To move the plugin to a new CLI release, change the exact pin `npx -y @simular-ai/box@X.Y.Z` in `claude/skills/box-offload/SKILL.md` and bump `version` in `claude/.claude-plugin/plugin.json` in one PR (CI fails unless every pin under `claude/` names the same exact version and that version is on npm; never a range, because the Claude directory review requires that what runs is what it read).
-- `cli/`: the JavaScript CLI (0.2.x). It no longer publishes to npm: its trusted publisher on `@simular-ai/box` was removed when the Rust 1.0.0 shipped, so do not push `cli-v*` tags. The endpoint and CLI changes now go to simular-ai/box-cli.
+- The box CLI (`@simular-ai/box` on npm) is released from simular-ai/box-cli, not from here. `e2e/` tests the pinned version against each real client (versions in `e2e/clients.json`); see `.github/workflows/ci.yml`.
diff --git a/claude/README.md b/claude/README.md
index 5ba9e90..b5ace53 100644
--- a/claude/README.md
+++ b/claude/README.md
@@ -9,7 +9,7 @@ Most agents need no plugin: add the MCP server `https://mcp.box.simular.ai/mcp`
 | Claude Code and Cowork | [`claude/`](https://github.com/simular-ai/box-plugin/tree/main/claude) | OAuth, once in the browser | `/plugin marketplace add simular-ai/box-plugin`, then `/plugin install simular-box@simular-box` |
 | DeepSeek Harness (dsh) | [`dsh/`](https://github.com/simular-ai/box-plugin/tree/main/dsh) | Personal key (`cb_...`), pasted on the plugin's page in Plugins | [dsh/README.md](https://github.com/simular-ai/box-plugin/blob/main/dsh/README.md) |
 | OpenClaw | [`openclaw/`](https://github.com/simular-ai/box-plugin/tree/main/openclaw) | OAuth, once from the plugin's page in Settings | `openclaw plugins install @simular-ai/openclaw-box` |
-| Any of Claude Code, Codex, Cursor, OpenCode, Gemini CLI, Hermes, OpenClaw, VS Code (and steps for Claude Desktop) | [`cli/`](https://github.com/simular-ai/box-plugin/tree/main/cli) | OAuth; personal key with `--auth key` for Hermes and OpenClaw | `npx @simular-ai/box connect` (check with `npx @simular-ai/box doctor`) |
+| Any of Claude Code, Codex, Cursor, OpenCode, Gemini CLI, Hermes, OpenClaw, VS Code (and steps for Claude Desktop) | [`@simular-ai/box`](https://www.npmjs.com/package/@simular-ai/box) (the box CLI, from [simular-ai/box-cli](https://github.com/simular-ai/box-cli)) | OAuth; personal key with `--auth key` for Hermes and OpenClaw | `npx @simular-ai/box connect` (check with `npx @simular-ai/box doctor`) |
 | Hermes Agent | [`hermes/`](https://github.com/simular-ai/box-plugin/tree/main/hermes) | Personal key (`cb_...`) in `MCP_BOX_API_KEY`; OAuth optional | [hermes/README.md](https://github.com/simular-ai/box-plugin/blob/main/hermes/README.md) |
 | ChatGPT and Codex (OpenAI plugin directory) | [`openai/`](https://github.com/simular-ai/box-plugin/tree/main/openai) | OAuth, once in the browser | Listed by OpenAI after review; build the upload with `openai/build-zip.sh` ([openai/README.md](https://github.com/simular-ai/box-plugin/blob/main/openai/README.md)) |
 
@@ -79,4 +79,4 @@ Add a folder named after the agent with its own manifest, MCP config and, where
 - `openai/`: bump `version` in `openai/plugin.json` and `publication.release_notes`, run `openai/build-zip.sh`, upload the ZIP at platform.openai.com/plugins.
 - `hermes/`: bump `version` in `hermes/plugin.json`. Users copy the folder by hand until box is in the Hermes plugin catalog.
 - The Claude plugin's CLI pin: since 1.0.0, `@simular-ai/box` on npm is the Rust CLI released from [simular-ai/box-cli](https://github.com/simular-ai/box-cli). To move the plugin to a new CLI release, change the exact CLI version in every `npx -y` command in `claude/skills/box-offload/SKILL.md` and `claude/README.md`, and bump `version` in `claude/.claude-plugin/plugin.json`, in one PR (CI fails unless every pin under `claude/` names the same exact version and that version is on npm; never a range, because the Claude directory review requires that what runs is what it read).
-- `cli/`: the JavaScript CLI (0.2.x). It no longer publishes to npm: its trusted publisher on `@simular-ai/box` was removed when the Rust 1.0.0 shipped, so do not push `cli-v*` tags. The endpoint and CLI changes now go to simular-ai/box-cli.
+- The box CLI (`@simular-ai/box` on npm) is released from simular-ai/box-cli, not from here. `e2e/` tests the pinned version against each real client (versions in `e2e/clients.json`); see `.github/workflows/ci.yml`.
diff --git a/cli/.gitattributes b/cli/.gitattributes
deleted file mode 100644
index 36fcc5d..0000000
--- a/cli/.gitattributes
+++ /dev/null
@@ -1 +0,0 @@
-test/fixtures/** text eol=lf
diff --git a/cli/.gitignore b/cli/.gitignore
deleted file mode 100644
index 6b1d0bf..0000000
--- a/cli/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-LICENSE
diff --git a/cli/README.md b/cli/README.md
deleted file mode 100644
index 01ef596..0000000
--- a/cli/README.md
+++ /dev/null
@@ -1,114 +0,0 @@
-# @simular-ai/box
-
-Connect [box](https://box.simular.ai) to your AI apps in one command. box gives your AI agent a computer of its own: a cloud Linux desktop with Chrome and a shell, driven over MCP.
-
-```bash
-npx @simular-ai/box connect
-```
-
-The CLI finds the AI apps on this computer, asks which ones should use box, and adds the box MCP server (`https://mcp.box.simular.ai/mcp`) to each one in its own format. Other servers and settings in those files are left alone, each changed file gets a backup next to it (`*.box-backup-<time>`), and running it again changes nothing.
-
-```bash
-npx @simular-ai/box doctor     # is box set up right in each app? is the endpoint up? is the key valid?
-npx @simular-ai/box remove     # undo connect
-```
-
-The command is `simular-box` (`box` belongs to box.com's CLI), so after `npm i -g @simular-ai/box` it is `simular-box connect`.
-
-## Apps
-
-| App | `--client` | What connect does | Sign-in |
-| --- | --- | --- | --- |
-| Claude Code | `claude-code` | Installs the [`claude/`](../claude/) plugin (box server + box skill) with `claude plugin install simular-box@simular-box`. With `BOX_MCP_URL` set, `claude mcp add --scope user --transport http box <url>` instead | OAuth: `/mcp` → box → Authenticate |
-| Codex | `codex` | Writes `[mcp_servers.box]` to `$CODEX_HOME/config.toml` (default `~/.codex`) | OAuth: `codex mcp login box`, or Settings → MCP servers → Authenticate in the Codex app |
-| Cursor | `cursor` | Merges `mcpServers.box` into `~/.cursor/mcp.json` | OAuth: Settings → MCP → Login |
-| Gemini CLI | `gemini-cli` | Merges `mcpServers.box` (`type: http`) into `~/.gemini/settings.json` | OAuth: `/mcp auth box` (in a trusted folder) |
-| OpenCode | `opencode` | Merges `mcp.box` (`type: remote`) into `~/.config/opencode/opencode.json(c)` | OAuth: `opencode mcp auth box` |
-| Hermes Agent | `hermes` | Writes `mcp_servers.box` to `$HERMES_HOME/config.yaml` (default `~/.hermes`); restarts a running gateway | OAuth (`hermes mcp login box`) or `--auth key` |
-| OpenClaw | `openclaw` | `openclaw mcp set box …` with `transport: streamable-http`; restarts a running Gateway when the key changes | OAuth (`openclaw mcp login box`) or `--auth key` |
-| VS Code | `vscode` | Merges `servers.box` (`type: http`) into the user `mcp.json` | OAuth, when the server starts |
-| Claude Desktop | `claude-desktop` | Writes nothing: remote servers are connectors in the app. Prints the steps | OAuth in the app |
-
-Pick apps without prompts with `--client cursor,codex --yes`; `--yes` alone picks every app found. `--dry-run` shows what would change.
-
-The CLI only changes or removes a server that points at box by Simular (`mcp.box.simular.ai`, the old `relay.simular.cloud`, its staging host, or your `BOX_MCP_URL`). If an app already has a different server named `box`, such as box.com's MCP server, `connect` stops without changing anything, and `remove` leaves it alone. To add box next to it, use `--name simular-box`. A symlinked config stays a symlink: the file it points to is updated. If a config can't be written (owned by another user, or locked by the app), connect says so; for Codex it prints the steps to add box in the Codex app's Settings instead.
-
-## Sign-in
-
-Every app signs in with OAuth by default: the app opens a browser page, you sign in to box and click Approve. No key to copy.
-
-Hermes and OpenClaw often run around the clock on a server, where an expired OAuth sign-in waits for a person. For those, `--auth key` uses a personal key instead:
-
-```bash
-# create a key at https://box.simular.ai/keys, then:
-BOX_TOKEN=cb_... npx @simular-ai/box connect --client hermes,openclaw --auth key
-```
-
-Without `BOX_TOKEN`, an interactive run asks for the key with hidden input. The key is never accepted as a command-line argument and never printed. It goes only where the app reads secrets: `MCP_BOX_API_KEY` in `$HERMES_HOME/.env`, `BOX_TOKEN` in `~/.openclaw/.env` (both `0600`). The app config holds only a `${...}` reference to it. No backup is kept of those `.env` files, because a backup would keep an old or removed key on disk. OpenClaw's Gateway reads `.env` only at start, and a running Hermes gateway keeps the old key, so connect restarts them when the key changes.
-
-## Doctor
-
-`doctor` checks, for each app it finds:
-
-- box is configured, points at the current URL (not the old `relay.simular.cloud`), and no old `box-control` server is left
-- the endpoint answers an unauthenticated request with `401` and a `WWW-Authenticate` link to its sign-in metadata, and that metadata names the same URL
-- a configured personal key is accepted (the key is sent to the box endpoint only, never printed)
-
-It prints a fix for each problem. `--json` prints a machine-readable report; the exit code is 1 when something needs fixing. OAuth sign-ins are stored by each app, so doctor can't see whether you've signed in.
-
-## Offload
-
-Move the coding task you are working on into your box, let an agent there keep going while you are away, and bring the work back. This is upstream cocoonbox's Offload (design §27), with the same box side.
-
-```bash
-npx @simular-ai/box login                                   # once: sign this CLI in to box in the browser
-npx @simular-ai/box offload install-cli --kind claude       # once per box: the vendor's official installer, in the box
-npx @simular-ai/box offload sign-in --kind claude           # once per box: Claude Code's own login, run in the box
-```
-
-Then, in Claude Code with the `simular-box` plugin, `/simular-box:offload` and later `/simular-box:back`. Elsewhere, write the hand-over to the path `offload handover-path` prints (or paste the request `offload --handover-prompt --kind codex` prints into your agent), then:
-
-```bash
-npx @simular-ai/box offload --kind claude     # preflight, copy the repo, start the box agent from the hand-over
-npx @simular-ai/box offload inbox             # what the box agent posted; offload send "..." answers it
-npx @simular-ai/box back                      # wait for its hand-over, fetch its commits, merge them here
-```
-
-How it works:
-
-- **Sign-in.** `login` signs the CLI in as the relay's first-party `cocoonbox-cli` client: the consent page opens in your browser, the answer comes back to a one-time listener on `127.0.0.1` (PKCE, `state` and issuer checked), and the CLI gets a device token of its own, listed under Keys -> Devices and revoked there or with `logout`. It is kept in `~/.simular-box/credentials.json` (`0600`, directory `0700`; `BOX_HOME` moves it). `BOX_TOKEN=cb_...` (a personal key) wins over it, for CI or a server. `login --token -` reads a personal key from stdin or a hidden prompt. A token is never accepted as an argument or printed.
-- **The box CLI has its own login.** `offload sign-in` runs the vendor's login (`claude auth login`, `codex login --device-auth`, `cursor-agent login`) on a terminal in the box, relayed to yours, with the box's browser kept shut. The first https link it prints on that vendor's own sign-in hosts opens in your browser, once; no other link from the box is opened. Approve, then paste the code into your terminal. Nothing is copied from this computer.
-- **Transport.** Everything goes over `Session.Exec` on the relay's gRPC: `npx @simular-ai/box rsh` is an ssh-like remote shell (`rsync -e`, `GIT_SSH_COMMAND`). An offload is three Execs: `begin` (box checks), rsync of the work tree and `.git` without objects, and `send`, whose stream carries the hand-over, `env.json`, the history as a git bundle and any opted-in secrets.
-- **Back.** It waits for the box agent to go idle (a hand-over request pasted while it is ending a turn can be lost; `back --interrupt` stops its current step instead), then up to 10 minutes in all for its hand-over, fetches the box's commits over `rsh`, and lands them against the snapshot taken at offload: a fast-forward when your repo has not changed, else a clean merge applied uncommitted (never touching a file you changed meanwhile), else the branch `cocoonbox/back-<time>` with your work tree untouched.
-- **Preflight.** It blocks on a non-git directory, a box missing `git`/`rsync`/`tmux`/`mise`, a missing or signed-out box CLI, an offload not yet brought back, and macOS-only commands. It warns (go on with `--yes`) about local services and VPN-only hosts the box cannot reach, git-ignored `.env*` files and other secrets (opt one in with `offload secrets add file:.env`; values travel only in the Exec stream and land on a tmpfs in the box), LFS and submodules, and a copy over 500 MB.
-- **Limits.** macOS and Linux (needs `git` and `rsync`); git repositories only; the box agent commits but never pushes; one session per repo and three per box; the box agent runs with permission prompts bypassed.
-
-## Other endpoints
-
-`BOX_MCP_URL` points everything at another endpoint (for example staging): `BOX_MCP_URL=https://… npx @simular-ai/box connect`. Offload, `login` and `rsh` use its origin, or `BOX_ENDPOINT` when set. When box's endpoint moves, a new CLI version changes the default and `connect` updates each app: it rewrites a `box` entry that points at the old address and, for Claude Code, updates the `simular-box@simular-box` plugin. Apps may then ask you to sign in to box again. box moved from `relay.simular.cloud` to `mcp.box.simular.ai` on 2026-11-04; `doctor` flags an app still on the old address.
-
-## Development
-
-```bash
-cd cli && npm install && npm test
-node bin/simular-box.js connect --dry-run
-```
-
-Test against a temporary home, never your own configs: `HOME=$(mktemp -d) node bin/simular-box.js connect --client cursor --yes`.
-
-CI (`.github/workflows/publish-cli.yml`) runs on every non-draft PR:
-- `check`: lint, unit tests and a smoke test on Linux, macOS and Windows.
-- `clients` (Layer 1): installs each real client at the version pinned in `e2e/clients.json`, then runs `e2e/install-matrix.mjs <client>` in an isolated HOME: connect, the client's own listing, re-run, doctor, remove. No secrets.
-- `live` (Layer 2): `e2e/live.mjs` with the staging key. It doesn't run on fork PRs.
-
-Any `e2e/` script can be run locally the same way, with the client on PATH. They never touch your HOME.
-
-### Releasing
-
-Bump `version` in `package.json`, merge, then push a tag `cli-vX.Y.Z`. A `cli-vX.Y.Z-rc.N` tag publishes under the dist-tag `next`. The workflow publishes with npm trusted publishing (OIDC, no token) and provenance, then creates a GitHub release.
-
-One-time setup, done by an owner of the `@simular-ai` npm org:
-
-1. **Publish the first version by hand.** npm can only attach a trusted publisher to a package that already exists. `npm help trust` says: "Package must exist: The package you're configuring must already exist on the npm registry". From `cli/` on `main`, with 2FA: `npm publish --access public`. This version has no provenance, because provenance comes only from CI.
-2. **Add the trusted publisher.** Either on npmjs.com (package → Settings → Trusted Publisher) or with npm >= 11.10.0: `npm trust github @simular-ai/box --repo simular-ai/box-plugin --file publish-cli.yml --env npm`. The values are organization `simular-ai`, repository `box-plugin`, workflow `publish-cli.yml`, environment `npm`.
-3. **Push the next tag within 2 days.** A new trusted-publisher configuration expires if its first publish doesn't happen within 2 days.
diff --git a/cli/bin/simular-box.js b/cli/bin/simular-box.js
deleted file mode 100755
index f1092da..0000000
--- a/cli/bin/simular-box.js
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-import { main } from '../src/cli.js'
-
-main(process.argv.slice(2)).then(
-  (code) => process.exit(code ?? 0),
-  (err) => {
-    process.stderr.write(`simular-box: ${err.message}\n`)
-    process.exit(1)
-  },
-)
diff --git a/cli/e2e/smoke.mjs b/cli/e2e/smoke.mjs
deleted file mode 100644
index 1ba95ad..0000000
--- a/cli/e2e/smoke.mjs
+++ /dev/null
@@ -1,33 +0,0 @@
-// Smoke test of the packed CLI entry point in an isolated HOME: version, help, a dry run that
-// must write nothing, and a doctor run that must emit valid JSON.
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import path from 'node:path'
-import { createRequire } from 'node:module'
-import { fileURLToPath } from 'node:url'
-import spawn from 'cross-spawn'
-import { isolatedEnv } from './isolated-env.mjs'
-
-const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..')
-const CLI = path.join(root, 'bin', 'simular-box.js')
-const { version } = createRequire(import.meta.url)(path.join(root, 'package.json'))
-const { home, env } = isolatedEnv()
-const run = (...args) => spawn.sync(process.execPath, [CLI, ...args], { env, encoding: 'utf8' })
-
-let r = run('--version')
-assert.equal(r.status, 0)
-assert.equal(r.stdout.trim(), version)
-r = run('--help')
-assert.equal(r.status, 0)
-assert.match(r.stdout, /npx @simular-ai\/box connect/)
-
-const before = fs.readdirSync(home).sort()
-r = run('connect', '--client', 'cursor,codex,opencode,vscode,gemini-cli,hermes', '--yes', '--dry-run')
-assert.equal(r.status, 0, r.stderr)
-assert.match(r.stdout, /would write/)
-assert.deepEqual(fs.readdirSync(home).sort(), before, 'dry run writes nothing')
-
-r = run('doctor', '--client', 'cursor', '--json')
-const report = JSON.parse(r.stdout)
-assert.equal(report.clients[0].configured, false)
-console.log(`smoke OK: simular-box ${version}`)
diff --git a/cli/eslint.config.js b/cli/eslint.config.js
deleted file mode 100644
index 285dd51..0000000
--- a/cli/eslint.config.js
+++ /dev/null
@@ -1,11 +0,0 @@
-import js from '@eslint/js'
-import globals from 'globals'
-
-export default [
-  js.configs.recommended,
-  {
-    languageOptions: { ecmaVersion: 2022, sourceType: 'module', globals: { ...globals.node } },
-    rules: { 'no-unused-vars': ['error', { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }] },
-  },
-  { ignores: ['node_modules/'] },
-]
diff --git a/cli/package-lock.json b/cli/package-lock.json
deleted file mode 100644
index 857ccae..0000000
--- a/cli/package-lock.json
+++ /dev/null
@@ -1,1479 +0,0 @@
-{
-  "name": "@simular-ai/box",
-  "version": "0.2.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "@simular-ai/box",
-      "version": "0.2.0",
-      "license": "MIT",
-      "dependencies": {
-        "@clack/prompts": "0.11.0",
-        "@grpc/grpc-js": "1.14.6",
-        "@grpc/proto-loader": "0.8.1",
-        "cross-spawn": "7.0.6",
-        "jsonc-parser": "3.3.1",
-        "smol-toml": "1.9.1",
-        "yaml": "2.9.1"
-      },
-      "bin": {
-        "simular-box": "bin/simular-box.js"
-      },
-      "devDependencies": {
-        "@eslint/js": "9.39.5",
-        "eslint": "9.39.5",
-        "globals": "17.14.0"
-      },
-      "engines": {
-        "node": ">=18.17"
-      }
-    },
-    "node_modules/@clack/core": {
-      "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/@clack/core/-/core-0.5.0.tgz",
-      "integrity": "sha512-p3y0FIOwaYRUPRcMO7+dlmLh8PSRcrjuTndsiA0WAFbWES0mLZlrjVoBRZ9DzkPFJZG6KGkJmoEAY0ZcVWTkow==",
-      "license": "MIT",
-      "dependencies": {
-        "picocolors": "^1.0.0",
-        "sisteransi": "^1.0.5"
-      }
-    },
-    "node_modules/@clack/prompts": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@clack/prompts/-/prompts-0.11.0.tgz",
-      "integrity": "sha512-pMN5FcrEw9hUkZA4f+zLlzivQSeQf5dRGJjSUbvVYDLvpKCdQx5OaknvKzgbtXOizhP+SJJJjqEbOe55uKKfAw==",
-      "license": "MIT",
-      "dependencies": {
-        "@clack/core": "0.5.0",
-        "picocolors": "^1.0.0",
-        "sisteransi": "^1.0.5"
-      }
-    },
-    "node_modules/@eslint-community/eslint-utils": {
-      "version": "4.10.1",
-      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz",
-      "integrity": "sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "eslint-visitor-keys": "^3.4.3"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      },
-      "peerDependencies": {
-        "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0"
-      }
-    },
-    "node_modules/@eslint-community/eslint-utils/node_modules/eslint-visitor-keys": {
-      "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
-      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      }
-    },
-    "node_modules/@eslint-community/regexpp": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
-      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
-      }
-    },
-    "node_modules/@eslint/config-array": {
-      "version": "0.21.2",
-      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.2.tgz",
-      "integrity": "sha512-nJl2KGTlrf9GjLimgIru+V/mzgSK0ABCDQRvxw5BjURL7WfH5uoWmizbH7QB6MmnMBd8cIC9uceWnezL1VZWWw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@eslint/object-schema": "^2.1.7",
-        "debug": "^4.3.1",
-        "minimatch": "^3.1.5"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      }
-    },
-    "node_modules/@eslint/config-helpers": {
-      "version": "0.4.2",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.4.2.tgz",
-      "integrity": "sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@eslint/core": "^0.17.0"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      }
-    },
-    "node_modules/@eslint/core": {
-      "version": "0.17.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
-      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@types/json-schema": "^7.0.15"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      }
-    },
-    "node_modules/@eslint/eslintrc": {
-      "version": "3.3.7",
-      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.7.tgz",
-      "integrity": "sha512-F42g89Qd5oAWtp0k0nnSrjziAKza7w8SVT4mStc18LZMaRb4J1HQAHLCalEtDCxrTuksx7NU9qsmeLwpOfPqWw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ajv": "^6.14.0",
-        "debug": "^4.3.2",
-        "espree": "^10.0.1",
-        "globals": "^14.0.0",
-        "ignore": "^5.2.0",
-        "import-fresh": "^3.2.1",
-        "js-yaml": "^4.3.2",
-        "minimatch": "^3.1.5",
-        "strip-json-comments": "^3.1.1"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      }
-    },
-    "node_modules/@eslint/eslintrc/node_modules/globals": {
-      "version": "14.0.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
-      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@eslint/js": {
-      "version": "9.39.5",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.5.tgz",
-      "integrity": "sha512-QywQuszQh77pIXCsq998c8hbhSTI/azTty1Z6N53dmAudKHhy573j3yvRLsX2BSp8YpLtoCEG8E9DJe+8zUh4A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://eslint.org/donate"
-      }
-    },
-    "node_modules/@eslint/object-schema": {
-      "version": "2.1.7",
-      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-2.1.7.tgz",
-      "integrity": "sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      }
-    },
-    "node_modules/@eslint/plugin-kit": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.4.1.tgz",
-      "integrity": "sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@eslint/core": "^0.17.0",
-        "levn": "^0.4.1"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      }
-    },
-    "node_modules/@grpc/grpc-js": {
-      "version": "1.14.6",
-      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.6.tgz",
-      "integrity": "sha512-SgC/B3/VZ8lTyOZ4Cwk6f1skWhmkNAaVfiX90qd5u1rRXGKk1//8FTUEN9GvOUq7rfWIqAYkA3CoyumYVpOS6g==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@grpc/proto-loader": "^0.8.0",
-        "@js-sdsl/ordered-map": "^4.4.2"
-      },
-      "engines": {
-        "node": ">=12.10.0"
-      }
-    },
-    "node_modules/@grpc/proto-loader": {
-      "version": "0.8.1",
-      "resolved": "https://registry.npmjs.org/@grpc/proto-loader/-/proto-loader-0.8.1.tgz",
-      "integrity": "sha512-wtF6h+DY6M3YaDBPAmvuuA6jV8Sif9MjtOI5euKFWRgCDl5PeDpPsHR9u2l6St5ceY8AZgoNDww5+HvEsXFsGg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "lodash.camelcase": "^4.3.0",
-        "long": "^5.0.0",
-        "protobufjs": "^7.5.5",
-        "yargs": "^17.7.2"
-      },
-      "bin": {
-        "proto-loader-gen-types": "build/bin/proto-loader-gen-types.js"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/@humanfs/core": {
-      "version": "0.19.2",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
-      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@humanfs/types": "^0.15.0"
-      },
-      "engines": {
-        "node": ">=18.18.0"
-      }
-    },
-    "node_modules/@humanfs/node": {
-      "version": "0.16.8",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
-      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@humanfs/core": "^0.19.2",
-        "@humanfs/types": "^0.15.0",
-        "@humanwhocodes/retry": "^0.4.0"
-      },
-      "engines": {
-        "node": ">=18.18.0"
-      }
-    },
-    "node_modules/@humanfs/types": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
-      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=18.18.0"
-      }
-    },
-    "node_modules/@humanwhocodes/module-importer": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
-      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=12.22"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
-      }
-    },
-    "node_modules/@humanwhocodes/retry": {
-      "version": "0.4.3",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
-      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=18.18"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
-      }
-    },
-    "node_modules/@js-sdsl/ordered-map": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/@js-sdsl/ordered-map/-/ordered-map-4.4.2.tgz",
-      "integrity": "sha512-iUKgm52T8HOE/makSxjqoWhe95ZJA1/G1sYsGev2JDKUSS14KAgg1LHb+Ba+IPow0xflbnSkOsZcO08C7w1gYw==",
-      "license": "MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/js-sdsl"
-      }
-    },
-    "node_modules/@protobufjs/aspromise": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
-      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/base64": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
-      "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/codegen": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz",
-      "integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/eventemitter": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.1.tgz",
-      "integrity": "sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/fetch": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.1.tgz",
-      "integrity": "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "@protobufjs/aspromise": "^1.1.1"
-      }
-    },
-    "node_modules/@protobufjs/float": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
-      "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/path": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
-      "integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/pool": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
-      "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/utf8": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.2.tgz",
-      "integrity": "sha512-b1UQwcEZ4yCnMCD8DAL1VlbvBJE9/IX4FTIp7BG1xYpf29SLazLSrqUkj4w7Y5y7cCVP6E5tcqqcI0xemPkHug==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@types/estree": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.10.tgz",
-      "integrity": "sha512-lTyOMnOcmRBzdCv6/4zUZCrEhV0xrqQiUZBZtVcbmLHBXKLnN8q89v/wKRF/Q0HbwVsqbIG3o5HDoFl9sduM+g==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@types/json-schema": {
-      "version": "7.0.15",
-      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
-      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@types/node": {
-      "version": "26.6.6",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.6.tgz",
-      "integrity": "sha512-MzQj+8Kx3XI40OmUAE6Qoh58ZMNstNNMwn2nfd3qWsfe7nDNSqJNzes4njhz6AHwrSHOffSLwXU6yb474Q4aog==",
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~8.9.0"
-      }
-    },
-    "node_modules/acorn": {
-      "version": "8.19.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.19.0.tgz",
-      "integrity": "sha512-oJlA3XiRm7Cyk6qFD2Jn8ak9B7jSy0qy00ADO3+8dpT0LSjFihQYv4C02LFCSYJV3Q37xYwwRy5m+IpIiUzqWw==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "acorn": "bin/acorn"
-      },
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/acorn-jsx": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
-      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
-      "dev": true,
-      "license": "MIT",
-      "peerDependencies": {
-        "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
-      }
-    },
-    "node_modules/ajv": {
-      "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
-      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "fast-deep-equal": "^3.1.1",
-        "fast-json-stable-stringify": "^2.0.0",
-        "json-schema-traverse": "^0.4.1",
-        "uri-js": "^4.2.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "license": "MIT",
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/argparse": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
-      "dev": true,
-      "license": "Python-2.0"
-    },
-    "node_modules/balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/brace-expansion": {
-      "version": "1.1.21",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
-      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
-    "node_modules/callsites": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
-      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/chalk": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
-    "node_modules/cliui": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
-      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
-      "license": "ISC",
-      "dependencies": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.1",
-        "wrap-ansi": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/color-convert": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "license": "MIT",
-      "dependencies": {
-        "color-name": "~1.1.4"
-      },
-      "engines": {
-        "node": ">=7.0.0"
-      }
-    },
-    "node_modules/color-name": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-      "license": "MIT"
-    },
-    "node_modules/concat-map": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/cross-spawn": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "license": "MIT",
-      "dependencies": {
-        "path-key": "^3.1.0",
-        "shebang-command": "^2.0.0",
-        "which": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/debug": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.3"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/deep-is": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
-      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "license": "MIT"
-    },
-    "node_modules/escalade": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
-      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/escape-string-regexp": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
-      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/eslint": {
-      "version": "9.39.5",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.5.tgz",
-      "integrity": "sha512-DgZS62aPLXKlnxILS/AYCoRvHaZeXceIzlXPkkGGzJWSow1aEk0lbTlxUSlyjC8jcaKxAdOnTDz+o1JFSBsyjw==",
-      "deprecated": "This version is no longer supported. Please see https://eslint.org/version-support for other options.",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@eslint-community/eslint-utils": "^4.8.0",
-        "@eslint-community/regexpp": "^4.12.1",
-        "@eslint/config-array": "^0.21.2",
-        "@eslint/config-helpers": "^0.4.2",
-        "@eslint/core": "^0.17.0",
-        "@eslint/eslintrc": "^3.3.6",
-        "@eslint/js": "9.39.5",
-        "@eslint/plugin-kit": "^0.4.1",
-        "@humanfs/node": "^0.16.6",
-        "@humanwhocodes/module-importer": "^1.0.1",
-        "@humanwhocodes/retry": "^0.4.2",
-        "@types/estree": "^1.0.6",
-        "ajv": "^6.14.0",
-        "chalk": "^4.0.0",
-        "cross-spawn": "^7.0.6",
-        "debug": "^4.3.2",
-        "escape-string-regexp": "^4.0.0",
-        "eslint-scope": "^8.4.0",
-        "eslint-visitor-keys": "^4.2.1",
-        "espree": "^10.4.0",
-        "esquery": "^1.5.0",
-        "esutils": "^2.0.2",
-        "fast-deep-equal": "^3.1.3",
-        "file-entry-cache": "^8.0.0",
-        "find-up": "^5.0.0",
-        "glob-parent": "^6.0.2",
-        "ignore": "^5.2.0",
-        "imurmurhash": "^0.1.4",
-        "is-glob": "^4.0.0",
-        "json-stable-stringify-without-jsonify": "^1.0.1",
-        "lodash.merge": "^4.6.2",
-        "minimatch": "^3.1.5",
-        "natural-compare": "^1.4.0",
-        "optionator": "^0.9.3"
-      },
-      "bin": {
-        "eslint": "bin/eslint.js"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://eslint.org/donate"
-      },
-      "peerDependencies": {
-        "jiti": "*"
-      },
-      "peerDependenciesMeta": {
-        "jiti": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/eslint-scope": {
-      "version": "8.4.0",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-8.4.0.tgz",
-      "integrity": "sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "esrecurse": "^4.3.0",
-        "estraverse": "^5.2.0"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      }
-    },
-    "node_modules/eslint-visitor-keys": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.1.tgz",
-      "integrity": "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      }
-    },
-    "node_modules/espree": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz",
-      "integrity": "sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "acorn": "^8.15.0",
-        "acorn-jsx": "^5.3.2",
-        "eslint-visitor-keys": "^4.2.1"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      }
-    },
-    "node_modules/esquery": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.7.0.tgz",
-      "integrity": "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "estraverse": "^5.1.0"
-      },
-      "engines": {
-        "node": ">=0.10"
-      }
-    },
-    "node_modules/esrecurse": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
-      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "estraverse": "^5.2.0"
-      },
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
-    "node_modules/estraverse": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
-      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
-    "node_modules/esutils": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
-      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/fast-deep-equal": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/fast-json-stable-stringify": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/fast-levenshtein": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
-      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/file-entry-cache": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
-      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "flat-cache": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=16.0.0"
-      }
-    },
-    "node_modules/find-up": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
-      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "locate-path": "^6.0.0",
-        "path-exists": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/flat-cache": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
-      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "flatted": "^3.2.9",
-        "keyv": "^4.5.4"
-      },
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/flatted": {
-      "version": "3.4.4",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.4.tgz",
-      "integrity": "sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/get-caller-file": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
-      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
-      "license": "ISC",
-      "engines": {
-        "node": "6.* || 8.* || >= 10.*"
-      }
-    },
-    "node_modules/glob-parent": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
-      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "is-glob": "^4.0.3"
-      },
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
-    "node_modules/globals": {
-      "version": "17.14.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.14.0.tgz",
-      "integrity": "sha512-UtdkTVyAJePQv0J2M9Xe4L0ruNSDV314XiIJsADI2Zf40bcdAonE/D/OhAU8AT99oij9mhLByb+NvA3QWZYgCg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/has-flag": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/ignore": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
-      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4"
-      }
-    },
-    "node_modules/import-fresh": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.1.tgz",
-      "integrity": "sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "parent-module": "^1.0.0",
-        "resolve-from": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/imurmurhash": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
-      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8.19"
-      }
-    },
-    "node_modules/is-extglob": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
-      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/is-glob": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
-      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "is-extglob": "^2.1.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/isexe": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "license": "ISC"
-    },
-    "node_modules/js-yaml": {
-      "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
-      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/puzrin"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/nodeca"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "argparse": "^2.0.1"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
-    "node_modules/json-buffer": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
-      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/json-schema-traverse": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/json-stable-stringify-without-jsonify": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
-      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/jsonc-parser": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.3.1.tgz",
-      "integrity": "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==",
-      "license": "MIT"
-    },
-    "node_modules/keyv": {
-      "version": "4.5.4",
-      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
-      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "json-buffer": "3.0.1"
-      }
-    },
-    "node_modules/levn": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
-      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "prelude-ls": "^1.2.1",
-        "type-check": "~0.4.0"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/locate-path": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
-      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "p-locate": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/lodash.camelcase": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/lodash.camelcase/-/lodash.camelcase-4.3.0.tgz",
-      "integrity": "sha512-TwuEnCnxbc3rAvhf/LbG7tJUDzhqXyFnv3dtzLOPgCG/hODL7WFnsbwktkD7yUV0RrreP/l1PALq/YSg6VvjlA==",
-      "license": "MIT"
-    },
-    "node_modules/lodash.merge": {
-      "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
-      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/long": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
-      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
-      "license": "Apache-2.0"
-    },
-    "node_modules/minimatch": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/natural-compare": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
-      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/optionator": {
-      "version": "0.9.4",
-      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
-      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "deep-is": "^0.1.3",
-        "fast-levenshtein": "^2.0.6",
-        "levn": "^0.4.1",
-        "prelude-ls": "^1.2.1",
-        "type-check": "^0.4.0",
-        "word-wrap": "^1.2.5"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/p-limit": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
-      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "yocto-queue": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/p-locate": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
-      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "p-limit": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/parent-module": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
-      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "callsites": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/path-exists": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/path-key": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/picocolors": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
-      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
-      "license": "ISC"
-    },
-    "node_modules/prelude-ls": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
-      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/protobufjs": {
-      "version": "7.6.6",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.6.tgz",
-      "integrity": "sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg==",
-      "hasInstallScript": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "@protobufjs/aspromise": "^1.1.2",
-        "@protobufjs/base64": "^1.1.2",
-        "@protobufjs/codegen": "^2.0.5",
-        "@protobufjs/eventemitter": "^1.1.1",
-        "@protobufjs/fetch": "^1.1.1",
-        "@protobufjs/float": "^1.0.2",
-        "@protobufjs/path": "^1.1.2",
-        "@protobufjs/pool": "^1.1.0",
-        "@protobufjs/utf8": "^1.1.1",
-        "@types/node": ">=13.7.0",
-        "long": "^5.3.2"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      }
-    },
-    "node_modules/punycode": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/require-directory": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
-      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/resolve-from": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
-      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/shebang-command": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "license": "MIT",
-      "dependencies": {
-        "shebang-regex": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/shebang-regex": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/sisteransi": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
-      "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==",
-      "license": "MIT"
-    },
-    "node_modules/smol-toml": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.9.1.tgz",
-      "integrity": "sha512-j7WyPdf0CJoutMzMoPLF/bVXHtKZIT9Rb4eGeEbWw8X2t5oirjPgpL+OpaENZrILYaXqYwnVH+qgUwVbl+pUJQ==",
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/cyyynthia"
-      }
-    },
-    "node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-json-comments": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
-      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/supports-color": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "has-flag": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/type-check": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
-      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "prelude-ls": "^1.2.1"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/undici-types": {
-      "version": "8.9.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
-      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
-      "license": "MIT"
-    },
-    "node_modules/uri-js": {
-      "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
-      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "punycode": "^2.1.0"
-      }
-    },
-    "node_modules/which": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "license": "ISC",
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "node-which": "bin/node-which"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/word-wrap": {
-      "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
-      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/wrap-ansi": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
-    "node_modules/y18n": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
-      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/yaml": {
-      "version": "2.9.1",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
-      "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
-      "license": "ISC",
-      "bin": {
-        "yaml": "bin.mjs"
-      },
-      "engines": {
-        "node": ">= 14.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/eemeli"
-      }
-    },
-    "node_modules/yargs": {
-      "version": "17.7.3",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz",
-      "integrity": "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==",
-      "license": "MIT",
-      "dependencies": {
-        "cliui": "^8.0.1",
-        "escalade": "^3.1.1",
-        "get-caller-file": "^2.0.5",
-        "require-directory": "^2.1.1",
-        "string-width": "^4.2.3",
-        "y18n": "^5.0.5",
-        "yargs-parser": "^21.1.1"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/yargs-parser": {
-      "version": "21.1.1",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
-      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/yocto-queue": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
-      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    }
-  }
-}
diff --git a/cli/package.json b/cli/package.json
deleted file mode 100644
index c4d77c5..0000000
--- a/cli/package.json
+++ /dev/null
@@ -1,63 +0,0 @@
-{
-  "name": "@simular-ai/box",
-  "version": "0.2.0",
-  "description": "Connect box by Simular (a cloud computer your AI agent drives over MCP) to Claude Code, Codex, Cursor, OpenCode, Gemini CLI, Hermes, OpenClaw and more in one command, and move a coding task into your box and back (offload / back).",
-  "license": "MIT",
-  "type": "module",
-  "bin": {
-    "simular-box": "bin/simular-box.js"
-  },
-  "files": [
-    "bin/",
-    "src/",
-    "proto/",
-    "README.md",
-    "LICENSE"
-  ],
-  "engines": {
-    "node": ">=18.17"
-  },
-  "scripts": {
-    "lint": "eslint . --max-warnings 0",
-    "test": "node --test",
-    "smoke": "node e2e/smoke.mjs",
-    "prepack": "node -e \"require('fs').copyFileSync('../LICENSE', 'LICENSE')\""
-  },
-  "dependencies": {
-    "@clack/prompts": "0.11.0",
-    "@grpc/grpc-js": "1.14.6",
-    "@grpc/proto-loader": "0.8.1",
-    "cross-spawn": "7.0.6",
-    "jsonc-parser": "3.3.1",
-    "smol-toml": "1.9.1",
-    "yaml": "2.9.1"
-  },
-  "homepage": "https://box.simular.ai/install",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/simular-ai/box-plugin.git",
-    "directory": "cli"
-  },
-  "bugs": "https://github.com/simular-ai/box-plugin/issues",
-  "keywords": [
-    "mcp",
-    "box",
-    "simular",
-    "computer-use",
-    "claude-code",
-    "codex",
-    "cursor",
-    "opencode",
-    "gemini-cli",
-    "hermes",
-    "openclaw"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "devDependencies": {
-    "@eslint/js": "9.39.5",
-    "eslint": "9.39.5",
-    "globals": "17.14.0"
-  }
-}
diff --git a/cli/proto/README.md b/cli/proto/README.md
deleted file mode 100644
index 3534011..0000000
--- a/cli/proto/README.md
+++ /dev/null
@@ -1,6 +0,0 @@
-# Vendored protos
-
-Copied unchanged from [simular-ai/box](https://github.com/simular-ai/box) `proto/` at `f452665cb144286ec100c3ad28cf3fa796851767`:
-`cocoonbox/agent/v1/session.proto` (Session.Exec), `cocoonbox/agent/v1/agents.proto` (imported by it) and
-`cocoonbox/control/v1/boxes.proto` (Boxes.List / Ensure). `@grpc/proto-loader` reads them at run time; nothing is
-generated. Refresh them by copying the same files again when the relay's wire changes.
diff --git a/cli/proto/cocoonbox/agent/v1/agents.proto b/cli/proto/cocoonbox/agent/v1/agents.proto
deleted file mode 100644
index 607c53d..0000000
--- a/cli/proto/cocoonbox/agent/v1/agents.proto
+++ /dev/null
@@ -1,212 +0,0 @@
-syntax = "proto3";
-
-package cocoonbox.agent.v1;
-
-option go_package = "github.com/simular-ai/box/api/gen/cocoonbox/agent/v1;agentv1";
-
-// Agents and Session are served by cocoonbox-agent inside the box. Clients
-// reach them through the edge with `authorization: Bearer <user token>` and
-// `x-cocoonbox-box: <box id>`; the edge forwards the call unchanged.
-service Agents {
-  rpc Create(CreateAgentRequest) returns (Agent);
-  rpc List(ListAgentsRequest) returns (ListAgentsResponse);
-  // Send queues a user turn. Duplicate client_nonce values return the first result.
-  rpc Send(SendRequest) returns (SendResponse);
-  rpc Transcript(TranscriptRequest) returns (TranscriptPage);
-  rpc Respond(RespondRequest) returns (RespondResponse);
-  rpc Cancel(CancelRequest) returns (CancelResponse);
-  // Rename sets the agent's name; an automatic title never replaces it.
-  rpc Rename(RenameAgentRequest) returns (Agent);
-  // Delete cancels the agent's running turn and removes the agent with its
-  // transcript. An mcp:* agent whose MCP session is open is refused with
-  // FAILED_PRECONDITION; an unknown agent gets NOT_FOUND.
-  rpc Delete(DeleteAgentRequest) returns (DeleteAgentResponse);
-  // End closes the MCP session that drives agent_id, or every MCP session of
-  // share_id; the agents and their transcripts stay. An agent_id without an
-  // open session gets NOT_FOUND.
-  rpc End(EndRequest) returns (EndResponse);
-}
-
-enum AgentStatus {
-  AGENT_STATUS_UNSPECIFIED = 0;
-  AGENT_STATUS_IDLE = 1;
-  AGENT_STATUS_RUNNING = 2;
-  AGENT_STATUS_WAITING_FOR_USER = 3;
-  AGENT_STATUS_FAILED = 4;
-}
-
-enum Role {
-  ROLE_UNSPECIFIED = 0;
-  ROLE_USER = 1;
-  ROLE_ASSISTANT = 2;
-  ROLE_TOOL = 3;
-  ROLE_SYSTEM = 4;
-}
-
-message Agent {
-  string id = 1;
-  string name = 2;
-  AgentStatus status = 3;
-  string main_model = 4;
-  int64 created_at_ms = 5;
-  int64 updated_at_ms = 6;
-}
-
-message CreateAgentRequest {
-  // Empty names the agent after the first line of its first message, cut to
-  // 24 characters; until then its name is "agent".
-  string name = 1;
-  string client_nonce = 2;
-  // Empty selects the box default.
-  string main_model = 3;
-}
-
-message ListAgentsRequest {}
-
-message ListAgentsResponse {
-  repeated Agent agents = 1;
-}
-
-message Attachment {
-  string name = 1;
-  string mime_type = 2;
-  bytes data = 3;
-}
-
-message SendRequest {
-  string agent_id = 1;
-  string text = 2;
-  repeated Attachment attachments = 3;
-  string client_nonce = 4;
-}
-
-message SendResponse {
-  string turn_id = 1;
-}
-
-message TranscriptRequest {
-  string agent_id = 1;
-  // Entries with seq > after_seq, oldest first.
-  uint64 after_seq = 2;
-  uint32 limit = 3;
-}
-
-message TranscriptPage {
-  repeated TranscriptEntry entries = 1;
-  bool has_more = 2;
-}
-
-message TranscriptEntry {
-  uint64 seq = 1;
-  string agent_id = 2;
-  string turn_id = 3;
-  Role role = 4;
-  int64 at_ms = 5;
-  oneof body {
-    TextBlock text = 10;
-    ReasoningBlock reasoning = 11;
-    ToolCall tool_call = 12;
-    ToolResult tool_result = 13;
-    ApprovalRequest approval = 14;
-    TurnEnd turn_end = 15;
-    // The turn's usage so far, recorded after each completed model call; TurnEnd.usage is the final sum.
-    Usage usage = 16;
-  }
-}
-
-message TextBlock {
-  string text = 1;
-  // Set when the text belongs to a subagent, e.g. "computer".
-  string subagent = 2;
-  // Index of the streamed block within its turn; matches TextDelta.block.
-  uint32 block = 3;
-}
-
-message ReasoningBlock {
-  string text = 1;
-  // Index of the streamed block within its turn; matches ReasoningDelta.block.
-  uint32 block = 2;
-  string subagent = 3;
-}
-
-message ToolCall {
-  string call_id = 1;
-  string name = 2;
-  string arguments_json = 3;
-  // Set when the call belongs to a subagent, e.g. "computer".
-  string subagent = 4;
-}
-
-message ToolResult {
-  string call_id = 1;
-  bool is_error = 2;
-  string text = 3;
-  // PNG when the tool produced a screenshot.
-  bytes image = 4;
-}
-
-message ApprovalRequest {
-  string approval_id = 1;
-  string summary = 2;
-  // "take_over": the agent hands the screen to the user (login, captcha, payment).
-  // "connector": a Connect tool call that needs the user's approval; approval_id is the broker's apr_… id,
-  // which the app answers with Connectors.Approve and then Agents.Respond.
-  string kind = 3;
-}
-
-message TurnEnd {
-  bool ok = 1;
-  string error = 2;
-  Usage usage = 3;
-}
-
-message Usage {
-  uint64 input_tokens = 1;
-  uint64 output_tokens = 2;
-  uint64 cached_input_tokens = 3;
-  repeated ModelUsage models = 4;
-}
-
-message ModelUsage {
-  string model = 1;
-  uint64 calls = 2;
-  uint64 input_tokens = 3;
-  uint64 output_tokens = 4;
-  uint64 cached_input_tokens = 5;
-}
-
-message RespondRequest {
-  string agent_id = 1;
-  string approval_id = 2;
-  bool approve = 3;
-  string text = 4;
-}
-
-message RespondResponse {}
-
-message CancelRequest {
-  string agent_id = 1;
-}
-
-message CancelResponse {}
-
-message RenameAgentRequest {
-  string agent_id = 1;
-  // Trimmed; empty is INVALID_ARGUMENT.
-  string name = 2;
-}
-
-message DeleteAgentRequest {
-  string agent_id = 1;
-}
-
-message DeleteAgentResponse {}
-
-message EndRequest {
-  oneof target {
-    string agent_id = 1;
-    string share_id = 2;
-  }
-}
-
-message EndResponse {}
diff --git a/cli/proto/cocoonbox/agent/v1/session.proto b/cli/proto/cocoonbox/agent/v1/session.proto
deleted file mode 100644
index 88266f4..0000000
--- a/cli/proto/cocoonbox/agent/v1/session.proto
+++ /dev/null
@@ -1,232 +0,0 @@
-syntax = "proto3";
-
-package cocoonbox.agent.v1;
-
-import "cocoonbox/agent/v1/agents.proto";
-
-option go_package = "github.com/simular-ai/box/api/gen/cocoonbox/agent/v1;agentv1";
-
-service Session {
-  rpc Hello(HelloRequest) returns (HelloResponse);
-  // Events streams live changes; reconnect with the last seen offset.
-  rpc Events(EventsRequest) returns (stream Event);
-  // Screen carries raw RFB bytes between the client and the box's VNC server.
-  // The first client frame must be `open`; the stream ends when either side closes.
-  rpc Screen(stream ScreenClientFrame) returns (stream ScreenServerFrame);
-  // ActiveOrigin returns the origin of the active tab of the box's Chrome.
-  rpc ActiveOrigin(ActiveOriginRequest) returns (ActiveOriginResponse);
-  // FillCredential fills the sign-in form of the active tab when its origin
-  // equals `origin` (scheme, host and port), else FAILED_PRECONDITION. App
-  // only: it is no MCP tool, and its values are never logged or recorded.
-  rpc FillCredential(FillCredentialRequest) returns (FillCredentialResponse);
-  // Exec runs a command as the desktop user and carries its stdin, stdout and
-  // stderr. The first client frame must be `start`. `eof`, or the client
-  // half-closing the stream, closes the command's stdin. The last server frame
-  // is `exit_code`. Cancelling the stream kills the command's process group.
-  // Owner only.
-  rpc Exec(stream ExecClientFrame) returns (stream ExecServerFrame);
-}
-
-message ExecClientFrame {
-  oneof body {
-    ExecStart start = 1;
-    bytes stdin = 2;
-    ExecEof eof = 3;
-    // Sent to the command's process group.
-    ExecSignal signal = 4;
-    // The terminal size of a command started with `tty`.
-    ExecWindow resize = 5;
-  }
-}
-
-message ExecStart {
-  // Run by a login shell, `bash -lc`, in /workspace, as rsh and ssh run a
-  // remote command.
-  string command = 1;
-  // Present: the command runs on a pseudo-terminal, and stdout carries its
-  // stderr too.
-  ExecTty tty = 2;
-}
-
-message ExecTty {
-  // TERM for the command.
-  string term = 1;
-  ExecWindow window = 2;
-  // The terminfo source of `term` (`infocmp -x` output), at most 256 KiB. A box
-  // without an entry for `term` compiles it into the user's ~/.terminfo;
-  // without one, or when it does not compile, the command gets xterm-256color.
-  string terminfo = 3;
-}
-
-message ExecWindow {
-  uint32 rows = 1;
-  uint32 cols = 2;
-}
-
-message ExecEof {}
-
-enum ExecSignal {
-  EXEC_SIGNAL_UNSPECIFIED = 0;
-  EXEC_SIGNAL_INT = 1;
-  EXEC_SIGNAL_TERM = 2;
-}
-
-message ExecServerFrame {
-  oneof body {
-    bytes stdout = 1;
-    bytes stderr = 2;
-    // The command's exit status, or 128 plus the signal that ended it.
-    int32 exit_code = 3;
-  }
-}
-
-message HelloRequest {
-  string client_version = 1;
-}
-
-message HelloResponse {
-  string agent_version = 1;
-  // The screen size the image boots at: 1280x800 on a desktop, 720x1280 on
-  // Android. A later change in the box, such as `wm size`, is not reflected.
-  uint32 screen_width = 2;
-  uint32 screen_height = 3;
-  repeated string models = 4;
-  string default_main_model = 5;
-  Automation automation = 6;
-}
-
-// Automation is what the box's screen is, from the guide its image holds.
-enum Automation {
-  AUTOMATION_UNSPECIFIED = 0;
-  // A desktop driven through cua-driver only.
-  AUTOMATION_PLAIN = 1;
-  // A desktop that runs GUI plans and scripts on the desk runtime.
-  AUTOMATION_DESK = 2;
-  // An Android phone in the box, driven through adb.
-  AUTOMATION_ANDROID = 3;
-}
-
-message ActiveOriginRequest {}
-
-message ActiveOriginResponse {
-  // As `location.origin`, e.g. "https://example.com" or "http://127.0.0.1:8080".
-  string origin = 1;
-}
-
-message FillCredentialRequest {
-  string origin = 1;
-  string username = 2;
-  oneof secret {
-    string password = 3;
-    // A one-time code, filled into the page's code field.
-    string code = 4;
-  }
-  bool submit = 5;
-}
-
-message FillCredentialResponse {
-  // The kinds of field filled: "username", "password", "code".
-  repeated string filled = 1;
-  bool submitted = 2;
-}
-
-message EventsRequest {
-  // Last Event.offset seen; 0 starts from now.
-  uint64 from_offset = 1;
-}
-
-message Event {
-  uint64 offset = 1;
-  oneof body {
-    TranscriptEntry transcript = 10;
-    Agent agent = 11;
-    ComputerAction computer_action = 12;
-    TextDelta text_delta = 13;
-    ReasoningDelta reasoning_delta = 14;
-    AgentDeleted agent_deleted = 15;
-    OffloadUpdate offload = 16;
-  }
-}
-
-// OffloadUpdate says a box CLI session of an offloaded repo posted to its
-// outbox or changed status. It carries no message text; `cocoonbox-agent
-// offload read` returns that.
-message OffloadUpdate {
-  // The repo key.
-  string repo = 1;
-  // The directory name under /workspace.
-  string name = 2;
-  // The box CLI: "claude", "codex" or "cursor".
-  string cli = 3;
-  string offload_id = 4;
-  // Unspecified for a status change.
-  OffloadEntry entry = 5;
-  // The outbox seq of `entry`; 0 for a status change.
-  uint64 seq = 6;
-  OffloadStatus status = 7;
-}
-
-enum OffloadEntry {
-  OFFLOAD_ENTRY_UNSPECIFIED = 0;
-  OFFLOAD_ENTRY_PROGRESS = 1;
-  OFFLOAD_ENTRY_QUESTION = 2;
-  OFFLOAD_ENTRY_BACK = 3;
-  OFFLOAD_ENTRY_BLOCKED = 4;
-}
-
-enum OffloadStatus {
-  OFFLOAD_STATUS_UNSPECIFIED = 0;
-  OFFLOAD_STATUS_WORKING = 1;
-  OFFLOAD_STATUS_IDLE = 2;
-  OFFLOAD_STATUS_WAITING_FOR_USER = 3;
-  OFFLOAD_STATUS_BLOCKED = 4;
-  OFFLOAD_STATUS_STOPPED = 5;
-}
-
-// AgentDeleted says the agent and its transcript are gone.
-message AgentDeleted {
-  string agent_id = 1;
-}
-
-// TextDelta is a live fragment of an assistant text block. Deltas are not
-// replayed on reconnect; the complete block follows as a TranscriptEntry whose
-// TextBlock carries the same (turn_id, block).
-message TextDelta {
-  string agent_id = 1;
-  string turn_id = 2;
-  uint32 block = 3;
-  string text = 4;
-  string subagent = 5;
-}
-
-// ReasoningDelta is TextDelta for reasoning blocks.
-message ReasoningDelta {
-  string agent_id = 1;
-  string turn_id = 2;
-  uint32 block = 3;
-  string text = 4;
-  string subagent = 5;
-}
-
-// ComputerAction mirrors an input the agent is about to inject, so the client
-// can highlight it on the live view.
-message ComputerAction {
-  string agent_id = 1;
-  string action = 2;
-  int32 x = 3;
-  int32 y = 4;
-  string text = 5;
-}
-
-message ScreenClientFrame {
-  oneof body {
-    ScreenOpen open = 1;
-    bytes data = 2;
-  }
-}
-
-message ScreenOpen {}
-
-message ScreenServerFrame {
-  bytes data = 1;
-}
diff --git a/cli/proto/cocoonbox/control/v1/boxes.proto b/cli/proto/cocoonbox/control/v1/boxes.proto
deleted file mode 100644
index 213a198..0000000
--- a/cli/proto/cocoonbox/control/v1/boxes.proto
+++ /dev/null
@@ -1,284 +0,0 @@
-syntax = "proto3";
-
-package cocoonbox.control.v1;
-
-option go_package = "github.com/simular-ai/box/api/gen/cocoonbox/control/v1;controlv1";
-
-// Boxes is served by cocoonbox-api (the edge). Callers authenticate with
-// `authorization: Bearer <user token>`.
-service Boxes {
-  // Ensure creates the caller's box, or wakes it, and returns immediately.
-  // Idempotent per (box, flavor). Progress arrives on WatchOperation.
-  rpc Ensure(EnsureRequest) returns (EnsureResponse);
-  // Create adds a box to the caller's boxes and starts it, within the user's
-  // box quota and the api's running limit.
-  rpc Create(CreateBoxRequest) returns (EnsureResponse);
-  rpc Rename(RenameBoxRequest) returns (Box);
-  // Delete removes the box's machine, the box and its saved state; with the
-  // owner's last box the owner's whole state goes.
-  rpc Delete(BoxRef) returns (Operation);
-  rpc Get(GetBoxRequest) returns (Box);
-  rpc List(ListBoxesRequest) returns (ListBoxesResponse);
-  // Watch sends the caller's boxes as List does, at once and again after any
-  // of them changes, by any client or by the api. Watching never wakes a box.
-  rpc Watch(WatchBoxesRequest) returns (stream ListBoxesResponse);
-  rpc Hibernate(BoxRef) returns (Operation);
-  rpc WatchOperation(WatchOperationRequest) returns (stream OperationEvent);
-  // SaveState writes a quiesced snapshot of the box's user state (home,
-  // /workspace, agent.db) to object storage. The browser closes for the copy.
-  rpc SaveState(BoxRef) returns (Operation);
-  // Rebase moves the box to another image and carries its user state over:
-  // quiesced save, new machine from the image, restore, switch, delete the old
-  // machine. The box id stays the same; running programs restart.
-  rpc Rebase(RebaseRequest) returns (Operation);
-  // ListSnapshots lists the box's kept snapshots, newest first.
-  rpc ListSnapshots(BoxRef) returns (ListSnapshotsResponse);
-  // BrowseSnapshot lists one directory of a kept snapshot; the box may be
-  // hibernated.
-  rpc BrowseSnapshot(BrowseSnapshotRequest) returns (BrowseSnapshotResponse);
-  // RestorePaths copies files and folders of a kept snapshot into
-  // ~/Restored/<save time>/ in the running box (PHASE_RESTORING_FILES).
-  // Nothing outside that folder changes and nothing restarts.
-  rpc RestorePaths(RestorePathsRequest) returns (Operation);
-  // SetWakeSchedule replaces the box's wake schedule. A minute before each
-  // time of cron in tz, the api wakes the box when it is hibernated. After
-  // awake_for it hibernates the box again, unless a client reached the box
-  // since that wake or an operation runs. The api keeps no routine: the box
-  // runs its own timers.
-  rpc SetWakeSchedule(SetWakeScheduleRequest) returns (WakeSchedule);
-  // ListWakeSchedules lists the wake schedules of the caller's boxes.
-  rpc ListWakeSchedules(ListWakeSchedulesRequest) returns (ListWakeSchedulesResponse);
-  // ClearWakeSchedule removes the box's wake schedule; a box the alarm woke
-  // stays up.
-  rpc ClearWakeSchedule(BoxRef) returns (ClearWakeScheduleResponse);
-  rpc Usage(UsageRequest) returns (UsageResponse);
-}
-
-enum BoxState {
-  BOX_STATE_UNSPECIFIED = 0;
-  BOX_STATE_STARTING = 1;
-  BOX_STATE_RUNNING = 2;
-  BOX_STATE_HIBERNATING = 3;
-  BOX_STATE_HIBERNATED = 4;
-  BOX_STATE_FAILED = 5;
-}
-
-enum Phase {
-  PHASE_UNSPECIFIED = 0;
-  PHASE_CREATING = 1;
-  PHASE_WAKING = 2;
-  PHASE_SNAPSHOTTING = 3;
-  PHASE_DONE = 4;
-  PHASE_FAILED = 5;
-  // Uploading the user state to object storage.
-  PHASE_SAVING = 6;
-  // Writing the user state into a new machine.
-  PHASE_RESTORING = 7;
-  // Removing the box's machine.
-  PHASE_DELETING = 8;
-  // Copying files of a snapshot into the running box.
-  PHASE_RESTORING_FILES = 9;
-}
-
-enum EntryKind {
-  ENTRY_KIND_UNSPECIFIED = 0;
-  ENTRY_KIND_FILE = 1;
-  ENTRY_KIND_DIR = 2;
-  ENTRY_KIND_SYMLINK = 3;
-}
-
-message BoxRef {
-  string box_id = 1;
-}
-
-message Flavor {
-  uint32 vcpus = 1;
-  uint32 memory_mib = 2;
-  uint32 disk_gib = 3;
-}
-
-message Box {
-  string id = 1;
-  BoxState state = 2;
-  string image = 3;
-  Flavor flavor = 4;
-  string failure_reason = 5;
-  int64 created_at_ms = 6;
-  // Time of the latest user-state snapshot in object storage; 0 before the first.
-  int64 last_saved_at_ms = 7;
-  // Image a new box gets today, and the default Rebase target; differs from image when an upgrade is available.
-  string latest_image = 8;
-  // Unique among the user's boxes.
-  string name = 9;
-}
-
-message Operation {
-  string id = 1;
-  string box_id = 2;
-}
-
-message EnsureRequest {
-  Flavor flavor = 1;
-  // Empty selects the user's first box, and creates one when the user has none.
-  string box_id = 2;
-}
-
-message CreateBoxRequest {
-  string name = 1;
-  // Empty selects the current default image.
-  string image = 2;
-  Flavor flavor = 3;
-}
-
-message RenameBoxRequest {
-  string box_id = 1;
-  string name = 2;
-}
-
-message EnsureResponse {
-  Box box = 1;
-  // Empty when the box is already running.
-  Operation operation = 2;
-}
-
-message RebaseRequest {
-  string box_id = 1;
-  // Target image; empty selects the current default image.
-  string image = 2;
-}
-
-message GetBoxRequest {
-  string box_id = 1;
-}
-
-message ListBoxesRequest {}
-
-message ListBoxesResponse {
-  repeated Box boxes = 1;
-  // Images CreateBoxRequest.image may name, the default image first; the
-  // family of one is the name before ':'.
-  repeated string offered_images = 2;
-}
-
-message WatchBoxesRequest {}
-
-message WatchOperationRequest {
-  string operation_id = 1;
-  // Resume after this offset; empty replays from the start.
-  string from_offset_key = 2;
-}
-
-message OperationEvent {
-  string operation_id = 1;
-  Phase phase = 2;
-  string detail = 3;
-  string offset_key = 4;
-  int64 at_ms = 5;
-  BoxState box_state = 6;
-  // Transfer progress while saving or restoring; 0 otherwise.
-  uint64 done_bytes = 7;
-  uint64 total_bytes = 8;
-}
-
-message Snapshot {
-  string id = 1;
-  int64 saved_at_ms = 2;
-  bool quiesced = 3;
-  uint64 files = 4;
-  uint64 logical_bytes = 5;
-  // Files new, changed or removed since the save before; absent for saves by
-  // agents older than this field.
-  optional uint64 changed_files = 6;
-  // Plaintext bytes of the chunks this save added to the store.
-  uint64 added_bytes = 7;
-}
-
-message ListSnapshotsResponse {
-  repeated Snapshot snapshots = 1;
-}
-
-message BrowseSnapshotRequest {
-  string box_id = 1;
-  string snapshot_id = 2;
-  // A box path such as /home/user/Documents; empty lists the roots.
-  string dir = 3;
-}
-
-message SnapshotEntry {
-  // The box path.
-  string path = 1;
-  EntryKind kind = 2;
-  uint64 size = 3;
-  int64 mtime_ms = 4;
-}
-
-message BrowseSnapshotResponse {
-  repeated SnapshotEntry entries = 1;
-  // The directory holds more entries than one answer carries.
-  bool truncated = 2;
-}
-
-message RestorePathsRequest {
-  string box_id = 1;
-  string snapshot_id = 2;
-  // Box paths of files or folders, each under /home/user or /workspace.
-  repeated string paths = 3;
-}
-
-message WakeSchedule {
-  string box_id = 1;
-  // Five fields: minute, hour, day of month, month, day of week.
-  string cron = 2;
-  // IANA zone name of cron, such as Asia/Singapore.
-  string tz = 3;
-  uint32 awake_for_s = 4;
-  // The next time of cron; the wake comes a minute before it.
-  int64 next_at_ms = 5;
-  // The latest wake of this schedule from hibernation; 0 before the first.
-  int64 last_wake_at_ms = 6;
-}
-
-message SetWakeScheduleRequest {
-  string box_id = 1;
-  string cron = 2;
-  string tz = 3;
-  // 0 selects the default, 15 minutes.
-  uint32 awake_for_s = 4;
-}
-
-message ListWakeSchedulesRequest {}
-
-message ListWakeSchedulesResponse {
-  repeated WakeSchedule schedules = 1;
-}
-
-message ClearWakeScheduleResponse {}
-
-message UsageRequest {}
-
-message UsageResponse {
-  UsagePeriod today = 1;
-  UsagePeriod month = 2;
-  int64 daily_cap_micros = 3;
-  bool default_cap = 4;
-  int64 remaining_today_micros = 5;
-}
-
-message UsagePeriod {
-  int64 since_ms = 1;
-  int64 requests = 2;
-  int64 prompt_tokens = 3;
-  int64 completion_tokens = 4;
-  int64 total_tokens = 5;
-  int64 cost_micros = 6;
-  repeated ModelUsage models = 7;
-}
-
-message ModelUsage {
-  string model = 1;
-  int64 requests = 2;
-  int64 prompt_tokens = 3;
-  int64 completion_tokens = 4;
-  int64 total_tokens = 5;
-  int64 cost_micros = 6;
-}
diff --git a/cli/src/args.js b/cli/src/args.js
deleted file mode 100644
index 704c2b5..0000000
--- a/cli/src/args.js
+++ /dev/null
@@ -1,45 +0,0 @@
-// Tiny argument parser: no dependency for a handful of flags.
-const BOOLEAN = new Set(['yes', 'json', 'dry-run', 'help', 'version', 'all', 'interrupt', 'handover-prompt'])
-const VALUE = new Set(['client', 'auth', 'name', 'box', 'kind', 'dir', 'handover', 'wait', 'endpoint'])
-// Value flags that take one value (the rest are lists: --client a,b).
-const SINGLE = new Set(['name', 'box', 'kind', 'dir', 'handover', 'wait', 'endpoint'])
-const ALIASES = { y: 'yes', h: 'help', v: 'version', c: 'client' }
-
-export function parseArgs(argv) {
-  const out = { command: null, flags: {}, rest: [] }
-  for (let i = 0; i < argv.length; i++) {
-    let arg = argv[i]
-    if (arg === '--') {
-      out.rest.push(...argv.slice(i + 1))
-      break
-    }
-    if (arg.startsWith('-')) {
-      let value
-      const eq = arg.indexOf('=')
-      if (eq !== -1) {
-        value = arg.slice(eq + 1)
-        arg = arg.slice(0, eq)
-      }
-      let name = arg.replace(/^--?/, '')
-      name = ALIASES[name] || name
-      if (BOOLEAN.has(name)) out.flags[name] = true
-      else if (VALUE.has(name)) {
-        if (value === undefined) value = argv[++i]
-        if (value === undefined || value.startsWith('-')) throw new Error(`--${name} needs a value`)
-        if (SINGLE.has(name)) out.flags[name] = value
-        else if (name === 'auth') {
-          if (value !== 'oauth' && value !== 'key') throw new Error('--auth must be oauth or key')
-          out.flags.auth = value
-        } else out.flags[name] = [...(out.flags[name] || []), ...value.split(',').map((s) => s.trim()).filter(Boolean)]
-      } else if (name === 'token' && (value ?? argv[i + 1]) === '-') {
-        // login --token -: the token comes from stdin or a hidden prompt, never from argv
-        if (value === undefined) i++
-        out.flags.token = '-'
-      } else if (name === 'key' || name === 'token') {
-        throw new Error('pass the key in the BOX_TOKEN environment variable or at the prompt, never as an argument (it would end up in shell history)')
-      } else throw new Error(`unknown option ${arg}`)
-    } else if (!out.command) out.command = arg
-    else out.rest.push(arg)
-  }
-  return out
-}
diff --git a/cli/src/box/browser.js b/cli/src/box/browser.js
deleted file mode 100644
index 822c331..0000000
--- a/cli/src/box/browser.js
+++ /dev/null
@@ -1,34 +0,0 @@
-import { spawn as nodeSpawn } from 'node:child_process'
-
-// openBrowser opens one http(s) URL in this computer's browser without any shell: the URL may come from a box's output,
-// so a shell metacharacter in it (& | ^ % on Windows' cmd) must never be interpreted. Each platform's opener takes the
-// URL as one argv element: macOS open(1), xdg-open (which passes "$1" quoted), and on Windows rundll32's
-// url.dll,FileProtocolHandler, the shell-free opener behind ShellExecute. BROWSER, when set, is run the same way.
-
-/** browserCommand is the opener and its argv for url, or null when url is no http(s) URL. */
-export function browserCommand(url, { env = process.env, platform = process.platform } = {}) {
-  let href
-  try {
-    const parsed = new URL(url)
-    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return null
-    href = parsed.href
-  } catch {
-    return null
-  }
-  if (env.BROWSER) return [env.BROWSER, [href]]
-  if (platform === 'darwin') return ['open', [href]]
-  if (platform === 'win32') return ['rundll32', ['url.dll,FileProtocolHandler', href]]
-  return ['xdg-open', [href]]
-}
-
-export function openBrowser(url, { env = process.env, platform = process.platform, spawn = nodeSpawn } = {}) {
-  const command = browserCommand(url, { env, platform })
-  if (!command) return false
-  try {
-    // shell: false is the default; it is spelled out because the URL must never reach a shell
-    spawn(command[0], command[1], { stdio: 'ignore', detached: true, shell: false, windowsVerbatimArguments: false }).on('error', () => {}).unref()
-    return true
-  } catch {
-    return false // the URL is printed too
-  }
-}
diff --git a/cli/src/box/connection.js b/cli/src/box/connection.js
deleted file mode 100644
index d1094de..0000000
--- a/cli/src/box/connection.js
+++ /dev/null
@@ -1,181 +0,0 @@
-import fs from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import grpc from '@grpc/grpc-js'
-import protoLoader from '@grpc/proto-loader'
-
-// The protos are copied from simular-ai/box proto/ (see proto/README.md); the wire is the relay's native gRPC.
-const PROTO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..', 'proto')
-const HEADER_BOX = 'x-cocoonbox-box'
-// Exec chunks are at most 64 KiB on every hop (contracts.md "Remote command").
-export const CHUNK = 64 << 10
-// A box agent frame is far below this; the edge allows the same.
-const MAX_MESSAGE = 16 << 20
-
-let services
-export function loadServices() {
-  if (services) return services
-  const def = protoLoader.loadSync(['cocoonbox/agent/v1/session.proto', 'cocoonbox/control/v1/boxes.proto'], {
-    includeDirs: [PROTO_ROOT],
-    keepCase: true,
-    longs: Number,
-    enums: String,
-    defaults: false,
-    oneofs: true,
-  })
-  const pkg = grpc.loadPackageDefinition(def)
-  services = { Session: pkg.cocoonbox.agent.v1.Session, Boxes: pkg.cocoonbox.control.v1.Boxes }
-  return services
-}
-
-/** describe turns a gRPC error into one line for a person. */
-export function describe(err) {
-  if (err && typeof err.code === 'number') {
-    const name = Object.keys(grpc.status).find((k) => grpc.status[k] === err.code) || String(err.code)
-    if (err.code === grpc.status.UNAUTHENTICATED) return `box refused the sign-in (${err.details}); run: npx @simular-ai/box login`
-    return `${name}: ${err.details || err.message}`
-  }
-  return err?.message || String(err)
-}
-
-/**
- * BoxConnection is the CLI's gRPC channel to the relay: Boxes for the box list and wake, Session.Exec to run a command
- * in a box. The token travels only in call metadata.
- */
-export class BoxConnection {
-  constructor(endpoint, token) {
-    const url = new URL(endpoint)
-    const target = `${url.hostname}:${url.port || (url.protocol === 'https:' ? 443 : 80)}`
-    const creds = url.protocol === 'https:' ? grpc.credentials.createSsl() : grpc.credentials.createInsecure()
-    const { Session, Boxes } = loadServices()
-    const options = {
-      'grpc.max_receive_message_length': MAX_MESSAGE,
-      'grpc.max_send_message_length': MAX_MESSAGE,
-      // HTTP/2 pings while a call is open, so a half-open stream (sleep, a network change) fails within ~45 s instead of
-      // holding a raw terminal; the relay's load balancer answers them, and no ping goes out on an idle channel.
-      'grpc.keepalive_time_ms': 30000,
-      'grpc.keepalive_timeout_ms': 15000,
-      'grpc.keepalive_permit_without_calls': 0,
-    }
-    this.endpoint = endpoint
-    this.token = token
-    this.boxes = new Boxes(target, creds, options)
-    // Session shares the Boxes channel's options but is its own client, so a stalled Exec never holds a Boxes call.
-    this.session = new Session(target, creds, options)
-  }
-
-  metadata(box) {
-    const md = new grpc.Metadata()
-    md.set('authorization', `Bearer ${this.token}`)
-    if (box) md.set(HEADER_BOX, box)
-    return md
-  }
-
-  #unary(method, request) {
-    return new Promise((resolve, reject) => {
-      this.boxes[method](request, this.metadata(), { deadline: Date.now() + 30000 }, (err, res) => (err ? reject(err) : resolve(res)))
-    })
-  }
-
-  async listBoxes() {
-    const res = await this.#unary('List', {})
-    return res.boxes || []
-  }
-
-  async ensure(boxId) {
-    return this.#unary('Ensure', { box_id: boxId })
-  }
-
-  /** waitRunning polls the box list until boxId runs, for at most timeoutMs. */
-  async waitRunning(boxId, { timeoutMs = 180000, intervalMs = 2000, onState = () => {} } = {}) {
-    const deadline = Date.now() + timeoutMs
-    let last = ''
-    for (;;) {
-      const box = (await this.listBoxes()).find((b) => b.id === boxId)
-      if (!box) throw new Error(`box ${boxId} is gone`)
-      if (box.state === 'BOX_STATE_RUNNING') return box
-      if (box.state === 'BOX_STATE_FAILED') throw new Error(`box ${box.name} failed to start${box.failure_reason ? `: ${box.failure_reason}` : ''}`)
-      if (box.state !== last) onState(box.state)
-      last = box.state
-      if (Date.now() > deadline) throw new Error(`box ${box.name} is still ${stateName(box.state)} after ${Math.round(timeoutMs / 1000)} s`)
-      await new Promise((r) => setTimeout(r, intervalMs))
-    }
-  }
-
-  /**
-   * exec runs start (`{command, tty?}`) in box. input is an async iterable of client frames after start
-   * (`{stdin}`, `{eof: {}}`, `{signal}`, `{resize}`); it is read one frame at a time as the stream drains, so a slow box
-   * slows the reader. onOutput(buffer, isStderr) may return a promise, which pauses the stream until it settles.
-   * Resolves to the exit code, or null when the stream ended without one. The returned `call` lets a caller cancel.
-   */
-  exec(box, start, input, onOutput, { onCall = () => {} } = {}) {
-    return new Promise((resolve, reject) => {
-      const call = this.session.Exec(this.metadata(box))
-      onCall(call)
-      let code = null
-      let settled = false
-      const done = (fn, v) => {
-        if (settled) return
-        settled = true
-        fn(v)
-      }
-      call.on('data', (frame) => {
-        if (frame.body === 'exit_code') code = frame.exit_code ?? 0
-        else if (frame.body === 'stdout' || frame.body === 'stderr') {
-          const pending = onOutput(frame[frame.body] || Buffer.alloc(0), frame.body === 'stderr')
-          if (pending && typeof pending.then === 'function') {
-            call.pause()
-            pending.then(() => call.resume(), (err) => {
-              call.cancel()
-              done(reject, err)
-            })
-          }
-        }
-      })
-      call.on('error', (err) => {
-        // A cancel after the exit code is ours; anything else is the transport's.
-        if (code !== null && err.code === grpc.status.CANCELLED) return done(resolve, code)
-        done(reject, err)
-      })
-      call.on('end', () => done(resolve, code))
-      const write = (frame) =>
-        new Promise((res) => {
-          if (call.write(frame)) res()
-          else call.once('drain', res)
-        })
-      ;(async () => {
-        await write({ start })
-        for await (const frame of input) {
-          if (settled) return
-          await write(frame)
-        }
-        call.end()
-      })().catch((err) => {
-        call.cancel()
-        done(reject, err)
-      })
-    })
-  }
-
-  close() {
-    this.boxes.close()
-    this.session.close()
-  }
-}
-
-export function stateName(state) {
-  return String(state || '').replace(/^BOX_STATE_/, '').toLowerCase() || 'unknown'
-}
-
-/** frames turns parts (Buffers, or {file} paths read lazily) into stdin frames of at most CHUNK bytes, then eof. */
-export async function* frames(parts) {
-  for (const part of parts) {
-    if (Buffer.isBuffer(part)) {
-      for (let i = 0; i < part.length; i += CHUNK) yield { stdin: part.subarray(i, i + CHUNK) }
-    } else if (part && part.file) {
-      const stream = fs.createReadStream(part.file, { highWaterMark: CHUNK })
-      for await (const chunk of stream) yield { stdin: chunk }
-    }
-  }
-  yield { eof: {} }
-}
diff --git a/cli/src/box/endpoint.js b/cli/src/box/endpoint.js
deleted file mode 100644
index 45431dc..0000000
--- a/cli/src/box/endpoint.js
+++ /dev/null
@@ -1,20 +0,0 @@
-import path from 'node:path'
-import { DEFAULT_MCP_URL } from '../constants.js'
-
-/** The relay origin for gRPC, OAuth and the CLI's own token: BOX_ENDPOINT, else the origin of BOX_MCP_URL, else prod. */
-export function endpointUrl(env = process.env) {
-  const raw = (env.BOX_ENDPOINT || '').trim() || new URL((env.BOX_MCP_URL || '').trim() || DEFAULT_MCP_URL).origin
-  const url = new URL(raw)
-  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname))) {
-    throw new Error(`the box endpoint must be https (or http on localhost): ${raw}`)
-  }
-  return url.origin
-}
-
-/**
- * Where the CLI keeps its state: BOX_HOME, else ~/.simular-box (0700). It holds the CLI's token (credentials.json, 0600)
- * and offload/, the records of offloads in flight.
- */
-export function boxHome(env = process.env, home = env.HOME || env.USERPROFILE) {
-  return env.BOX_HOME || path.join(home, '.simular-box')
-}
diff --git a/cli/src/box/login.js b/cli/src/box/login.js
deleted file mode 100644
index 893c5b4..0000000
--- a/cli/src/box/login.js
+++ /dev/null
@@ -1,123 +0,0 @@
-import crypto from 'node:crypto'
-import http from 'node:http'
-import os from 'node:os'
-
-// BrowserLogin signs the CLI in as the relay's first-party client (RFC 8252), as upstream's `cocoonbox login`: it opens
-// the consent page, takes the answer on a loopback port of its own, and redeems the code with PKCE for a device token,
-// which has no expiry and no refresh token and is revoked under Keys -> Devices.
-
-export const CLI_CLIENT = 'cocoonbox-cli'
-const AUTHORIZE_PATH = '/cb/oauth/authorize'
-const TOKEN_PATH = '/oauth/token'
-const REVOKE_PATH = '/oauth/revoke'
-const MAX_DEVICE_NAME = 64
-const PAGE = '<!doctype html><meta charset=utf-8><title>box</title><p>box has the answer. You can close this tab and return to the terminal.'
-
-const urlSafe = (buf) => buf.toString('base64url')
-
-export function challenge(verifier) {
-  return urlSafe(crypto.createHash('sha256').update(verifier).digest())
-}
-
-/** deviceName is this computer's name as the consent page and the Devices list show it. */
-export function deviceName(host = os.hostname()) {
-  const name = host.endsWith('.local') ? host.slice(0, -6) : host
-  let out = ''
-  for (const ch of name) {
-    if (Buffer.byteLength(out + ch) > MAX_DEVICE_NAME) break
-    out += ch
-  }
-  return out
-}
-
-export function authorizeUrl(endpoint, { redirect, challenge: chal, state, device }) {
-  const url = new URL(endpoint + AUTHORIZE_PATH)
-  url.search = new URLSearchParams({
-    response_type: 'code',
-    client_id: CLI_CLIENT,
-    redirect_uri: redirect,
-    scope: 'account',
-    code_challenge: chal,
-    code_challenge_method: 'S256',
-    state,
-    device_name: device,
-  }).toString()
-  return url.toString()
-}
-
-/** listen opens 127.0.0.1 on a free port and resolves the query of the first GET /callback. */
-function listen() {
-  let deliver
-  const answered = new Promise((resolve) => (deliver = resolve))
-  const server = http.createServer((req, res) => {
-    const url = new URL(req.url, 'http://127.0.0.1')
-    if (req.method !== 'GET' || url.pathname !== '/callback') {
-      res.writeHead(404).end()
-      return
-    }
-    res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' }).end(PAGE)
-    deliver(url.searchParams)
-  })
-  return new Promise((resolve, reject) => {
-    server.once('error', (err) => reject(new Error(`cannot listen on 127.0.0.1: ${err.message}`)))
-    server.listen(0, '127.0.0.1', () => resolve({ server, port: server.address().port, answered }))
-  })
-}
-
-async function post(endpoint, pathname, fields, fetchImpl = fetch) {
-  const res = await fetchImpl(endpoint + pathname, {
-    method: 'POST',
-    headers: { 'content-type': 'application/x-www-form-urlencoded' },
-    body: new URLSearchParams(fields).toString(),
-    signal: AbortSignal.timeout(15000),
-  })
-  let body = {}
-  try {
-    body = await res.json()
-  } catch {
-    // an empty or non-JSON answer
-  }
-  return { status: res.status, body }
-}
-
-/**
- * browserLogin runs the sign-in: open(url) shows the consent page; the promise resolves to the device token.
- * The token is returned to the caller only; it is never printed or logged here.
- */
-export async function browserLogin(endpoint, { open, timeoutMs = 600000, device = deviceName(), fetchImpl } = {}) {
-  const { server, port, answered } = await listen()
-  try {
-    const verifier = urlSafe(crypto.randomBytes(32))
-    const state = urlSafe(crypto.randomBytes(16))
-    const redirect = `http://127.0.0.1:${port}/callback`
-    await open(authorizeUrl(endpoint, { redirect, challenge: challenge(verifier), state, device }))
-    let timer
-    const timeout = new Promise((_, reject) => {
-      timer = setTimeout(() => reject(new Error('no answer from the browser in time')), timeoutMs)
-    })
-    const answer = await Promise.race([answered, timeout]).finally(() => clearTimeout(timer))
-    if (answer.get('state') !== state) throw new Error('the browser brought back an answer to another sign-in')
-    const iss = answer.get('iss')
-    if ((iss || '').toLowerCase() !== endpoint.toLowerCase()) throw new Error(`the answer came from ${iss || 'an unnamed issuer'}, not ${endpoint}`)
-    if (answer.get('error')) throw new Error(`the sign-in was denied: ${answer.get('error_description') || answer.get('error')}`)
-    const code = answer.get('code')
-    if (!code) throw new Error('the answer carries no code')
-    const { status, body } = await post(
-      endpoint,
-      TOKEN_PATH,
-      { grant_type: 'authorization_code', code, client_id: CLI_CLIENT, redirect_uri: redirect, code_verifier: verifier },
-      fetchImpl,
-    )
-    if (status !== 200 || !body.access_token) throw new Error(`the server refused the sign-in: ${body.error_description || `HTTP ${status}`}`)
-    return body.access_token
-  } finally {
-    server.close()
-    server.closeAllConnections?.()
-  }
-}
-
-/** revoke ends a device token at the server; a token that is no device's is left alone (RFC 7009). */
-export async function revoke(endpoint, token, { fetchImpl } = {}) {
-  const { status } = await post(endpoint, REVOKE_PATH, { token, client_id: CLI_CLIENT }, fetchImpl)
-  if (status !== 200) throw new Error(`the server answered HTTP ${status} to the revoke`)
-}
diff --git a/cli/src/box/rsh.js b/cli/src/box/rsh.js
deleted file mode 100644
index 60f1f67..0000000
--- a/cli/src/box/rsh.js
+++ /dev/null
@@ -1,314 +0,0 @@
-import fs from 'node:fs'
-import { spawnSync } from 'node:child_process'
-import { describe, stateName } from './connection.js'
-
-// rsh runs a command in a box with this process's stdin, stdout and stderr, ssh-style, so rsync and git can use it as their
-// remote shell (contracts.md "Remote command", upstream `cocoonbox rsh`). It exits with the command's code, or 255 for its
-// own failures.
-
-export const RSH_USAGE = 'usage: npx @simular-ai/box rsh [--box NAME|ID] [-t] [-l USER] [HOST] COMMAND...'
-export const RSH_FAILURE = 255
-const MAX_TERMINFO = 256 << 10
-
-/** parseRsh splits rsh's argv into options and the words after them. */
-export function parseRsh(argv) {
-  const options = {}
-  let i = 0
-  for (; i < argv.length; i++) {
-    const a = argv[i]
-    if (a === '--') {
-      i++
-      break
-    }
-    if (!a.startsWith('-')) break
-    if (a === '-t') {
-      options.tty = true
-      continue
-    }
-    if (!['--box', '--endpoint', '-l'].includes(a) || i + 1 >= argv.length) throw new Error(`unknown option ${a}\n${RSH_USAGE}`)
-    options[a.replace(/^-+/, '')] = argv[++i]
-  }
-  return { options, words: argv.slice(i) }
-}
-
-/**
- * pickBox resolves the box and drops rsync's or git's host word. --box wins: a first word that is `box` or names one of
- * the user's boxes is dropped as the host. Without --box, the first word names the box.
- */
-export function pickBox(boxes, boxRef, words) {
-  const host = (w) => w.split('@').pop()
-  const named = (w) => boxes.find((b) => b.id === host(w) || b.name === host(w))
-  const rest = [...words]
-  let box
-  if (boxRef) {
-    box = boxes.find((b) => b.id === boxRef || b.name === boxRef)
-    if (!box) throw new Error(`no box named ${boxRef}; yours: ${boxes.map((b) => b.name).join(', ') || 'none'}`)
-    if (rest.length && (host(rest[0]) === 'box' || named(rest[0]))) rest.shift()
-  } else {
-    box = rest.length ? named(rest[0]) : null
-    if (!box) throw new Error(`name the box with --box or as the host\n${RSH_USAGE}`)
-    rest.shift()
-  }
-  return { box, command: rest.join(' ') }
-}
-
-/** wake ensures box runs, reporting progress on stderr, and returns it as the list then shows it. */
-export async function wake(connection, box, stderr = process.stderr) {
-  if (box.state === 'BOX_STATE_RUNNING') return box
-  stderr.write(`box: waking ${box.name}\n`)
-  await connection.ensure(box.id)
-  return connection.waitRunning(box.id, { onState: (s) => stderr.write(`box: ${box.name} is ${stateName(s)}\n`) })
-}
-
-/** terminfo is the local `infocmp -x` source of term, which a box without the entry compiles; empty when there is none. */
-export function terminfo(term) {
-  if (!term) return ''
-  const r = spawnSync('infocmp', ['-x', term], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
-  if (r.status !== 0 || Buffer.byteLength(r.stdout || '') > MAX_TERMINFO) return ''
-  return r.stdout
-}
-
-/**
- * Input is the frames sent after start: stdin chunks pulled one at a time as the stream asks (so a chunk or two at most
- * wait in memory), then eof; signals and window sizes jump the queue.
- */
-export class Input {
-  /** filter, when given, maps each stdin chunk (the tty escape); it may end the input by returning disconnect. */
-  constructor(stdin, { filter } = {}) {
-    this.filter = filter
-    this.urgent = []
-    this.wake = null
-    this.reader = stdin ? stdin[Symbol.asyncIterator]() : null
-    this.pending = null
-    this.ended = !stdin
-    this.eofSent = false
-  }
-
-  send(frame) {
-    this.urgent.push(frame)
-    const wake = this.wake
-    this.wake = null
-    wake?.()
-  }
-
-  #nextUrgent() {
-    return new Promise((resolve) => (this.wake = resolve))
-  }
-
-  async *[Symbol.asyncIterator]() {
-    for (;;) {
-      if (this.urgent.length) {
-        yield this.urgent.shift()
-        continue
-      }
-      if (this.ended) {
-        if (!this.eofSent) {
-          this.eofSent = true
-          yield { eof: {} }
-          continue
-        }
-        // after eof only signals and sizes go
-        await this.#nextUrgent()
-        continue
-      }
-      const urgent = this.#nextUrgent().then(() => null)
-      this.pending ??= this.reader.next().then((v) => ({ v }))
-      const got = await Promise.race([this.pending, urgent])
-      if (!got) continue
-      this.pending = null
-      if (got.v.done) {
-        this.ended = true
-        continue
-      }
-      let data = Buffer.isBuffer(got.v.value) ? got.v.value : Buffer.from(got.v.value)
-      if (this.filter) {
-        const r = this.filter(data)
-        data = r.data
-        if (r.disconnect) {
-          if (data.length) yield { stdin: data }
-          // stop reading; the caller cancels the stream
-          this.ended = true
-          this.eofSent = true
-          continue
-        }
-      }
-      if (data.length) yield { stdin: data }
-    }
-  }
-}
-
-const TILDE = 0x7e
-const DOT = 0x2e
-
-/**
- * escapeFilter is ssh's escape for a raw terminal: `~.` at the start of a line disconnects, `~~` sends one `~`, and a
- * `~` before anything else is sent as typed. Raw mode sends Ctrl-C to the box, so this is the way out of a stuck stream.
- */
-export function escapeFilter(onDisconnect) {
-  let lineStart = true
-  let pending = false
-  return (buf) => {
-    const out = []
-    for (const b of buf) {
-      if (pending) {
-        pending = false
-        if (b === DOT) {
-          onDisconnect()
-          return { data: Buffer.from(out), disconnect: true }
-        }
-        out.push(TILDE)
-        if (b === TILDE) {
-          lineStart = false
-          continue
-        }
-      } else if (lineStart && b === TILDE) {
-        pending = true
-        continue
-      }
-      out.push(b)
-      lineStart = b === 0x0d || b === 0x0a
-    }
-    return { data: Buffer.from(out), disconnect: false }
-  }
-}
-
-/** writeTo writes data to a stream and resolves when it may take more, so a slow local reader slows the box. */
-export function writeTo(stream, data) {
-  if (stream.destroyed || stream.writableEnded) return undefined
-  if (stream.write(data)) return undefined
-  return new Promise((resolve) => {
-    const done = () => {
-      stream.off('drain', done)
-      stream.off('close', done)
-      resolve()
-    }
-    stream.once('drain', done)
-    stream.once('close', done)
-  })
-}
-
-/**
- * attach runs start in box on this process's terminal or pipes. tap(buffer) sees every output chunk (sign-in watches for
- * its link). Resolves to the exit code; a second INT or TERM rejects with code 255.
- */
-export async function attach(connection, boxId, start, { tty = false, tap = () => {}, stdin = process.stdin, stdout = process.stdout, stderr = process.stderr } = {}) {
-  let call
-  let ended = null // why this side ended the stream: 'escape' or 'pipe'
-  const end = (why) => {
-    if (ended) return
-    ended = why
-    call?.cancel()
-  }
-  const raw = tty && stdin?.isTTY
-  const input = new Input(stdin, { filter: raw ? escapeFilter(() => end('escape')) : undefined })
-  const restore = []
-  // A closed local reader (`rsh box cat big | head`) ends the stream quietly with 255, as ssh does, instead of a crash.
-  const onPipeError = (err) => {
-    if (err?.code === 'EPIPE' || err?.code === 'ERR_STREAM_DESTROYED') end('pipe')
-  }
-  for (const s of [stdout, stderr]) {
-    s.on('error', onPipeError)
-    restore.push(() => s.off('error', onPipeError))
-  }
-  if (tty) {
-    if (raw) {
-      stderr.write('box: ~. at the start of a line disconnects\r\n')
-      stdin.setRawMode(true)
-      restore.push(() => stdin.setRawMode(false))
-      const onResize = () => input.send({ resize: { rows: stdout.rows || 24, cols: stdout.columns || 80 } })
-      process.on('SIGWINCH', onResize)
-      restore.push(() => process.off('SIGWINCH', onResize))
-    }
-  }
-  let forwarded = false
-  const onSignal = (name) => () => {
-    if (forwarded) {
-      call?.cancel()
-      for (const r of restore.splice(0)) r()
-      process.exit(RSH_FAILURE)
-    }
-    forwarded = true
-    input.send({ signal: name })
-  }
-  const int = onSignal('EXEC_SIGNAL_INT')
-  const term = onSignal('EXEC_SIGNAL_TERM')
-  process.on('SIGINT', int)
-  process.on('SIGTERM', term)
-  restore.push(() => {
-    process.off('SIGINT', int)
-    process.off('SIGTERM', term)
-  })
-  try {
-    return await connection.exec(
-      boxId,
-      start,
-      input,
-      (data, isStderr) => {
-        if (ended) return undefined
-        tap(data)
-        return writeTo(isStderr ? stderr : stdout, data)
-      },
-      { onCall: (c) => (call = c) },
-    )
-  } catch (err) {
-    if (!ended) throw err
-    if (ended === 'escape') stderr.write('\r\nbox: disconnected\r\n')
-    return RSH_FAILURE
-  } finally {
-    for (const r of restore.splice(0)) r()
-    stdin?.pause?.()
-  }
-}
-
-/** rsh is the `rsh` command; it never returns, exiting with the remote code or 255. */
-export async function rsh(argv, { connect, env = process.env }) {
-  const report = env.BOX_RSH_REPORT
-  const fail = (message) => {
-    if (report) {
-      try {
-        fs.writeFileSync(report, `failed: ${message.split('\n')[0]}\n`)
-      } catch {
-        // the caller only reads it when present
-      }
-    }
-    process.stderr.write(`box rsh: ${message}\n`)
-    return RSH_FAILURE
-  }
-  let parsed
-  try {
-    parsed = parseRsh(argv)
-  } catch (err) {
-    return fail(err.message)
-  }
-  let connection
-  try {
-    connection = connect(parsed.options.endpoint)
-    const boxes = await connection.listBoxes()
-    const { box, command } = pickBox(boxes, parsed.options.box, parsed.words)
-    if (!command) return fail(`no command: rsh runs a command, not a login shell\n${RSH_USAGE}`)
-    await wake(connection, box)
-    const start = { command }
-    let tty = false
-    if (parsed.options.tty) {
-      if (process.stdin.isTTY) {
-        const t = env.TERM || ''
-        start.tty = { term: t, window: { rows: process.stdout.rows || 24, cols: process.stdout.columns || 80 }, terminfo: terminfo(t) }
-        tty = true
-      } else process.stderr.write('box rsh: no terminal for the command because stdin is not a terminal\n')
-    }
-    const code = await attach(connection, box.id, start, { tty })
-    if (code === null) return fail('the box ended the command without an exit code')
-    if (report) {
-      try {
-        fs.writeFileSync(report, `exit ${code}\n`)
-      } catch {
-        // best effort
-      }
-    }
-    return code
-  } catch (err) {
-    return fail(describe(err))
-  } finally {
-    connection?.close()
-  }
-}
diff --git a/cli/src/box/token-store.js b/cli/src/box/token-store.js
deleted file mode 100644
index e68e8ff..0000000
--- a/cli/src/box/token-store.js
+++ /dev/null
@@ -1,61 +0,0 @@
-import fs from 'node:fs'
-import path from 'node:path'
-
-export const TOKEN_ENV = 'BOX_TOKEN'
-
-/**
- * TokenStore keeps the CLI's own box token per endpoint in <boxHome>/credentials.json, mode 0600 in a 0700 directory,
- * as gh and Claude Code do on Linux. BOX_TOKEN (a personal key, cb_...) wins over the file and is never written.
- * It is one small interface, so an OS keychain backend can replace the file later without touching the callers.
- */
-export class TokenStore {
-  constructor(dir, env = process.env) {
-    this.dir = dir
-    this.file = path.join(dir, 'credentials.json')
-    this.env = env
-  }
-
-  /** saved is the token login stored for endpoint, ignoring BOX_TOKEN: {token, source: 'browser' (a device token) | 'paste'}. */
-  saved(endpoint) {
-    const entry = this.#read()[endpoint]
-    return entry?.token ? { token: entry.token, source: entry.source || 'paste' } : null
-  }
-
-  /** get is the token calls use: BOX_TOKEN ({source: 'env'}) when set, else the saved one, else null. */
-  get(endpoint) {
-    const fromEnv = (this.env[TOKEN_ENV] || '').trim()
-    return fromEnv ? { token: fromEnv, source: 'env' } : this.saved(endpoint)
-  }
-
-  set(endpoint, token, source) {
-    const all = this.#read()
-    all[endpoint] = { token, source, saved_at: new Date().toISOString() }
-    this.#write(all)
-  }
-
-  remove(endpoint) {
-    const all = this.#read()
-    if (!(endpoint in all)) return false
-    delete all[endpoint]
-    this.#write(all)
-    return true
-  }
-
-  #read() {
-    try {
-      const parsed = JSON.parse(fs.readFileSync(this.file, 'utf8'))
-      return parsed && typeof parsed === 'object' ? parsed : {}
-    } catch {
-      return {}
-    }
-  }
-
-  #write(all) {
-    fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 })
-    fs.chmodSync(this.dir, 0o700)
-    const tmp = `${this.file}.${process.pid}.tmp`
-    fs.writeFileSync(tmp, JSON.stringify(all, null, 2) + '\n', { mode: 0o600 })
-    fs.chmodSync(tmp, 0o600)
-    fs.renameSync(tmp, this.file)
-  }
-}
diff --git a/cli/src/cli.js b/cli/src/cli.js
deleted file mode 100644
index 052e400..0000000
--- a/cli/src/cli.js
+++ /dev/null
@@ -1,414 +0,0 @@
-import { createRequire } from 'node:module'
-import * as p from '@clack/prompts'
-import { parseArgs } from './args.js'
-import { createContext } from './context.js'
-import { CLIENTS, findClient } from './clients/index.js'
-import { DEFAULT_MCP_URL, KEY_ENV, KEYS_URL, WATCH_URL, INSTALL_URL, SUPPORT_EMAIL, EXAMPLE_PROMPTS, isOldUrl, looksLikeKey, validServerName } from './constants.js'
-import { probeEndpoint, checkKey } from './probe.js'
-import { OFFLOAD_HELP, boxContext, login, logout, rshCommand, offload, back } from './offload/commands.js'
-
-const VERSION = createRequire(import.meta.url)('../package.json').version
-
-const HELP = `simular-box ${VERSION}: connect box (a cloud computer for your AI agent) to your AI apps.
-
-Usage:
-  npx @simular-ai/box connect [--client <ids>] [--auth oauth|key] [--yes] [--dry-run]
-  npx @simular-ai/box doctor  [--client <ids>] [--json]
-  npx @simular-ai/box remove  [--client <ids>] [--yes] [--dry-run]
-
-${OFFLOAD_HELP}
-
-Clients: ${CLIENTS.map((c) => c.id).join(', ')}
-
-Options:
-  -c, --client <ids>  Comma-separated client ids (default: pick from the detected ones)
-      --name <name>   Server name to use instead of "box" (when another "box" server exists)
-      --auth key      Hermes and OpenClaw: use a personal key instead of OAuth (for
-                      always-on servers with no browser). Other apps always use OAuth.
-  -y, --yes           Don't ask; with no --client, use every detected client
-      --dry-run       Show what would change without writing anything
-      --json          doctor: machine-readable output
-
-Sign-in: every app signs in with OAuth in the browser by default (no key). With --auth key, the key
-comes from ${KEY_ENV} or a hidden prompt (create one at ${KEYS_URL}); it is never accepted as an
-argument and never printed.
-Set BOX_MCP_URL to use another box endpoint (default ${DEFAULT_MCP_URL}).
-`
-
-export async function main(argv, { env = process.env, stdout = process.stdout, isTTY = Boolean(process.stdin.isTTY && process.stdout.isTTY) } = {}) {
-  // rsh is rsync's and git's remote shell: its words after the options are the remote command, so they are not parsed here.
-  if (argv[0] === 'rsh') return rshCommand(boxContext(env), argv.slice(1))
-  const args = parseArgs(argv)
-  if (args.flags.version) {
-    stdout.write(`${VERSION}\n`)
-    return 0
-  }
-  if (args.flags.help || !args.command || args.command === 'help') {
-    stdout.write(HELP)
-    return args.command || args.flags.help ? 0 : 1
-  }
-  const ctx = createContext({ env, dryRun: Boolean(args.flags['dry-run']), serverName: args.flags.name ? validServerName(args.flags.name) : undefined })
-  const interactive = isTTY && !args.flags.yes && !args.flags.json
-  switch (args.command) {
-    case 'connect':
-    case 'add':
-    case 'install':
-      return connect(ctx, args.flags, { interactive, env, isTTY })
-    case 'doctor':
-    case 'status':
-      return doctor(ctx, args.flags, { stdout })
-    case 'remove':
-    case 'uninstall':
-      return remove(ctx, args.flags, { interactive })
-    case 'login':
-      return login(boxContext(env), args.flags, { stdout })
-    case 'logout':
-      return logout(boxContext(env), args.flags, { stdout })
-    case 'offload':
-      return offload(boxContext(env), args.flags, args.rest, { stdout })
-    case 'back':
-      return back(boxContext(env), args.flags, { stdout })
-    default:
-      throw new Error(`unknown command "${args.command}"; run with --help`)
-  }
-}
-
-function selectedFromFlags(flags) {
-  return (flags.client || []).map((id) => {
-    const c = findClient(id)
-    if (!c) throw new Error(`unknown client "${id}"; known: ${CLIENTS.map((x) => x.id).join(', ')}`)
-    return c
-  })
-}
-
-function detectAll(ctx) {
-  return CLIENTS.map((client) => ({ client, detected: safe(() => client.detect(ctx), { installed: false }) }))
-}
-
-function safe(fn, fallback) {
-  try {
-    return fn()
-  } catch {
-    return fallback
-  }
-}
-
-function cancelled(value) {
-  if (p.isCancel(value)) {
-    p.cancel('Nothing changed.')
-    return true
-  }
-  return false
-}
-
-async function chooseClients(ctx, flags, { interactive, verb }) {
-  const explicit = selectedFromFlags(flags)
-  if (explicit.length) return explicit
-  const found = detectAll(ctx).filter((d) => d.detected.installed)
-  if (!found.length) {
-    p.log.warn(`No supported AI apps found. Supported: ${CLIENTS.map((c) => c.name).join(', ')}.`)
-    p.log.info(`Install one, or pick one anyway with --client <id>. Manual steps: ${INSTALL_URL}`)
-    return []
-  }
-  if (!interactive) {
-    if (!flags.yes) throw new Error(`no --client given; pass --client ${found.map((d) => d.client.id).join(',')} or --yes for all detected`)
-    return found.map((d) => d.client)
-  }
-  const picked = await p.multiselect({
-    message: `Which apps should ${verb} box? (space to toggle, enter to confirm)`,
-    options: found.map(({ client, detected }) => ({
-      value: client.id,
-      label: client.name,
-      hint: `${client.manual ? 'shows the steps' : client.supportsKey ? 'OAuth or personal key' : 'sign in in the browser'}${detected.cliMissing ? '; CLI not on PATH' : ''}`,
-    })),
-    initialValues: found.map((d) => d.client.id),
-    required: true,
-  })
-  if (cancelled(picked)) return null
-  return picked.map(findClient)
-}
-
-async function chooseModes(clients, flags, { interactive }) {
-  const modes = {}
-  for (const c of clients) modes[c.id] = c.auth === 'key' ? 'key' : 'oauth'
-  const flexible = clients.filter((c) => c.supportsKey)
-  if (!flexible.length) return modes
-  if (flags.auth) {
-    for (const c of flexible) modes[c.id] = flags.auth
-    return modes
-  }
-  if (!interactive) return modes
-  for (const c of flexible) {
-    const choice = await p.select({
-      message: `How should ${c.name} sign in to box?`,
-      options: [
-        { value: 'oauth', label: 'Sign in in the browser (OAuth)', hint: 'desktop with a browser' },
-        { value: 'key', label: 'Personal key (cb_...)', hint: 'always-on server; OAuth sign-ins expire and need a person' },
-      ],
-      initialValue: 'oauth',
-    })
-    if (cancelled(choice)) return null
-    modes[c.id] = choice
-  }
-  return modes
-}
-
-async function getKey(ctx, clients, { interactive, env }) {
-  const fromEnv = (env[KEY_ENV] || '').trim()
-  if (fromEnv) {
-    if (!looksLikeKey(fromEnv)) throw new Error(`${KEY_ENV} is set but does not look like a box personal key (cb_...)`)
-    return fromEnv
-  }
-  // Re-runs keep the key a client already has.
-  const missing = clients.filter((c) => !safe(() => c.status(ctx), {}).keyConfigured)
-  if (!missing.length) return null
-  if (!interactive) {
-    throw new Error(`${missing.map((c) => c.name).join(', ')} sign in with a personal key. Create one at ${KEYS_URL} and run again with ${KEY_ENV}=cb_... in the environment`)
-  }
-  p.log.info(`${missing.map((c) => c.name).join(', ')} can't sign in in the browser, so ${missing.length > 1 ? 'they use' : 'it uses'} a personal key.\nCreate one at ${KEYS_URL} (Create key under Personal keys; it is shown once).`)
-  const key = await p.password({
-    message: 'Paste the key (cb_...)',
-    mask: '*',
-    validate: (v) => (looksLikeKey(v) ? undefined : 'A box personal key starts with cb_'),
-  })
-  if (cancelled(key)) return undefined
-  return key.trim()
-}
-
-async function connect(ctx, flags, { interactive, env, isTTY }) {
-  p.intro(`box ${ctx.dryRun ? '(dry run) ' : ''}-> ${ctx.url}`)
-  const clients = await chooseClients(ctx, flags, { interactive, verb: 'use' })
-  if (!clients?.length) return clients === null ? 1 : 0
-  const modes = await chooseModes(clients, flags, { interactive })
-  if (!modes) return 1
-  const keyClients = clients.filter((c) => modes[c.id] === 'key')
-  let key = null
-  if (keyClients.length) {
-    key = await getKey(ctx, keyClients, { interactive, env })
-    if (key === undefined) return 1
-  }
-  let failed = 0
-  let connected = 0
-  const next = []
-  const signable = []
-  for (const client of clients) {
-    // The spinner draws with escape codes; in logs and CI print plain lines instead.
-    const spin = isTTY ? p.spinner() : { start() {}, stop: (msg, code) => (code ? p.log.error(msg) : p.log.success(msg)) }
-    spin.start(`${client.name}`)
-    try {
-      const moved = movedFrom(ctx, client)
-      const res = await client.connect(ctx, { key, mode: modes[client.id] })
-      spin.stop(`${client.name}: ${res.actions.length ? res.actions.join('; ') : 'already set up'}`)
-      for (const b of res.backups || []) p.log.message(`  backup: ${b}`)
-      for (const w of res.warnings || []) p.log.warn(`  ${w}`)
-      if (moved.length && res.actions.length && !ctx.dryRun) {
-        p.log.warn(`  box moved from ${moved.join(', ')} to ${ctx.url}. ${client.name} may ask you to sign in to box again.`)
-      }
-      for (const n of res.next || []) next.push({ client, text: `${client.name}: ${n}` })
-      if (client.signIn && modes[client.id] === 'oauth') signable.push(client)
-      connected++
-    } catch (err) {
-      failed++
-      spin.stop(`${client.name}: failed`, 1)
-      p.log.error(`  ${err.message}`)
-      if (isPermissionError(err)) {
-        const where = safe(() => client.configLocation(ctx), 'its config')
-        p.log.warn(`  box could not change ${where}: the file or its folder may belong to another user (for example after a run with sudo), or the app may hold it open. Check the owner of both, or quit the app, then run again.`)
-        for (const n of client.permissionHelp?.(ctx) || []) next.push({ client, text: `${client.name}: ${n}` })
-      }
-    }
-  }
-  // Some apps sign in from their own CLI; offer to run it here instead of leaving it as a step.
-  if (interactive && !ctx.dryRun) {
-    for (const client of signable) {
-      if (await signInNow(ctx, client)) next.splice(0, next.length, ...next.filter((n) => n.client !== client))
-    }
-  }
-  if (next.length) p.note(next.map((n) => n.text).join('\n'), 'Next')
-  if (connected && !ctx.dryRun) {
-    p.note([`After signing in (or setting your key), start a new chat (or restart the app) so box's tools load. Then try:`, ...EXAMPLE_PROMPTS.map((e) => `  ${e}`)].join('\n'), 'Try box')
-  }
-  p.outro(`Watch your box live: ${WATCH_URL}  |  Keys and connected apps: ${KEYS_URL}  |  Check: npx @simular-ai/box doctor`)
-  return failed ? 1 : 0
-}
-
-/** Runs a client's own sign-in for box in this terminal. True when the client then reports box signed in. */
-async function signInNow(ctx, client) {
-  if (client.signIn.signedIn(ctx) === true) {
-    p.log.success(`${client.name}: already signed in to box`)
-    return true
-  }
-  const go = await p.confirm({ message: `Sign in to box in ${client.name} now? It opens your browser.`, initialValue: true })
-  if (cancelled(go) || !go) return false
-  const args = client.signIn.args(ctx)
-  p.log.step(`Running ${[client.signIn.bin, ...args].join(' ')}`)
-  ctx.runInteractive(client.signIn.bin, args)
-  const ok = client.signIn.signedIn(ctx)
-  if (ok === true) p.log.success(`${client.name}: signed in to box`)
-  else p.log.warn(`${client.name}: box is not signed in yet (the sign-in may have timed out). Run it again when you're ready.`)
-  return ok === true
-}
-
-/** The old box addresses a client points at before connect rewrites them. */
-function movedFrom(ctx, client) {
-  const st = safe(() => client.status(ctx), null)
-  return [...new Set((st?.entries || []).map((e) => e.url).filter((u) => u && isOldUrl(u, ctx.url)))]
-}
-
-/** EACCES/EPERM, or EBUSY (Windows: the app holds the file open), including as text ("Access is denied"). */
-export function isPermissionError(err) {
-  return ['EACCES', 'EPERM', 'EBUSY'].includes(err?.code) || /\bEACCES\b|\bEPERM\b|\bEBUSY\b|permission denied|access is denied|operation not permitted/i.test(err?.message || '')
-}
-
-async function remove(ctx, flags, { interactive }) {
-  p.intro(`Remove box ${ctx.dryRun ? '(dry run)' : ''}`)
-  let clients = selectedFromFlags(flags)
-  if (!clients.length) {
-    const configured = detectAll(ctx)
-      .filter((d) => d.detected.installed)
-      .map((d) => d.client)
-      .filter((c) => {
-        const s = safe(() => c.status(ctx), null)
-        return s && (s.entries.length || s.legacy.length || s.keyConfigured)
-      })
-    if (!configured.length) {
-      p.outro('box is not set up in any detected app.')
-      return 0
-    }
-    if (interactive) {
-      const picked = await p.multiselect({
-        message: 'Remove box from which apps?',
-        options: configured.map((c) => ({ value: c.id, label: c.name })),
-        initialValues: configured.map((c) => c.id),
-        required: true,
-      })
-      if (cancelled(picked)) return 1
-      clients = picked.map(findClient)
-    } else if (flags.yes) clients = configured
-    else throw new Error(`no --client given; pass --client ${configured.map((c) => c.id).join(',')} or --yes`)
-  }
-  let failed = 0
-  for (const client of clients) {
-    try {
-      const res = await client.remove(ctx)
-      p.log.success(`${client.name}: ${res.actions.length ? res.actions.join('; ') : 'nothing to remove'}`)
-      for (const b of res.backups || []) p.log.message(`  backup: ${b}`)
-      for (const w of res.warnings || []) p.log.warn(`  ${w}`)
-      for (const n of res.next || []) p.log.info(`  ${n}`)
-    } catch (err) {
-      failed++
-      p.log.error(`${client.name}: ${err.message}`)
-    }
-  }
-  p.outro(`To revoke a key or a signed-in app, open ${KEYS_URL}.`)
-  return failed ? 1 : 0
-}
-
-export async function runDoctor(ctx, flags, { probe = probeEndpoint, check = checkKey } = {}) {
-  const report = { url: ctx.url, defaultUrl: DEFAULT_MCP_URL, endpoint: null, clients: [] }
-  report.endpoint = await probe(ctx.url)
-  const explicit = selectedFromFlags(flags)
-  const rows = explicit.length ? explicit.map((client) => ({ client, detected: safe(() => client.detect(ctx), { installed: false }) })) : detectAll(ctx).filter((d) => d.detected.installed)
-  for (const { client, detected } of rows) {
-    const row = { id: client.id, name: client.name, auth: client.auth, installed: detected.installed, configured: false, entries: [], problems: [], fixes: [] }
-    report.clients.push(row)
-    let st
-    try {
-      st = client.status(ctx)
-    } catch (err) {
-      row.problems.push(`cannot read config: ${err.message}`)
-      row.fixes.push(`fix or move aside ${client.configLocation(ctx)}, then: npx @simular-ai/box connect --client ${client.id}`)
-      continue
-    }
-    if (st.manual) {
-      row.manual = true
-      row.problems = []
-      row.fixes = []
-      row.notes = [`can't be checked from here: add or check the box connector in ${client.configLocation(ctx)} (URL ${ctx.url})`]
-      row.ok = true
-      continue
-    }
-    if (st.foreign) {
-      row.problems.push(`a server named "${ctx.name}" in ${st.foreign.where} points at ${st.foreign.url}, which is not box by Simular`)
-      row.fixes.push(`npx @simular-ai/box connect --client ${client.id} --name simular-box`)
-    }
-    row.entries = st.entries.map(({ where, url, enabled }) => ({ where, url: url || null, enabled: enabled !== false }))
-    row.configured = st.entries.length > 0
-    const keyMode = st.entries.some((e) => e.mode === 'key')
-    const nameFlag = ctx.name !== 'box' ? ` --name ${ctx.name}` : ''
-    const fix = `npx @simular-ai/box connect --client ${client.id}${nameFlag}${keyMode ? ' --auth key' : ''}`
-    if (!row.configured && !st.foreign) {
-      row.problems.push('box is not configured')
-      row.fixes.push(fix)
-    }
-    for (const e of st.entries) {
-      if (e.url && isOldUrl(e.url, ctx.url)) {
-        row.problems.push(`${e.where} points at ${e.url}, box's old address, which no longer signs in; box is now at ${ctx.url}`)
-        row.fixes.push(fix)
-      } else if (e.url && e.url !== ctx.url) {
-        row.problems.push(`${e.where} points at ${e.url}, not ${ctx.url}`)
-        row.fixes.push(fix)
-      }
-      if (e.enabled === false) {
-        row.problems.push(`${e.where} is disabled`)
-        row.fixes.push(fix)
-      }
-    }
-    if (st.entries.length > 1) row.problems.push(`box is configured ${st.entries.length} times; the app may show it twice`)
-    if (st.legacy.length) {
-      row.problems.push(`old server ${st.legacy.join(', ')} is still configured`)
-      row.fixes.push(fix)
-    }
-    for (const w of st.warnings || []) row.problems.push(w)
-    for (const f of st.fixes || []) row.fixes.push(f)
-    if (keyMode || client.auth === 'key' || st.key) {
-      if (!st.key) {
-        row.key = { configured: false }
-        if (row.configured) {
-          row.problems.push('no personal key is configured')
-          row.fixes.push(`create a key at ${KEYS_URL}, then: ${KEY_ENV}=cb_... npx @simular-ai/box connect --client ${client.id} --auth key`)
-        }
-      } else if (report.endpoint.ok || report.endpoint.status) {
-        const r = await check(ctx.url, st.key)
-        row.key = { configured: true, valid: r.valid, status: r.status }
-        if (r.valid === false) {
-          row.problems.push(`the configured key was rejected (${r.error})`)
-          row.fixes.push(`create a new key at ${KEYS_URL}, then: ${KEY_ENV}=cb_... npx @simular-ai/box connect --client ${client.id} --auth key`)
-        } else if (r.valid === null) row.problems.push(`could not check the key: ${r.error}`)
-      } else row.key = { configured: true, valid: null }
-    }
-    row.fixes = [...new Set(row.fixes)]
-    row.ok = row.problems.length === 0
-  }
-  report.ok = report.endpoint.ok && report.clients.every((c) => c.ok)
-  return report
-}
-
-async function doctor(ctx, flags, { stdout }) {
-  const report = await runDoctor(ctx, flags)
-  if (flags.json) {
-    stdout.write(JSON.stringify(report, null, 2) + '\n')
-    return report.ok ? 0 : 1
-  }
-  p.intro('box doctor')
-  if (ctx.url !== DEFAULT_MCP_URL) p.log.info(`BOX_MCP_URL is set: checking ${ctx.url}`)
-  const ep = report.endpoint
-  if (ep.ok) p.log.success(`Endpoint ${ep.url} is up (401 + sign-in metadata, authorization server ${ep.authorizationServer})`)
-  else p.log.error(`Endpoint: ${ep.error}. Check your network or proxy; status: https://box.simular.ai`)
-  if (!report.clients.length) p.log.warn('No supported AI apps found.')
-  for (const c of report.clients) {
-    const lines = []
-    for (const e of c.entries) lines.push(`${e.where} -> ${e.url || '(url unknown)'}`)
-    if (c.key) lines.push(`personal key: ${c.key.configured ? (c.key.valid === true ? 'valid' : c.key.valid === false ? 'rejected' : 'not checked') : 'none'}`)
-    for (const pr of c.problems) lines.push(`problem: ${pr}`)
-    for (const f of c.fixes) lines.push(`fix: ${f}`)
-    for (const n of c.notes || []) lines.push(n)
-    const how = c.manual ? 'connector in the app' : c.key ? 'personal key' : 'OAuth'
-    const msg = `${c.name} (${how})\n${lines.map((l) => `  ${l}`).join('\n')}`
-    if (c.ok) p.log.success(msg)
-    else p.log.warn(msg)
-  }
-  if (report.clients.some((c) => !c.manual && !c.key)) p.log.info('OAuth sign-ins are kept by each app, so doctor cannot see them: if box asks you to sign in, do it in that app.')
-  p.outro(report.ok ? 'All good.' : `Something needs fixing (above). Help: ${SUPPORT_EMAIL}`)
-  return report.ok ? 0 : 1
-}
diff --git a/cli/src/clients/claude-code.js b/cli/src/clients/claude-code.js
deleted file mode 100644
index 4838f5b..0000000
--- a/cli/src/clients/claude-code.js
+++ /dev/null
@@ -1,202 +0,0 @@
-// Claude Code. Uses Claude Code's own CLI, never edits ~/.claude.json directly.
-// Default URL: installs this repo's claude/ plugin (box MCP server + the box skill) from the
-// `simular-box` marketplace. With BOX_MCP_URL set, the plugin's pinned URL would be wrong, so a
-// user-scope server is added with `claude mcp add` instead.
-// Docs: https://code.claude.com/docs/en/mcp , https://code.claude.com/docs/en/plugins
-import fs from 'node:fs'
-import path from 'node:path'
-import { DEFAULT_MCP_URL, ForeignServerError, LEGACY_SERVER_NAMES, SERVER_NAME } from '../constants.js'
-
-const MARKETPLACE_SOURCE = 'simular-ai/box-plugin'
-const MARKETPLACE = 'simular-box'
-const PLUGIN = `simular-box@${MARKETPLACE}`
-// The plugin was called `box` until 2026-11; the Claude plugin directory already had a `box`.
-// connect replaces an installed old plugin with the new one, and remove takes both.
-const LEGACY_PLUGINS = [`box@${MARKETPLACE}`]
-
-function configDir(ctx) {
-  return ctx.env.CLAUDE_CONFIG_DIR || path.join(ctx.home, '.claude')
-}
-
-function userConfigFile(ctx) {
-  return ctx.env.CLAUDE_CONFIG_DIR ? path.join(ctx.env.CLAUDE_CONFIG_DIR, '.claude.json') : path.join(ctx.home, '.claude.json')
-}
-
-function readUserServers(ctx) {
-  try {
-    return JSON.parse(fs.readFileSync(userConfigFile(ctx), 'utf8')).mcpServers || {}
-  } catch {
-    return {}
-  }
-}
-
-function listPlugins(ctx) {
-  const res = ctx.run('claude', ['plugin', 'list', '--json'])
-  if (res.status !== 0) return []
-  try {
-    return JSON.parse(res.stdout)
-  } catch {
-    return []
-  }
-}
-
-function pluginState(ctx) {
-  return listPlugins(ctx).find((p) => p.id === PLUGIN) || null
-}
-
-function legacyPlugins(ctx) {
-  return listPlugins(ctx).filter((p) => LEGACY_PLUGINS.includes(p.id))
-}
-
-function scopeArgs(plugin) {
-  return ['user', 'project', 'local'].includes(plugin.scope) ? ['--scope', plugin.scope] : []
-}
-
-function must(res, what) {
-  if (res.status !== 0) throw new Error(`${what} failed: ${(res.stderr || res.stdout).trim().split('\n').pop()}`)
-}
-
-export default {
-  id: 'claude-code',
-  name: 'Claude Code',
-  auth: 'oauth',
-
-  detect(ctx) {
-    if (ctx.which('claude')) return { installed: true, via: 'claude on PATH' }
-    if (fs.existsSync(configDir(ctx))) return { installed: true, via: configDir(ctx), cliMissing: true }
-    return { installed: false }
-  },
-
-  configLocation(ctx) {
-    return userConfigFile(ctx)
-  },
-
-  status(ctx) {
-    const user = readUserServers(ctx)
-    const mine = (n) => user[n] && ctx.ours(user[n].url)
-    const hasClaude = ctx.which('claude')
-    const plugin = hasClaude ? pluginState(ctx) : null
-    const old = hasClaude ? legacyPlugins(ctx) : []
-    const entries = []
-    // A disabled plugin next to a user-scope server is how connect sets up a BOX_MCP_URL override.
-    if (plugin && (plugin.enabled || !mine(ctx.name))) {
-      entries.push({ where: `plugin ${PLUGIN}${plugin.enabled ? '' : ' (disabled)'}`, url: plugin.mcpServers?.box?.url, enabled: plugin.enabled })
-    }
-    // An old-named plugin still serves box (and its URL tells connect whether box moved).
-    for (const p of old.filter((p) => p.enabled)) entries.push({ where: `plugin ${p.id}`, url: p.mcpServers?.box?.url, enabled: true })
-    if (mine(ctx.name)) entries.push({ where: `user scope in ${userConfigFile(ctx)}`, url: user[ctx.name].url, enabled: true })
-    // The plugin's server is named plugin:simular-box:box, so a foreign user-scope `box` only
-    // matters when connect would add a user-scope server itself (BOX_MCP_URL set).
-    const foreign = user[ctx.name] && !mine(ctx.name) && ctx.url !== DEFAULT_MCP_URL ? { where: userConfigFile(ctx), url: user[ctx.name].url } : undefined
-    const legacy = [...LEGACY_SERVER_NAMES.filter(mine), ...old.map((p) => `plugin ${p.id}`)]
-    return { entries, legacy, keyConfigured: false, foreign }
-  },
-
-  connect(ctx) {
-    if (!ctx.which('claude')) throw new Error('the `claude` command is not on PATH; install Claude Code first (https://code.claude.com)')
-    const actions = []
-    let updated = false
-    const user = readUserServers(ctx)
-    const mine = (n) => user[n] && ctx.ours(user[n].url)
-    if (ctx.url !== DEFAULT_MCP_URL && user[ctx.name] && !mine(ctx.name)) {
-      throw new ForeignServerError(`Claude Code (user scope, ${userConfigFile(ctx)})`, ctx.name, user[ctx.name].url || user[ctx.name].command)
-    }
-    // `claude mcp remove/add` edit ~/.claude.json; Claude Code keeps its own backups of it
-    // under ~/.claude/backups.
-    for (const name of LEGACY_SERVER_NAMES.filter(mine)) {
-      if (!ctx.dryRun) ctx.run('claude', ['mcp', 'remove', '--scope', 'user', name])
-      actions.push(`removed old server ${name}`)
-    }
-
-    if (ctx.url === DEFAULT_MCP_URL) {
-      const plugin = pluginState(ctx)
-      if (!plugin) {
-        if (!ctx.dryRun) {
-          const list = ctx.run('claude', ['plugin', 'marketplace', 'list', '--json'])
-          if (!list.stdout.includes(`"${MARKETPLACE}"`)) {
-            must(ctx.run('claude', ['plugin', 'marketplace', 'add', MARKETPLACE_SOURCE], { timeoutMs: 180000 }), 'claude plugin marketplace add')
-          } else {
-            // A marketplace added before the rename lists only the old plugin name.
-            must(ctx.run('claude', ['plugin', 'marketplace', 'update', MARKETPLACE], { timeoutMs: 180000 }), 'claude plugin marketplace update')
-          }
-          must(ctx.run('claude', ['plugin', 'install', PLUGIN, '--scope', 'user'], { timeoutMs: 180000 }), 'claude plugin install')
-        }
-        actions.push(`installed plugin ${PLUGIN} (box server + box skill)`)
-      } else {
-        // Claude Code doesn't auto-update third-party marketplaces, so a plugin installed before
-        // box moved keeps the old URL until the marketplace and the plugin are updated.
-        const pinned = plugin.mcpServers?.box?.url
-        if (pinned && pinned !== DEFAULT_MCP_URL) {
-          if (!ctx.dryRun) {
-            must(ctx.run('claude', ['plugin', 'marketplace', 'update', MARKETPLACE], { timeoutMs: 180000 }), 'claude plugin marketplace update')
-            must(ctx.run('claude', ['plugin', 'update', PLUGIN, ...scopeArgs(plugin)], { timeoutMs: 180000 }), 'claude plugin update')
-            const now = pluginState(ctx)?.mcpServers?.box?.url
-            if (now !== DEFAULT_MCP_URL) {
-              throw new Error(
-                `the ${PLUGIN} plugin still points at ${now || 'an unknown URL'} after an update; its marketplace "${MARKETPLACE}" may not come from ${MARKETPLACE_SOURCE}. ` +
-                  `Run \`claude plugin uninstall ${PLUGIN}\` and \`claude plugin marketplace remove ${MARKETPLACE}\`, then connect again`,
-              )
-            }
-          }
-          actions.push(`${ctx.dryRun ? 'would update' : 'updated'} plugin ${PLUGIN} (box server now at ${DEFAULT_MCP_URL})`)
-          updated = true
-        }
-        if (!plugin.enabled) {
-          if (!ctx.dryRun) must(ctx.run('claude', ['plugin', 'enable', PLUGIN]), 'claude plugin enable')
-          actions.push(`enabled plugin ${PLUGIN}`)
-        }
-      }
-      // Our own user-scope box next to the plugin would show box twice. Someone else's stays.
-      if (mine(SERVER_NAME)) {
-        if (!ctx.dryRun) ctx.run('claude', ['mcp', 'remove', '--scope', 'user', SERVER_NAME])
-        actions.push('removed the user-scope box server (the plugin provides it)')
-      }
-    } else {
-      const current = user[ctx.name]
-      if (!current || current.url !== ctx.url || current.type !== 'http') {
-        if (!ctx.dryRun) {
-          if (current) ctx.run('claude', ['mcp', 'remove', '--scope', 'user', ctx.name])
-          must(ctx.run('claude', ['mcp', 'add', '--scope', 'user', '--transport', 'http', ctx.name, ctx.url]), 'claude mcp add')
-        }
-        actions.push(`added user-scope server ${ctx.name} -> ${ctx.url}`)
-      }
-      const plugin = pluginState(ctx)
-      if (plugin?.enabled) {
-        if (!ctx.dryRun) ctx.run('claude', ['plugin', 'disable', PLUGIN])
-        actions.push(`disabled plugin ${PLUGIN} (it points at the default URL)`)
-      }
-    }
-    // The old-named plugin goes on either route, and only once box is set up the new way, so a
-    // failed install leaves the user with the old plugin rather than with no box at all.
-    for (const p of legacyPlugins(ctx)) {
-      if (!ctx.dryRun) must(ctx.run('claude', ['plugin', 'uninstall', p.id, ...scopeArgs(p)]), 'claude plugin uninstall')
-      actions.push(`${ctx.dryRun ? 'would uninstall' : 'uninstalled'} old plugin ${p.id}`)
-    }
-    const label = ctx.url === DEFAULT_MCP_URL ? 'plugin:simular-box:box' : ctx.name
-    return {
-      actions,
-      next: [`${updated ? 'Restart Claude Code (a plugin update applies on restart), then run' : 'Start Claude Code, run'} /mcp, pick ${label} and choose Authenticate; sign in and click Approve in the browser.`],
-    }
-  },
-
-  remove(ctx) {
-    if (!ctx.which('claude')) throw new Error('the `claude` command is not on PATH')
-    const actions = []
-    const warnings = []
-    const user = readUserServers(ctx)
-    for (const name of [...new Set([ctx.name, SERVER_NAME, ...LEGACY_SERVER_NAMES])]) {
-      if (!user[name]) continue
-      if (!ctx.ours(user[name].url)) {
-        if (name === ctx.name) warnings.push(`left user-scope server ${name}: it points at ${user[name].url || user[name].command}, not box by Simular`)
-        continue
-      }
-      if (!ctx.dryRun) ctx.run('claude', ['mcp', 'remove', '--scope', 'user', name])
-      actions.push(`${ctx.dryRun ? 'would remove' : 'removed'} user-scope server ${name}`)
-    }
-    for (const p of listPlugins(ctx).filter((p) => p.id === PLUGIN || LEGACY_PLUGINS.includes(p.id))) {
-      if (!ctx.dryRun) must(ctx.run('claude', ['plugin', 'uninstall', p.id, ...scopeArgs(p)]), 'claude plugin uninstall')
-      actions.push(`${ctx.dryRun ? 'would uninstall' : 'uninstalled'} plugin ${p.id}`)
-    }
-    return { actions, warnings, next: [] }
-  },
-}
diff --git a/cli/src/clients/claude-desktop.js b/cli/src/clients/claude-desktop.js
deleted file mode 100644
index 68c619d..0000000
--- a/cli/src/clients/claude-desktop.js
+++ /dev/null
@@ -1,36 +0,0 @@
-// Claude Desktop and claude.ai: remote servers are added as custom connectors in the app, not in
-// claude_desktop_config.json (that file only takes local stdio servers). We can't add a connector
-// for the user, so `connect` prints the steps and writes nothing.
-// Docs: https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp
-import fs from 'node:fs'
-import path from 'node:path'
-
-const appDir = (ctx) => path.join(ctx.appData, 'Claude')
-
-export default {
-  id: 'claude-desktop',
-  name: 'Claude Desktop',
-  auth: 'oauth',
-  manual: true,
-  aliases: ['claude-ai', 'claude.ai'],
-  detect(ctx) {
-    if (fs.existsSync(appDir(ctx))) return { installed: true, via: appDir(ctx) }
-    if (ctx.platform === 'darwin' && fs.existsSync('/Applications/Claude.app')) return { installed: true, via: '/Applications/Claude.app' }
-    return { installed: false }
-  },
-  configLocation() {
-    return 'Settings -> Connectors in the Claude app'
-  },
-  status() {
-    return { entries: [], legacy: [], keyConfigured: false, manual: true }
-  },
-  connect(ctx) {
-    return {
-      actions: ['nothing written: Claude Desktop adds remote servers as connectors in the app'],
-      next: [`Open Settings -> Connectors -> Add custom connector, name it box, paste ${ctx.url}, click Connect, sign in and Approve.`],
-    }
-  },
-  remove() {
-    return { actions: [], next: ['Remove the box connector in Settings -> Connectors.'] }
-  },
-}
diff --git a/cli/src/clients/codex.js b/cli/src/clients/codex.js
deleted file mode 100644
index 4c42944..0000000
--- a/cli/src/clients/codex.js
+++ /dev/null
@@ -1,92 +0,0 @@
-// Codex CLI: $CODEX_HOME/config.toml (default ~/.codex), `[mcp_servers.box]` with `url`.
-// Codex runs OAuth itself (`codex mcp login box`). We edit the TOML instead of running
-// `codex mcp add`, because `add` starts the browser sign-in inline and would block a scripted run.
-// Sources: https://github.com/openai/codex/blob/main/codex-rs/cli/src/mcp_cmd.rs ,
-// https://github.com/openai/codex/blob/main/codex-rs/config/src/mcp_types.rs
-import fs from 'node:fs'
-import path from 'node:path'
-import { ForeignServerError, LEGACY_SERVER_NAMES } from '../constants.js'
-import { readText, updateFile } from '../fsutil.js'
-import { parseToml, removeTomlServers, upsertTomlServer } from '../formats.js'
-
-const home = (ctx) => ctx.env.CODEX_HOME || path.join(ctx.home, '.codex')
-const file = (ctx) => path.join(home(ctx), 'config.toml')
-const servers = (ctx) => parseToml(readText(file(ctx)), file(ctx)).mcp_servers || {}
-const ourLegacy = (ctx, map) => LEGACY_SERVER_NAMES.filter((n) => map[n] && ctx.ours(map[n].url))
-
-// The Codex app (ChatGPT desktop) reads the same config.toml but ships no `codex` on PATH.
-function signInHint(ctx) {
-  if (ctx.which('codex')) return `Run \`codex mcp login ${ctx.name}\`, sign in in the browser and click Approve.`
-  return `Restart the Codex app, open Settings -> MCP servers and click Authenticate next to ${ctx.name}; sign in in the browser and click Approve.`
-}
-
-export default {
-  id: 'codex',
-  name: 'Codex',
-  auth: 'oauth',
-  aliases: ['codex-cli'],
-
-  detect(ctx) {
-    if (ctx.which('codex')) return { installed: true, via: 'codex on PATH' }
-    if (fs.existsSync(home(ctx))) return { installed: true, via: home(ctx), cliMissing: true }
-    return { installed: false }
-  },
-
-  configLocation: file,
-
-  status(ctx) {
-    const f = file(ctx)
-    const map = servers(ctx)
-    const box = map[ctx.name]
-    if (box && !ctx.ours(box.url)) return { entries: [], legacy: [], keyConfigured: false, foreign: { where: f, url: box.url || box.command } }
-    const warnings = []
-    if (box && (box.bearer_token_env_var || box.http_headers || box.env_http_headers)) {
-      warnings.push('box has a bearer token or headers set; Codex then skips OAuth. Re-run connect to reset it')
-    }
-    return {
-      entries: box ? [{ where: f, url: box.url, enabled: box.enabled !== false }] : [],
-      legacy: ourLegacy(ctx, map),
-      keyConfigured: false,
-      warnings,
-    }
-  },
-
-  connect(ctx) {
-    const f = file(ctx)
-    const map = servers(ctx)
-    const current = map[ctx.name]
-    if (current && !ctx.ours(current.url)) throw new ForeignServerError(f, ctx.name, current.url || current.command)
-    const res = updateFile(f, (text) => upsertTomlServer(text, ctx.name, { url: ctx.url }, { legacy: ourLegacy(ctx, map), file: f }), {
-      dryRun: ctx.dryRun,
-    })
-    return {
-      actions: res.changed ? [`${ctx.dryRun ? 'would write' : 'wrote'} [mcp_servers.${ctx.name}] to ${f}`] : [],
-      backups: res.backup ? [res.backup] : [],
-      next: [signInHint(ctx)],
-    }
-  },
-
-  /** Shown when config.toml cannot be written (EACCES/EPERM, "Access is denied" on Windows). */
-  permissionHelp(ctx) {
-    return [
-      `If the Codex app holds the file, add box there instead: Settings -> MCP servers -> Add server, name it ${ctx.name}, choose Streamable HTTP, paste ${ctx.url} as the URL and click Save.`,
-      `Restart Codex, then click Authenticate next to ${ctx.name}, sign in in the browser and click Approve.`,
-    ]
-  },
-
-  remove(ctx) {
-    const f = file(ctx)
-    const map = servers(ctx)
-    const names = [ctx.name, ...LEGACY_SERVER_NAMES].filter((n) => map[n] && ctx.ours(map[n].url))
-    const warnings = map[ctx.name] && !names.includes(ctx.name) ? [`left [mcp_servers.${ctx.name}] in ${f}: it is not box by Simular`] : []
-    // Drop the stored sign-in too, while Codex still knows the server (best effort).
-    if (names.includes(ctx.name) && !ctx.dryRun && ctx.which('codex')) ctx.run('codex', ['mcp', 'logout', ctx.name], { timeoutMs: 30000 })
-    const res = updateFile(f, (text) => removeTomlServers(text, names, { file: f }), { dryRun: ctx.dryRun })
-    return {
-      actions: res.changed ? [`${ctx.dryRun ? 'would remove' : 'removed'} ${names.map((n) => `[mcp_servers.${n}]`).join(', ')} from ${f}`] : [],
-      backups: res.backup ? [res.backup] : [],
-      warnings,
-      next: [],
-    }
-  },
-}
diff --git a/cli/src/clients/cursor.js b/cli/src/clients/cursor.js
deleted file mode 100644
index adbd730..0000000
--- a/cli/src/clients/cursor.js
+++ /dev/null
@@ -1,16 +0,0 @@
-// Cursor: ~/.cursor/mcp.json, `mcpServers`. Cursor signs in to remote servers with OAuth
-// (DCR + PKCE) itself. Docs: https://cursor.com/docs/context/mcp
-import path from 'node:path'
-import { jsonClient } from './json-client.js'
-
-export default jsonClient({
-  id: 'cursor',
-  name: 'Cursor',
-  auth: 'oauth',
-  file: (ctx) => path.join(ctx.home, '.cursor', 'mcp.json'),
-  container: ['mcpServers'],
-  entry: (ctx) => ({ url: ctx.url }),
-  bins: ['cursor', 'agent', 'cursor-agent'],
-  dirs: (ctx) => [path.join(ctx.home, '.cursor'), ...(ctx.platform === 'darwin' ? ['/Applications/Cursor.app'] : [])],
-  next: (ctx) => [`Open Cursor Settings -> MCP (Tools & MCP) and click Login next to ${ctx.name}; sign in and click Approve.`],
-})
diff --git a/cli/src/clients/gemini-cli.js b/cli/src/clients/gemini-cli.js
deleted file mode 100644
index 9200e2c..0000000
--- a/cli/src/clients/gemini-cli.js
+++ /dev/null
@@ -1,21 +0,0 @@
-// Gemini CLI: ~/.gemini/settings.json, `mcpServers`, `{ type: "http", url }` (streamable HTTP).
-// On a 401 Gemini CLI marks the server as needing OAuth; `/mcp auth box` discovers the sign-in
-// from the WWW-Authenticate header and runs it. MCP servers load only in a trusted folder.
-// Docs: https://github.com/google-gemini/gemini-cli/blob/main/docs/tools/mcp-server.md
-import path from 'node:path'
-import { jsonClient } from './json-client.js'
-
-export default jsonClient({
-  id: 'gemini-cli',
-  name: 'Gemini CLI',
-  auth: 'oauth',
-  aliases: ['gemini'],
-  file: (ctx) => path.join(ctx.home, '.gemini', 'settings.json'),
-  container: ['mcpServers'],
-  entry: (ctx) => ({ type: 'http', url: ctx.url }),
-  // Gemini CLI also reads `httpUrl` (its older field for streamable HTTP).
-  entryUrl: (e) => e?.url ?? e?.httpUrl,
-  bins: ['gemini'],
-  dirs: (ctx) => [path.join(ctx.home, '.gemini')],
-  next: (ctx) => [`Start Gemini CLI in a trusted folder, run \`/mcp auth ${ctx.name}\`, sign in in the browser and click Approve.`],
-})
diff --git a/cli/src/clients/hermes.js b/cli/src/clients/hermes.js
deleted file mode 100644
index b5d2d61..0000000
--- a/cli/src/clients/hermes.js
+++ /dev/null
@@ -1,123 +0,0 @@
-// Hermes Agent: $HERMES_HOME/config.yaml (default ~/.hermes), `mcp_servers.box`.
-// OAuth (default): `{url, auth: oauth}`; Hermes signs in with `hermes mcp login box`.
-// Personal key (--auth key, for always-on servers): the header references ${MCP_BOX_API_KEY}, the
-// name `hermes mcp add --auth header` itself uses, and the key goes to $HERMES_HOME/.env (0600),
-// where Hermes loads secrets from. A running gateway caches the old key, so it is restarted.
-// We write the YAML directly because `hermes mcp add` is interactive and cancels without a TTY.
-// Sources: https://github.com/NousResearch/hermes-agent/blob/main/hermes_cli/mcp_config.py ,
-// https://github.com/NousResearch/hermes-agent/blob/main/tools/mcp_tool.py ,
-// https://github.com/NousResearch/hermes-agent/blob/main/hermes_constants.py
-import fs from 'node:fs'
-import path from 'node:path'
-import { ForeignServerError, LEGACY_SERVER_NAMES } from '../constants.js'
-import { readText, updateFile } from '../fsutil.js'
-import { readEnvValue, readYaml, removeEnvValue, removeYamlServers, upsertEnvValue, upsertYamlServer } from '../formats.js'
-
-export const HERMES_KEY_ENV = 'MCP_BOX_API_KEY'
-const KEY_REF = `Bearer \${${HERMES_KEY_ENV}}`
-
-function home(ctx) {
-  if (ctx.env.HERMES_HOME) return ctx.env.HERMES_HOME
-  if (ctx.platform === 'win32' && ctx.env.LOCALAPPDATA) return path.join(ctx.env.LOCALAPPDATA, 'hermes')
-  return path.join(ctx.home, '.hermes')
-}
-const configFile = (ctx) => path.join(home(ctx), 'config.yaml')
-const envFile = (ctx) => path.join(home(ctx), '.env')
-
-function serverEntry(ctx) {
-  const f = configFile(ctx)
-  return readYaml(readText(f), f).mcp_servers || {}
-}
-const ourLegacy = (ctx, map) => LEGACY_SERVER_NAMES.filter((n) => map[n] && ctx.ours(map[n].url))
-
-export default {
-  id: 'hermes',
-  name: 'Hermes Agent',
-  auth: 'oauth',
-  supportsKey: true,
-
-  detect(ctx) {
-    if (ctx.which('hermes')) return { installed: true, via: 'hermes on PATH' }
-    if (fs.existsSync(home(ctx))) return { installed: true, via: home(ctx), cliMissing: true }
-    return { installed: false }
-  },
-
-  configLocation: configFile,
-
-  status(ctx) {
-    const servers = serverEntry(ctx)
-    const box = servers[ctx.name]
-    if (box && !ctx.ours(box.url)) return { entries: [], legacy: [], keyConfigured: false, foreign: { where: configFile(ctx), url: box.url || box.command } }
-    const usesKey = Boolean(box?.headers && JSON.stringify(box.headers).includes(HERMES_KEY_ENV))
-    const key = usesKey ? readEnvValue(readText(envFile(ctx)), HERMES_KEY_ENV) || ctx.env[HERMES_KEY_ENV] : undefined
-    const warnings = []
-    if (usesKey && !key) warnings.push(`box reads ${HERMES_KEY_ENV}, but it is not set in ${envFile(ctx)}`)
-    return {
-      entries: box ? [{ where: configFile(ctx), url: box.url, enabled: box.enabled !== false, mode: usesKey ? 'key' : 'oauth' }] : [],
-      legacy: ourLegacy(ctx, servers),
-      key,
-      keyConfigured: Boolean(key),
-      warnings,
-    }
-  },
-
-  connect(ctx, { mode = 'oauth', key } = {}) {
-    const f = configFile(ctx)
-    const servers = serverEntry(ctx)
-    if (servers[ctx.name] && !ctx.ours(servers[ctx.name].url)) throw new ForeignServerError(f, ctx.name, servers[ctx.name].url || servers[ctx.name].command)
-    const entry =
-      mode === 'key'
-        ? { url: ctx.url, headers: { Authorization: KEY_REF }, enabled: true }
-        : { url: ctx.url, auth: 'oauth', enabled: true }
-    const actions = []
-    const backups = []
-    const next = []
-    let keyChanged = false
-    if (mode === 'key') {
-      const useKey = key || this.status(ctx).key
-      if (!useKey) throw new Error('a personal key is needed')
-      const r = updateFile(envFile(ctx), (text) => upsertEnvValue(text, HERMES_KEY_ENV, useKey), { mode: 0o600, dryRun: ctx.dryRun, secret: true })
-      if (r.changed) {
-        keyChanged = true
-        actions.push(`${ctx.dryRun ? 'would save' : 'saved'} the key as ${HERMES_KEY_ENV} in ${envFile(ctx)} (no backup of that file is kept: it holds keys)`)
-      }
-      if (r.backup) backups.push(r.backup)
-    }
-    const r = updateFile(f, (text) => upsertYamlServer(text, 'mcp_servers', ctx.name, entry, { legacy: ourLegacy(ctx, servers), file: f }), {
-      dryRun: ctx.dryRun,
-    })
-    if (r.changed) actions.push(`${ctx.dryRun ? 'would write' : 'wrote'} mcp_servers.${ctx.name} (${mode === 'key' ? 'personal key' : 'OAuth'}) to ${f}`)
-    if (r.backup) backups.push(r.backup)
-
-    if (mode === 'oauth') next.push(`Run \`hermes mcp login ${ctx.name}\`, sign in in the browser and click Approve (on a server without a browser: \`hermes mcp login ${ctx.name} --flow device\`, or use --auth key).`)
-    if ((keyChanged || r.changed) && !ctx.dryRun) {
-      // A running gateway keeps the old config and key until it restarts.
-      if (ctx.which('hermes')) {
-        const st = ctx.run('hermes', ['gateway', 'status'], { timeoutMs: 20000 })
-        if (st.status === 0 && /running/i.test(st.stdout) && !/not running/i.test(st.stdout)) {
-          const rr = ctx.run('hermes', ['gateway', 'restart'], { timeoutMs: 60000 })
-          if (rr.status === 0) actions.push('restarted the Hermes gateway so it picks up the change')
-          else next.push('Run `hermes gateway restart` so the gateway picks up the change.')
-        }
-      } else next.push('If a Hermes gateway is running, run `hermes gateway restart` so it picks up the change.')
-    }
-    next.push('In an open Hermes chat, run /reload-mcp (or start a new session).')
-    return { actions, backups, next }
-  },
-
-  remove(ctx) {
-    const actions = []
-    const backups = []
-    const f = configFile(ctx)
-    const servers = serverEntry(ctx)
-    const names = [ctx.name, ...LEGACY_SERVER_NAMES].filter((n) => servers[n] && ctx.ours(servers[n].url))
-    const warnings = servers[ctx.name] && !names.includes(ctx.name) ? [`left mcp_servers.${ctx.name} in ${f}: it is not box by Simular`] : []
-    const r = updateFile(f, (text) => removeYamlServers(text, 'mcp_servers', names, { file: f }), { dryRun: ctx.dryRun })
-    if (r.changed) actions.push(`${ctx.dryRun ? 'would remove' : 'removed'} mcp_servers.${names.join(', ')} from ${f}`)
-    if (r.backup) backups.push(r.backup)
-    const e = updateFile(envFile(ctx), (text) => removeEnvValue(text, HERMES_KEY_ENV), { dryRun: ctx.dryRun, secret: true })
-    if (e.changed) actions.push(`${ctx.dryRun ? 'would remove' : 'removed'} ${HERMES_KEY_ENV} from ${envFile(ctx)}`)
-    if (e.backup) backups.push(e.backup)
-    return { actions, backups, warnings, next: actions.length ? ['Run `hermes gateway restart` if a gateway is running.'] : [] }
-  },
-}
diff --git a/cli/src/clients/index.js b/cli/src/clients/index.js
deleted file mode 100644
index c5e5ad8..0000000
--- a/cli/src/clients/index.js
+++ /dev/null
@@ -1,19 +0,0 @@
-import claudeCode from './claude-code.js'
-import claudeDesktop from './claude-desktop.js'
-import codex from './codex.js'
-import cursor from './cursor.js'
-import geminiCli from './gemini-cli.js'
-import hermes from './hermes.js'
-import openclaw from './openclaw.js'
-import opencode from './opencode.js'
-import vscode from './vscode.js'
-
-export const CLIENTS = [claudeCode, codex, cursor, opencode, geminiCli, hermes, openclaw, vscode, claudeDesktop]
-
-const ALIASES = { claude: 'claude-code', 'claude-code-cli': 'claude-code' }
-
-export function findClient(id) {
-  const key = String(id).toLowerCase()
-  const target = ALIASES[key] || key
-  return CLIENTS.find((c) => c.id === target || (c.aliases || []).includes(target))
-}
diff --git a/cli/src/clients/json-client.js b/cli/src/clients/json-client.js
deleted file mode 100644
index fee79c8..0000000
--- a/cli/src/clients/json-client.js
+++ /dev/null
@@ -1,89 +0,0 @@
-// Shared logic for clients whose config is a JSON/JSONC file with a map of servers.
-import fs from 'node:fs'
-import { ForeignServerError, LEGACY_SERVER_NAMES } from '../constants.js'
-import { readText, updateFile } from '../fsutil.js'
-import { getPath, parseJsonc, removeJsonServer, upsertJsonServer } from '../formats.js'
-
-/**
- * @param {object} spec
- * @param {string} spec.id
- * @param {string} spec.name
- * @param {'oauth'} spec.auth
- * @param {(ctx) => string} spec.file          config file path
- * @param {string[]} spec.container             JSON path of the servers map
- * @param {(ctx) => object} spec.entry          the box entry to write
- * @param {(entry) => string|undefined} [spec.entryUrl]
- * @param {string[]} [spec.bins]                binaries that mean "installed"
- * @param {(ctx) => string[]} [spec.dirs]       directories that mean "installed"
- * @param {string[]|((ctx) => string[])} [spec.next]
- * @param {object} [spec.signIn]              optional sign-in connect can run for the person (see opencode.js)
- */
-export function jsonClient(spec) {
-  const entryUrl = spec.entryUrl || ((e) => e?.url ?? e?.serverUrl)
-  const servers = (ctx) => {
-    const file = spec.file(ctx)
-    return getPath(parseJsonc(readText(file), file), spec.container) || {}
-  }
-  // Only entries that point at box by Simular are ours to change or remove.
-  const ourLegacy = (ctx, map) => LEGACY_SERVER_NAMES.filter((n) => map[n] && ctx.ours(entryUrl(map[n])))
-
-  return {
-    id: spec.id,
-    name: spec.name,
-    auth: spec.auth,
-    aliases: spec.aliases || [],
-    signIn: spec.signIn,
-
-    detect(ctx) {
-      for (const bin of spec.bins || []) if (ctx.which(bin)) return { installed: true, via: `${bin} on PATH` }
-      for (const dir of spec.dirs ? spec.dirs(ctx) : []) if (fs.existsSync(dir)) return { installed: true, via: dir }
-      return { installed: false }
-    },
-
-    configLocation(ctx) {
-      return spec.file(ctx)
-    },
-
-    status(ctx) {
-      const file = spec.file(ctx)
-      const map = servers(ctx)
-      const entry = map[ctx.name]
-      if (entry && !ctx.ours(entryUrl(entry))) {
-        return { entries: [], legacy: [], keyConfigured: false, foreign: { where: file, url: entryUrl(entry) } }
-      }
-      return {
-        entries: entry ? [{ where: file, url: entryUrl(entry), enabled: entry.enabled !== false && entry.disabled !== true }] : [],
-        legacy: ourLegacy(ctx, map),
-        keyConfigured: false,
-      }
-    },
-
-    connect(ctx) {
-      const file = spec.file(ctx)
-      const map = servers(ctx)
-      if (map[ctx.name] && !ctx.ours(entryUrl(map[ctx.name]))) throw new ForeignServerError(file, ctx.name, entryUrl(map[ctx.name]))
-      const res = updateFile(file, (text) => upsertJsonServer(text, spec.container, ctx.name, spec.entry(ctx), { legacy: ourLegacy(ctx, map), file }), {
-        dryRun: ctx.dryRun,
-      })
-      return {
-        actions: res.changed ? [`${ctx.dryRun ? 'would write' : 'wrote'} ${ctx.name} to ${file}`] : [],
-        backups: res.backup ? [res.backup] : [],
-        next: typeof spec.next === 'function' ? spec.next(ctx) : spec.next || [],
-      }
-    },
-
-    remove(ctx) {
-      const file = spec.file(ctx)
-      const map = servers(ctx)
-      const names = [ctx.name, ...LEGACY_SERVER_NAMES].filter((n) => map[n] && ctx.ours(entryUrl(map[n])))
-      const warnings = map[ctx.name] && !names.includes(ctx.name) ? [`left "${ctx.name}" in ${file}: it points at ${entryUrl(map[ctx.name])}, not box by Simular`] : []
-      const res = updateFile(file, (text) => removeJsonServer(text, spec.container, names, { file }), { dryRun: ctx.dryRun })
-      return {
-        actions: res.changed ? [`${ctx.dryRun ? 'would remove' : 'removed'} ${names.join(', ')} from ${file}`] : [],
-        backups: res.backup ? [res.backup] : [],
-        warnings,
-        next: [],
-      }
-    },
-  }
-}
diff --git a/cli/src/clients/openclaw.js b/cli/src/clients/openclaw.js
deleted file mode 100644
index 2628fcb..0000000
--- a/cli/src/clients/openclaw.js
+++ /dev/null
@@ -1,172 +0,0 @@
-// OpenClaw: `mcp.servers.box` in openclaw.json (JSON5, managed by OpenClaw). Written through
-// OpenClaw's own `openclaw mcp set/show/unset`, so its config journal and paths stay right.
-// OAuth (default): `{url, transport: "streamable-http", auth: "oauth"}`, then `openclaw mcp login box`.
-// Without `transport` OpenClaw defaults to SSE, so it is always set.
-// Personal key (--auth key): the header is `Bearer ${BOX_TOKEN}` and the key goes to the state
-// dir's .env (0600). OpenClaw substitutes ${VAR} from its own process environment and sends the
-// placeholder literally when the variable is unset (the 401 seen in box-plugin#2): a Gateway
-// started by launchd/systemd never sees a shell export, but it does load <state dir>/.env, and
-// only at start, hence the restart.
-// Sources: https://github.com/openclaw/openclaw/blob/main/src/cli/mcp-cli.ts ,
-// https://github.com/openclaw/openclaw/blob/main/src/config/env-substitution.ts ,
-// https://github.com/openclaw/openclaw/blob/main/docs/help/environment.md
-import fs from 'node:fs'
-import path from 'node:path'
-import { ForeignServerError, KEY_ENV, LEGACY_SERVER_NAMES } from '../constants.js'
-import { readText, updateFile } from '../fsutil.js'
-import { parseJsonc, readEnvValue, removeEnvValue, sameValue, upsertEnvValue } from '../formats.js'
-
-const KEY_REF = `Bearer \${${KEY_ENV}}`
-
-function stateDir(ctx) {
-  if (ctx.env.OPENCLAW_STATE_DIR) return ctx.env.OPENCLAW_STATE_DIR
-  const base = ctx.env.OPENCLAW_HOME || ctx.home
-  const profile = (ctx.env.OPENCLAW_PROFILE || '').trim()
-  return path.join(base, profile && profile !== 'default' ? `.openclaw-${profile}` : '.openclaw')
-}
-const envFile = (ctx) => path.join(stateDir(ctx), '.env')
-const configFile = (ctx) => ctx.env.OPENCLAW_CONFIG_PATH || path.join(stateDir(ctx), 'openclaw.json')
-
-function show(ctx, name) {
-  const res = ctx.run('openclaw', ['mcp', 'show', name, '--json'], { timeoutMs: 30000 })
-  if (res.status !== 0) return undefined
-  try {
-    return JSON.parse(res.stdout.slice(res.stdout.indexOf('{')))
-  } catch {
-    return undefined
-  }
-}
-
-/**
- * The entry as written in the file. `openclaw mcp show` prints values with ${VAR} already
- * substituted (it would show the key), so compare and inspect the raw file when we can parse it;
- * OpenClaw itself writes plain JSON. Falls back to `show` for hand-written JSON5.
- */
-function rawEntry(ctx, name) {
-  const file = configFile(ctx)
-  const text = readText(file)
-  if (text === null) return { known: true, entry: undefined }
-  try {
-    return { known: true, entry: parseJsonc(text, file).mcp?.servers?.[name] }
-  } catch {
-    return { known: false, entry: show(ctx, name) }
-  }
-}
-
-function must(res, what) {
-  if (res.status === 0) return
-  const msg = (res.stderr || res.stdout).trim().split('\n').filter(Boolean).pop() || `exit ${res.status}`
-  if (/gateway/i.test(msg) && /running/i.test(msg)) {
-    throw new Error(`${what}: ${msg}. Run \`openclaw gateway stop\`, run connect again, then \`openclaw gateway start\``)
-  }
-  throw new Error(`${what} failed: ${msg}`)
-}
-
-function gatewayUp(ctx) {
-  return ctx.run('openclaw', ['gateway', 'health'], { timeoutMs: 20000 }).status === 0
-}
-
-export default {
-  id: 'openclaw',
-  name: 'OpenClaw',
-  auth: 'oauth',
-  supportsKey: true,
-
-  detect(ctx) {
-    if (ctx.which('openclaw')) return { installed: true, via: 'openclaw on PATH' }
-    if (fs.existsSync(stateDir(ctx))) return { installed: true, via: stateDir(ctx), cliMissing: true }
-    return { installed: false }
-  },
-
-  configLocation: configFile,
-
-  status(ctx) {
-    if (!ctx.which('openclaw')) throw new Error('the `openclaw` command is not on PATH, so its config cannot be read')
-    const box = rawEntry(ctx, ctx.name).entry
-    if (box && !ctx.ours(box.url)) return { entries: [], legacy: [], keyConfigured: false, foreign: { where: configFile(ctx), url: box.url || box.command } }
-    const legacy = LEGACY_SERVER_NAMES.filter((n) => ctx.ours(rawEntry(ctx, n).entry?.url))
-    const header = box?.headers?.Authorization || box?.headers?.authorization
-    const usesKeyRef = typeof header === 'string' && header.includes(`\${${KEY_ENV}}`)
-    const literal = typeof header === 'string' && /^Bearer\s+cb_/.test(header) ? header.replace(/^Bearer\s+/, '') : undefined
-    const key = literal || (usesKeyRef ? readEnvValue(readText(envFile(ctx)), KEY_ENV) : undefined)
-    const warnings = []
-    if (box && box.transport !== 'streamable-http') warnings.push(`box uses transport ${box.transport || 'sse (the default)'}; box needs streamable-http`)
-    if (usesKeyRef && !key) warnings.push(`box sends \${${KEY_ENV}}, but ${KEY_ENV} is not in ${envFile(ctx)}; OpenClaw would send the placeholder and get 401`)
-    if (literal) warnings.push('the key is written into openclaw.json in plain text; re-run connect to move it to .env')
-    return {
-      entries: box ? [{ where: configFile(ctx), url: box.url, enabled: box.enabled !== false, mode: header ? 'key' : 'oauth' }] : [],
-      legacy,
-      key,
-      keyConfigured: Boolean(key),
-      warnings,
-    }
-  },
-
-  connect(ctx, { mode = 'oauth', key } = {}) {
-    if (!ctx.which('openclaw')) throw new Error('the `openclaw` command is not on PATH; install OpenClaw first')
-    const current = rawEntry(ctx, ctx.name).entry
-    if (current && !ctx.ours(current.url)) throw new ForeignServerError(configFile(ctx), ctx.name, current.url || current.command)
-    const actions = []
-    const backups = []
-    const next = []
-    let keyChanged = false
-    if (mode === 'key') {
-      const useKey = key || readEnvValue(readText(envFile(ctx)), KEY_ENV)
-      if (!useKey) throw new Error('a personal key is needed')
-      const r = updateFile(envFile(ctx), (text) => upsertEnvValue(text, KEY_ENV, useKey), { mode: 0o600, dryRun: ctx.dryRun, secret: true })
-      if (r.changed) {
-        keyChanged = true
-        actions.push(`${ctx.dryRun ? 'would save' : 'saved'} the key as ${KEY_ENV} in ${envFile(ctx)} (no backup of that file is kept: it holds keys)`)
-      }
-      if (r.backup) backups.push(r.backup)
-    }
-    const entry =
-      mode === 'key'
-        ? { url: ctx.url, transport: 'streamable-http', headers: { Authorization: KEY_REF } }
-        : { url: ctx.url, transport: 'streamable-http', auth: 'oauth' }
-    let configChanged = false
-    if (!sameValue(current, entry)) {
-      if (!ctx.dryRun) must(ctx.run('openclaw', ['mcp', 'set', ctx.name, JSON.stringify(entry)], { timeoutMs: 60000 }), 'openclaw mcp set')
-      configChanged = true
-      actions.push(`${ctx.dryRun ? 'would set' : 'set'} mcp.servers.${ctx.name} (${mode === 'key' ? 'personal key from .env' : 'OAuth'}) via openclaw mcp set`)
-    }
-    for (const name of LEGACY_SERVER_NAMES) {
-      if (ctx.ours(rawEntry(ctx, name).entry?.url)) {
-        if (!ctx.dryRun) ctx.run('openclaw', ['mcp', 'unset', name])
-        actions.push(`removed old server ${name}`)
-      }
-    }
-    if (!ctx.dryRun && (configChanged || keyChanged)) {
-      if (keyChanged && gatewayUp(ctx)) {
-        // The Gateway reads .env only when it starts.
-        const rr = ctx.run('openclaw', ['gateway', 'restart'], { timeoutMs: 120000 })
-        if (rr.status === 0) actions.push('restarted the OpenClaw Gateway so it loads the key')
-        else next.push('Run `openclaw gateway restart` so the Gateway loads the key.')
-      } else if (configChanged) ctx.run('openclaw', ['mcp', 'reload'], { timeoutMs: 30000 })
-      if (keyChanged && !gatewayUp(ctx)) next.push('The key is read when the Gateway starts: `openclaw gateway start` (or restart it if it runs elsewhere).')
-    }
-    if (mode === 'oauth') next.push(`Run \`openclaw mcp login ${ctx.name}\`, sign in in the browser and click Approve. On a server without a browser, use --auth key instead.`)
-    return { actions, backups, next }
-  },
-
-  remove(ctx) {
-    if (!ctx.which('openclaw')) throw new Error('the `openclaw` command is not on PATH')
-    const actions = []
-    const backups = []
-    const warnings = []
-    for (const name of [ctx.name, ...LEGACY_SERVER_NAMES]) {
-      const entry = rawEntry(ctx, name).entry
-      if (entry === undefined) continue
-      if (!ctx.ours(entry.url)) {
-        if (name === ctx.name) warnings.push(`left mcp.servers.${name}: it is not box by Simular`)
-        continue
-      }
-      if (!ctx.dryRun) must(ctx.run('openclaw', ['mcp', 'unset', name]), 'openclaw mcp unset')
-      actions.push(`${ctx.dryRun ? 'would remove' : 'removed'} mcp.servers.${name}`)
-    }
-    const e = updateFile(envFile(ctx), (text) => removeEnvValue(text, KEY_ENV), { dryRun: ctx.dryRun, mode: 0o600, secret: true })
-    if (e.changed) actions.push(`${ctx.dryRun ? 'would remove' : 'removed'} ${KEY_ENV} from ${envFile(ctx)}`)
-    if (e.backup) backups.push(e.backup)
-    return { actions, backups, warnings, next: [] }
-  },
-}
diff --git a/cli/src/clients/opencode.js b/cli/src/clients/opencode.js
deleted file mode 100644
index d6f5cd1..0000000
--- a/cli/src/clients/opencode.js
+++ /dev/null
@@ -1,46 +0,0 @@
-// OpenCode: ~/.config/opencode/opencode.json(c), `mcp`, `{ type: "remote", url }`. OpenCode
-// detects the 401 and runs OAuth (DCR) itself; `opencode mcp auth box` signs in.
-// Docs: https://opencode.ai/docs/mcp-servers/ , https://opencode.ai/docs/config/
-import fs from 'node:fs'
-import path from 'node:path'
-import { jsonClient } from './json-client.js'
-
-function file(ctx) {
-  if (ctx.env.OPENCODE_CONFIG) return ctx.env.OPENCODE_CONFIG
-  const dir = path.join(ctx.xdgConfig, 'opencode')
-  const jsonc = path.join(dir, 'opencode.jsonc')
-  return fs.existsSync(jsonc) ? jsonc : path.join(dir, 'opencode.json')
-}
-
-export default jsonClient({
-  id: 'opencode',
-  name: 'OpenCode',
-  auth: 'oauth',
-  file,
-  container: ['mcp'],
-  entry: (ctx) => ({ type: 'remote', url: ctx.url, enabled: true }),
-  bins: ['opencode'],
-  dirs: (ctx) => [path.join(ctx.xdgConfig, 'opencode')],
-  next: (ctx) => [`Run \`opencode mcp auth ${ctx.name}\`, sign in in the browser and click Approve.`],
-  // Without this step box shows "needs authentication" and loads no tools, so an interactive
-  // connect offers to run it. `opencode mcp auth` exits 0 even when sign-in fails or times out,
-  // so the result is read back from `opencode mcp auth list` instead of the exit code.
-  signIn: {
-    bin: 'opencode',
-    args: (ctx) => ['mcp', 'auth', ctx.name],
-    signedIn(ctx) {
-      const res = ctx.run('opencode', ['mcp', 'auth', 'list'], { timeoutMs: 30000 })
-      if (res.status !== 0) return undefined
-      return authListSaysSignedIn(res.stdout, ctx.name)
-    },
-  },
-})
-
-/** Pure: whether `opencode mcp auth list` shows `name` as authenticated; undefined when it isn't listed. */
-export function authListSaysSignedIn(stdout, name) {
-  // eslint-disable-next-line no-control-regex
-  const lines = String(stdout).replace(/\x1b\[[0-9;]*m/g, '').split('\n')
-  const line = lines.find((l) => l.split(/\s+/).includes(name))
-  if (!line) return undefined
-  return line.includes('✓') && !/not authenticated|expired/i.test(line)
-}
diff --git a/cli/src/clients/vscode.js b/cli/src/clients/vscode.js
deleted file mode 100644
index dcd92a4..0000000
--- a/cli/src/clients/vscode.js
+++ /dev/null
@@ -1,20 +0,0 @@
-// VS Code (GitHub Copilot agent mode): user-profile mcp.json, `servers`, `type: "http"`.
-// VS Code runs the OAuth sign-in itself. Docs:
-// https://code.visualstudio.com/docs/agents/reference/mcp-configuration
-// Detection uses the user-data folder, not `code` on PATH: Cursor also installs a `code` shim.
-import path from 'node:path'
-import { jsonClient } from './json-client.js'
-
-const userDir = (ctx) => path.join(ctx.appData, 'Code', 'User')
-
-export default jsonClient({
-  id: 'vscode',
-  name: 'VS Code',
-  auth: 'oauth',
-  aliases: ['code', 'copilot'],
-  file: (ctx) => path.join(userDir(ctx), 'mcp.json'),
-  container: ['servers'],
-  entry: (ctx) => ({ type: 'http', url: ctx.url }),
-  dirs: (ctx) => [userDir(ctx)],
-  next: (ctx) => [`In VS Code, open the Command Palette -> MCP: List Servers -> ${ctx.name} -> Start, then allow the sign-in and click Approve.`],
-})
diff --git a/cli/src/constants.js b/cli/src/constants.js
deleted file mode 100644
index 013561e..0000000
--- a/cli/src/constants.js
+++ /dev/null
@@ -1,106 +0,0 @@
-// The one place the box MCP endpoint lives. When the endpoint moves, change DEFAULT_MCP_URL, add
-// the old host to OLD_HOSTS and release a new CLI version. BOX_MCP_URL overrides it (e.g. staging).
-export const DEFAULT_MCP_URL = 'https://mcp.box.simular.ai/mcp'
-
-/**
- * Hosts box was served from before. Entries there are still ours (connect rewrites them, remove
- * removes them), but they no longer work: the old host's sign-in metadata names the new URL, and
- * MCP clients refuse a resource that doesn't match the URL they were given.
- */
-export const OLD_HOSTS = ['relay.simular.cloud']
-
-/** Servers named here are removed on connect: older box setups added them next to `box`. */
-export const LEGACY_SERVER_NAMES = ['box-control']
-
-export const SERVER_NAME = 'box'
-
-/** Hosts that serve box by Simular. An existing server named `box` elsewhere is not ours. */
-export const OUR_HOSTS = ['mcp.box.simular.ai', 'staging.relay.simular.cloud', ...OLD_HOSTS]
-
-/** Whether `url` points at box by Simular (a known host, or the host of the current endpoint). */
-export function isOurUrl(url, currentUrl) {
-  if (typeof url !== 'string') return false
-  let host
-  try {
-    host = new URL(url).host
-  } catch {
-    return false
-  }
-  if (OUR_HOSTS.includes(host)) return true
-  try {
-    return host === new URL(currentUrl).host
-  } catch {
-    return false
-  }
-}
-
-/** Whether `url` is box's old address (and not what this run connects to). */
-export function isOldUrl(url, currentUrl) {
-  try {
-    const host = new URL(url).host
-    return OLD_HOSTS.includes(host) && host !== new URL(currentUrl).host
-  } catch {
-    return false
-  }
-}
-
-/** Thrown when a server with our name already exists but points somewhere else. */
-export class ForeignServerError extends Error {
-  constructor(where, name, url) {
-    super(
-      `${where} already has a server named "${name}" that points at ${url || 'something else'}, which is not box by Simular. ` +
-        'Nothing was changed. To add box next to it, run again with --name <another-name> (for example --name simular-box).',
-    )
-    this.foreign = true
-  }
-}
-
-export function validServerName(name) {
-  if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(name)) throw new Error('--name may use letters, digits, - and _ (up to 64)')
-  return name
-}
-export const KEY_ENV = 'BOX_TOKEN'
-export const KEYS_URL = 'https://box.simular.ai/keys'
-export const WATCH_URL = 'https://box.simular.ai/box'
-export const INSTALL_URL = 'https://box.simular.ai/install'
-export const SUPPORT_EMAIL = 'support@simular.ai'
-
-// Shown after a successful connect, word for word. They start with "Use box to" so the model reads
-// "box" as this tool, not a layout box or Box.com. Keep in sync with box-portal
-// src/docs/content/mcp.md ("Once box is connected, try asking your AI"; the first one is
-// BOX_FIRST_PROMPT in src/lib/getting-started.ts).
-export const EXAMPLE_PROMPTS = [
-  'Use box to open Chrome, search Google for "Simular", and summarize the top 3 results.',
-  "Use box to open GitHub Trending and tell me what today's top 3 repositories do",
-  "Use box to go to news.ycombinator.com and give me today's top 5 stories in a table",
-]
-
-export function mcpUrl(env = process.env) {
-  const override = (env.BOX_MCP_URL || '').trim()
-  if (!override) return DEFAULT_MCP_URL
-  let parsed
-  try {
-    parsed = new URL(override)
-  } catch {
-    throw new Error(`BOX_MCP_URL is not a valid URL: ${override}`)
-  }
-  if (parsed.protocol !== 'https:' && !(parsed.protocol === 'http:' && isLoopback(parsed.hostname))) {
-    throw new Error('BOX_MCP_URL must use https (http is allowed only for localhost)')
-  }
-  return parsed.toString().replace(/\/$/, '')
-}
-
-function isLoopback(host) {
-  return host === 'localhost' || host === '127.0.0.1' || host === '[::1]'
-}
-
-/** A personal key looks like `cb_` followed by url-safe characters. */
-export function looksLikeKey(value) {
-  return typeof value === 'string' && /^cb_[A-Za-z0-9_-]{4,}$/.test(value.trim())
-}
-
-/** For display only: never print a key, only that one is set and how it starts. */
-export function maskKey(value) {
-  if (!value) return '(none)'
-  return value.startsWith('cb_') ? 'cb_****' : '****'
-}
diff --git a/cli/src/context.js b/cli/src/context.js
deleted file mode 100644
index 624779a..0000000
--- a/cli/src/context.js
+++ /dev/null
@@ -1,76 +0,0 @@
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import spawn from 'cross-spawn'
-import { mcpUrl, SERVER_NAME, isOurUrl } from './constants.js'
-
-/**
- * Everything a client adapter may touch about the machine goes through this context, so tests can
- * point it at a temporary HOME and a fake PATH.
- */
-export function createContext({ env = process.env, platform = process.platform, dryRun = false, log = () => {}, serverName = SERVER_NAME } = {}) {
-  // Match os.homedir(), which the apps themselves use: USERPROFILE on Windows, HOME elsewhere.
-  const home = (platform === 'win32' ? env.USERPROFILE || env.HOME : env.HOME || env.USERPROFILE) || os.homedir()
-  const ctx = {
-    env,
-    home,
-    platform,
-    dryRun,
-    log,
-    url: mcpUrl(env),
-    /** The name box is installed under (--name); `box` unless that name is taken by another server. */
-    name: serverName,
-    /** Whether a configured URL is box by Simular (and so ours to change or remove). */
-    ours(url) {
-      return isOurUrl(url, this.url)
-    },
-    /** XDG config dir, falling back to ~/.config (also on macOS, as most CLIs do). */
-    xdgConfig: env.XDG_CONFIG_HOME || path.join(home, '.config'),
-    /** Platform app-data dir: ~/Library/Application Support, %APPDATA%, or XDG config. */
-    appData:
-      platform === 'darwin'
-        ? path.join(home, 'Library', 'Application Support')
-        : platform === 'win32'
-          ? env.APPDATA || path.join(home, 'AppData', 'Roaming')
-          : env.XDG_CONFIG_HOME || path.join(home, '.config'),
-    which(bin) {
-      return which(bin, env, platform)
-    },
-    /**
-     * Run a client's own CLI. Arguments are passed as an array; cross-spawn quotes them for
-     * Windows .cmd shims (npm-installed CLIs), where a plain spawn needs a shell. Secrets must
-     * never be passed here: they would show up in `ps`.
-     */
-    run(bin, args, { input, timeoutMs = 60000 } = {}) {
-      const resolved = ctx.which(bin)
-      if (!resolved) return { status: 127, stdout: '', stderr: `${bin} not found` }
-      const res = spawn.sync(resolved, args, { env, input, encoding: 'utf8', timeout: timeoutMs })
-      return { status: res.status ?? 1, stdout: res.stdout || '', stderr: res.stderr || String(res.error || '') }
-    },
-    /** Run a client's own CLI attached to this terminal, for its interactive sign-in. */
-    runInteractive(bin, args) {
-      const resolved = ctx.which(bin)
-      if (!resolved) return { status: 127 }
-      const res = spawn.sync(resolved, args, { env, stdio: 'inherit' })
-      return { status: res.status ?? 1 }
-    },
-  }
-  return ctx
-}
-
-export function which(bin, env = process.env, platform = process.platform) {
-  const dirs = (env.PATH || env.Path || '').split(path.delimiter).filter(Boolean)
-  const exts = platform === 'win32' ? (env.PATHEXT || '.EXE;.CMD;.BAT').split(';') : ['']
-  for (const dir of dirs) {
-    for (const ext of exts) {
-      const candidate = path.join(dir, bin + ext)
-      try {
-        const st = fs.statSync(candidate)
-        if (st.isFile() && (platform === 'win32' || st.mode & 0o111)) return candidate
-      } catch {
-        // not here
-      }
-    }
-  }
-  return null
-}
diff --git a/cli/src/formats.js b/cli/src/formats.js
deleted file mode 100644
index dc91eb7..0000000
--- a/cli/src/formats.js
+++ /dev/null
@@ -1,268 +0,0 @@
-// Format-preserving edits. We change only the keys we own and keep comments, ordering and
-// every other server the user has.
-import * as jsonc from 'jsonc-parser'
-import * as TOML from 'smol-toml'
-import YAML from 'yaml'
-
-const FORMAT = { formattingOptions: { insertSpaces: true, tabSize: 2, eol: '\n' } }
-
-/** Parse JSON or JSONC. Throws on a file we cannot parse: never overwrite what we can't read. */
-export function parseJsonc(text, file = 'config') {
-  if (text === null || text.trim() === '') return {}
-  const errors = []
-  const value = jsonc.parse(text, errors, { allowTrailingComma: true, disallowComments: false })
-  if (errors.length) {
-    const e = errors[0]
-    throw new Error(`${file} is not valid JSON (${jsonc.printParseErrorCode(e.error)} at offset ${e.offset}); fix it or move it aside, then run again`)
-  }
-  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error(`${file} does not hold a JSON object; fix it or move it aside, then run again`)
-  }
-  return value
-}
-
-/** Set (or with value undefined, delete) the value at `jsonPath`, keeping the rest of the text. */
-export function setJsoncPath(text, jsonPath, value, file) {
-  const base = text === null || text.trim() === '' ? '{}\n' : text
-  parseJsonc(base, file)
-  const eol = /\r\n/.test(base) ? '\r\n' : '\n'
-  const edits = jsonc.modify(base, jsonPath, value, { formattingOptions: { ...FORMAT.formattingOptions, eol } })
-  let out = jsonc.applyEdits(base, edits)
-  if (!out.endsWith('\n')) out += eol
-  return out
-}
-
-export function getPath(obj, jsonPath) {
-  let cur = obj
-  for (const key of jsonPath) {
-    if (cur === null || typeof cur !== 'object') return undefined
-    cur = cur[key]
-  }
-  return cur
-}
-
-/** Equal for config purposes (key order ignored). */
-export function sameValue(a, b) {
-  return JSON.stringify(sortKeys(a)) === JSON.stringify(sortKeys(b))
-}
-
-function sortKeys(v) {
-  if (Array.isArray(v)) return v.map(sortKeys)
-  if (v && typeof v === 'object') {
-    return Object.fromEntries(Object.keys(v).sort().map((k) => [k, sortKeys(v[k])]))
-  }
-  return v
-}
-
-/**
- * Upsert `servers[name] = entry` under `containerPath` in a JSON/JSONC document and delete legacy
- * names. Returns the new text, or the old text when nothing changes.
- */
-export function upsertJsonServer(text, containerPath, name, entry, { legacy = [], file } = {}) {
-  const doc = parseJsonc(text, file)
-  let out = text
-  const current = getPath(doc, [...containerPath, name])
-  if (!sameValue(current, entry)) out = setJsoncPath(out, [...containerPath, name], entry, file)
-  for (const old of legacy) {
-    if (getPath(parseJsonc(out, file), [...containerPath, old]) !== undefined) {
-      out = setJsoncPath(out, [...containerPath, old], undefined, file)
-    }
-  }
-  return out
-}
-
-export function removeJsonServer(text, containerPath, names, { file } = {}) {
-  if (text === null) return null
-  let out = text
-  for (const name of names) {
-    if (getPath(parseJsonc(out, file), [...containerPath, name]) !== undefined) {
-      out = setJsoncPath(out, [...containerPath, name], undefined, file)
-    }
-  }
-  return out
-}
-
-// ---- dotenv files (KEY=value lines) ----
-
-const envLine = (name) => new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=.*$`, 'm')
-
-export function readEnvValue(text, name) {
-  if (!text) return undefined
-  const m = new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=\\s*(.*)$`, 'm').exec(text)
-  if (!m) return undefined
-  return m[1].trim().replace(/^(['"])(.*)\1$/, '$2')
-}
-
-/** Set NAME=value, replacing an existing line in place and keeping every other line. */
-export function upsertEnvValue(text, name, value) {
-  const line = `${name}=${value}`
-  if (text && envLine(name).test(text)) {
-    if (readEnvValue(text, name) === value) return text
-    return text.replace(envLine(name), () => line)
-  }
-  const base = text ? text.replace(/\n*$/, '\n') : ''
-  return `${base}${line}\n`
-}
-
-export function removeEnvValue(text, name) {
-  if (!text || !envLine(name).test(text)) return text
-  return text.replace(new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=.*(?:\\r?\\n|$)`, 'm'), '')
-}
-
-// ---- TOML (Codex): surgical table edits, so comments and formatting elsewhere survive ----
-
-
-export function parseToml(text, file = 'config.toml') {
-  if (!text || !text.trim()) return {}
-  try {
-    return TOML.parse(text)
-  } catch (err) {
-    throw new Error(`${file} is not valid TOML (${err.message.split('\n')[0]}); fix it or move it aside, then run again`)
-  }
-}
-
-function splitDotted(key) {
-  const parts = []
-  let cur = ''
-  let quote = null
-  for (const ch of key) {
-    if (quote) {
-      if (ch === quote) quote = null
-      else cur += ch
-    } else if (ch === '"' || ch === "'") quote = ch
-    else if (ch === '.') {
-      parts.push(cur.trim())
-      cur = ''
-    } else cur += ch
-  }
-  parts.push(cur.trim())
-  return parts
-}
-
-const HEADER = /^\s*\[(\[?)\s*([^\]]+?)\s*\]\]?\s*(?:#.*)?\r?$/
-
-/**
- * Remove `[table]` blocks whose key path starts with any of `prefixes` (arrays of key parts), or
- * equals one of them when `exact`. Comment and blank lines just above a table we keep stay with
- * that table (they usually describe it).
- */
-export function removeTomlTables(text, prefixes, { exact = false } = {}) {
-  if (!text) return text
-  const lines = text.split('\n') // a CRLF line keeps its \r, which HEADER tolerates
-  const out = []
-  let dropping = false
-  let pending = [] // comment/blank lines seen while dropping; kept if a kept table follows
-  for (const line of lines) {
-    const m = HEADER.exec(line)
-    if (m) {
-      const parts = splitDotted(m[2])
-      const wasDropping = dropping
-      dropping = prefixes.some((pre) => (exact ? pre.length === parts.length : true) && pre.every((p, i) => parts[i] === p))
-      if (wasDropping && !dropping) {
-        const blank = (l) => /^\s*\r?$/.test(l)
-        if (!out.length || blank(out[out.length - 1])) while (pending.length && blank(pending[0])) pending.shift()
-        out.push(...pending)
-      }
-      pending = []
-    }
-    if (!dropping) out.push(line)
-    else if (/^\s*(#.*)?\r?$/.test(line)) pending.push(line)
-    else pending = []
-  }
-  // A dropped block at the end also drops the file's final newline: restore it.
-  const eol = /\r\n/.test(text) ? '\r\n' : '\n'
-  let result = out.join('\n').replace(/\r$/, '')
-  if (/\n$/.test(text) && !/\n$/.test(result) && result) result += eol
-  return result
-}
-
-const tomlString = (s) => JSON.stringify(s)
-
-/** Keys that select how Codex connects; anything else on our table (timeouts, tool lists) is kept. */
-const CONNECTION_KEYS = new Set(['url', 'command', 'args', 'env', 'cwd', 'bearer_token', 'bearer_token_env_var', 'http_headers', 'env_http_headers'])
-
-/**
- * Set `[mcp_servers.<name>]` so it connects with `fields`, removing legacy names. Other settings
- * on the table and its subtables (e.g. tool approvals) are kept. The caller checks that an
- * existing table is ours. Throws when the server is defined in a way we can't edit safely.
- */
-export function upsertTomlServer(text, name, fields, { legacy = [], file } = {}) {
-  const doc = parseToml(text, file)
-  const current = doc.mcp_servers?.[name]
-  const kept = {}
-  for (const [k, v] of Object.entries(current || {})) {
-    if (!CONNECTION_KEYS.has(k) && (v === null || typeof v !== 'object' || Array.isArray(v) || v instanceof Date)) kept[k] = v
-  }
-  const connection = Object.fromEntries(Object.entries(current || {}).filter(([k]) => CONNECTION_KEYS.has(k)))
-  const hasLegacy = legacy.some((n) => doc.mcp_servers?.[n] !== undefined)
-  if (current && sameValue(connection, fields) && !hasLegacy) return text
-  let out = removeTomlTables(text || '', [['mcp_servers', name]], { exact: true })
-  out = removeTomlTables(out, legacy.map((n) => ['mcp_servers', n]))
-  const check = parseToml(out, file)
-  for (const n of legacy) {
-    if (check.mcp_servers?.[n] !== undefined) throw new Error(`${file} defines mcp_servers.${n} inline; remove it by hand, then run again`)
-  }
-  const leftover = check.mcp_servers?.[name]
-  if (leftover && Object.values(leftover).some((v) => v === null || typeof v !== 'object' || Array.isArray(v))) {
-    throw new Error(`${file} defines mcp_servers.${name} inline or with dotted keys; remove it by hand, then run again`)
-  }
-  // Keep the file's line endings (CRLF on Windows-edited files).
-  const eol = /\r\n/.test(text || '') ? '\r\n' : '\n'
-  const keptLines = Object.keys(kept).length ? TOML.stringify(kept).trim().split(/\r?\n/) : []
-  const body = [...Object.entries(fields).map(([k, v]) => `${k} = ${tomlString(v)}`), ...keptLines].join(eol)
-  out = `${out.replace(/\s*$/, '')}${out.trim() ? eol + eol : ''}[mcp_servers.${name}]${eol}${body}${eol}`
-  const final = parseToml(out, file)
-  const got = Object.fromEntries(Object.entries(final.mcp_servers?.[name] || {}).filter(([k]) => CONNECTION_KEYS.has(k)))
-  if (!sameValue(got, fields)) throw new Error(`could not update ${file} safely; nothing was written`)
-  return out
-}
-
-export function removeTomlServers(text, names, { file } = {}) {
-  if (!text) return text
-  const doc = parseToml(text, file)
-  if (!names.some((n) => doc.mcp_servers?.[n] !== undefined)) return text
-  const out = removeTomlTables(text, names.map((n) => ['mcp_servers', n])).replace(/(\r?\n){3,}/g, (m) => (m.includes('\r') ? '\r\n\r\n' : '\n\n'))
-  const check = parseToml(out, file)
-  for (const n of names) {
-    if (check.mcp_servers?.[n] !== undefined) throw new Error(`${file} defines mcp_servers.${n} inline; remove it by hand`)
-  }
-  return out
-}
-
-// ---- YAML (Hermes): Document API keeps comments and key order ----
-
-
-export function parseYamlDoc(text, file = 'config.yaml') {
-  const doc = YAML.parseDocument(text || '')
-  if (doc.errors.length) throw new Error(`${file} is not valid YAML (${doc.errors[0].message.split('\n')[0]}); fix it or move it aside, then run again`)
-  const root = doc.toJS()
-  if (root !== null && root !== undefined && (typeof root !== 'object' || Array.isArray(root))) {
-    throw new Error(`${file} does not hold a YAML mapping`)
-  }
-  return doc
-}
-
-export function upsertYamlServer(text, containerKey, name, entry, { legacy = [], file } = {}) {
-  const doc = parseYamlDoc(text, file)
-  const js = doc.toJS() || {}
-  const servers = js[containerKey] || {}
-  const hasLegacy = legacy.some((n) => servers[n] !== undefined)
-  if (sameValue(servers[name], entry) && !hasLegacy) return text
-  if (!doc.contents) doc.contents = doc.createNode({})
-  doc.setIn([containerKey, name], doc.createNode(entry))
-  for (const n of legacy) if (servers[n] !== undefined) doc.deleteIn([containerKey, n])
-  return String(doc)
-}
-
-export function removeYamlServers(text, containerKey, names, { file } = {}) {
-  if (!text) return text
-  const doc = parseYamlDoc(text, file)
-  const servers = (doc.toJS() || {})[containerKey] || {}
-  if (!names.some((n) => servers[n] !== undefined)) return text
-  for (const n of names) if (servers[n] !== undefined) doc.deleteIn([containerKey, n])
-  return String(doc)
-}
-
-export function readYaml(text, file) {
-  return parseYamlDoc(text, file).toJS() || {}
-}
diff --git a/cli/src/fsutil.js b/cli/src/fsutil.js
deleted file mode 100644
index 15e007f..0000000
--- a/cli/src/fsutil.js
+++ /dev/null
@@ -1,74 +0,0 @@
-import fs from 'node:fs'
-import path from 'node:path'
-
-export function readText(file) {
-  try {
-    return fs.readFileSync(file, 'utf8')
-  } catch (err) {
-    if (err.code === 'ENOENT') return null
-    throw err
-  }
-}
-
-export function exists(file) {
-  try {
-    fs.accessSync(file)
-    return true
-  } catch {
-    return false
-  }
-}
-
-/**
- * Copy `file` to `file.box-backup-<timestamp>` before we change it. Returns the backup path,
- * or null when there was nothing to back up.
- */
-export function backup(file, now = new Date()) {
-  if (!exists(file)) return null
-  const stamp = now.toISOString().replace(/[:.]/g, '-')
-  const target = `${file}.box-backup-${stamp}`
-  fs.copyFileSync(file, target)
-  try {
-    fs.chmodSync(target, fs.statSync(file).mode & 0o777)
-  } catch {
-    // best effort: the copy keeps the default mode
-  }
-  return target
-}
-
-/**
- * Write atomically (temp file + rename) so a crash never leaves a half-written config.
- * Keeps the existing file's mode; `mode` applies to new files (0600 for files that hold a key).
- */
-export function writeAtomic(linkOrFile, text, { mode } = {}) {
-  // Write through a symlinked config (dotfile repos): replace the target, keep the link.
-  const file = exists(linkOrFile) ? fs.realpathSync(linkOrFile) : linkOrFile
-  fs.mkdirSync(path.dirname(file), { recursive: true })
-  let finalMode = mode
-  if (exists(file)) {
-    const current = fs.statSync(file).mode & 0o777
-    finalMode = mode === undefined ? current : current & mode
-  }
-  const tmp = `${file}.box-tmp-${process.pid}`
-  fs.writeFileSync(tmp, text, { mode: finalMode ?? 0o644 })
-  if (finalMode !== undefined) fs.chmodSync(tmp, finalMode)
-  fs.renameSync(tmp, file)
-}
-
-/**
- * Apply `transform(oldText|null) -> newText|null` to a file. Returns {changed, backup}.
- * A null result or an unchanged text leaves the file alone (idempotent re-runs, no backup spam).
- * `secret: true` (a .env holding keys) keeps no backup: a backup would keep an old or removed
- * key on disk. Those edits only add, replace or delete one line.
- */
-export function updateFile(file, transform, { mode, dryRun = false, secret = false } = {}) {
-  const before = readText(file)
-  const after = transform(before)
-  if (after === null || after === before) return { changed: false, backup: null }
-  if (dryRun) return { changed: true, backup: null, preview: after }
-  const backupPath = secret ? null : backup(exists(file) ? fs.realpathSync(file) : file)
-  // A backup of a file that holds a key is a copy of that key: keep it as private as the file.
-  if (backupPath && mode !== undefined) fs.chmodSync(backupPath, (fs.statSync(backupPath).mode & 0o777) & mode)
-  writeAtomic(file, after, { mode })
-  return { changed: true, backup: backupPath }
-}
diff --git a/cli/src/offload/commands.js b/cli/src/offload/commands.js
deleted file mode 100644
index 27b2f04..0000000
--- a/cli/src/offload/commands.js
+++ /dev/null
@@ -1,415 +0,0 @@
-import fs from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { openBrowser } from '../box/browser.js'
-import { BoxConnection, describe } from '../box/connection.js'
-import { boxHome, endpointUrl } from '../box/endpoint.js'
-import { browserLogin, revoke } from '../box/login.js'
-import { attach, rsh, wake } from '../box/rsh.js'
-import { TokenStore, TOKEN_ENV } from '../box/token-store.js'
-import { GitRepo, OffloadError, landingSummary } from './git.js'
-import { HANDOVER_TEMPLATE, currentKind, findSignInLink, kind as kindOf, loginCommand, tmuxSession } from './model.js'
-import { Offloader } from './offloader.js'
-import { quote } from './run.js'
-import { OffloadStore } from './store.js'
-
-// The box-side commands of the CLI: login/logout, rsh, offload, back, and the box CLI's install and sign-in. They follow
-// upstream cocoonbox's CLI (macos/Sources/CocoonBoxCLI/main.swift) and its app's "Install in box" / "Sign in in the box".
-
-const BIN = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..', 'bin', 'simular-box.js')
-export const CMD = 'npx @simular-ai/box'
-
-export const OFFLOAD_HELP = `Offload (move a coding task into your box and back):
-  login [--token -]                     sign this CLI in to box in the browser (a device token, revocable
-                                        under Keys -> Devices); --token - reads a personal key (cb_...)
-                                        from stdin or a hidden prompt. Kept in ~/.simular-box (0600)
-  logout                                forget the token, and revoke it when login made it
-  rsh [--box NAME|ID] [-t] [HOST] COMMAND...
-                                        run COMMAND in a box with this stdin/stdout/stderr (rsync's and
-                                        git's remote shell); exits with its code, or 255
-  offload [--box B] [--kind claude|codex|cursor] [--dir PATH] [--handover FILE] [--yes] [--json]
-                                        move this repo's task into a box: preflight, copy, and a fresh box
-                                        CLI session that starts from the hand-over
-  offload handover-path                 print where to write the hand-over
-  offload --handover-prompt [--kind K]  print the request to paste into Codex or another CLI
-  offload inbox [--wait S] [--all] [--json]   what the box agent posted since the last look
-  offload status [--all] [--json]       the box CLI session of this repo, or of every repo
-  offload send [--interrupt] [TEXT...]  give the box agent a message (TEXT, else stdin)
-  offload secrets [add|remove ENTRY]    this repo's opted-in secrets: file:PATH, aws, kube, gcloud, ssh:KEY
-  offload install-cli [--box B] [--kind K]   install the box CLI with the vendor's official installer
-  offload sign-in [--box B] [--kind K]  run the box CLI's own login in the box on this terminal; its
-                                        sign-in link opens in this computer's browser
-  back [--interrupt] [--json]           bring the task back: the box agent's hand-over and its commits,
-                                        merged against the offload's snapshot; it first waits for the box
-                                        agent to go idle (--interrupt stops its current step instead)
-
-offload and back exit 0 when done, 1 on a failure (nothing changed here), 3 when the preflight blocks,
-and 4 when it warns and --yes was not given: ask the user, then run again with --yes.`
-
-/** Box is the CLI's context for box calls: endpoint, token store and offload store. */
-export function boxContext(env = process.env) {
-  const home = boxHome(env)
-  return {
-    env,
-    home,
-    tokens: new TokenStore(home, env),
-    store: new OffloadStore(home),
-    endpoint: (override) => (override ? endpointUrl({ BOX_ENDPOINT: override }) : endpointUrl(env)),
-  }
-}
-
-export function connect(ctx, override) {
-  const endpoint = ctx.endpoint(override)
-  const saved = ctx.tokens.get(endpoint)
-  if (!saved) throw new Error(`not signed in to ${endpoint}; run: ${CMD} login`)
-  return new BoxConnection(endpoint, saved.token)
-}
-
-// ---------- login ----------
-
-export async function login(ctx, flags, { stdin = process.stdin, stderr = process.stderr, stdout = process.stdout } = {}) {
-  const endpoint = ctx.endpoint(flags.endpoint)
-  let token
-  let source
-  if (flags.token !== undefined) {
-    if (flags.token !== '-') throw new Error('--token takes -: paste the token on stdin or at the prompt, never as an argument')
-    token = await readSecret(stdin, stderr, 'box personal key (cb_...): ')
-    source = 'paste'
-  } else {
-    token = await browserLogin(endpoint, {
-      open: (url) => {
-        stderr.write(`box: allow this computer in the browser; if no page opened, open\n  ${url}\n`)
-        openBrowser(url, { env: ctx.env })
-      },
-    })
-    source = 'browser'
-  }
-  if (!token) throw new Error('no token given')
-  const connection = new BoxConnection(endpoint, token)
-  try {
-    await connection.listBoxes()
-  } catch (err) {
-    if (source === 'browser') await revoke(endpoint, token).catch(() => {})
-    throw new Error(describe(err))
-  } finally {
-    connection.close()
-  }
-  const previous = ctx.tokens.saved(endpoint)
-  ctx.tokens.set(endpoint, token, source)
-  // A replaced device token would otherwise stay live with nothing holding it.
-  if (previous?.source === 'browser' && previous.token !== token) await revoke(endpoint, previous.token).catch(() => {})
-  if ((ctx.env[TOKEN_ENV] || '').trim()) stderr.write(`box: note: ${TOKEN_ENV} is set and wins over the saved token\n`)
-  stdout.write(`signed in to ${endpoint}\n`)
-  return 0
-}
-
-export async function logout(ctx, flags, { stdout = process.stdout } = {}) {
-  const endpoint = ctx.endpoint(flags.endpoint)
-  const saved = ctx.tokens.saved(endpoint)
-  let note = ''
-  if (saved?.source === 'browser') {
-    try {
-      await revoke(endpoint, saved.token)
-    } catch (err) {
-      note = ` (the server did not revoke the device token: ${err.message}; revoke it under Keys -> Devices at https://box.simular.ai/keys)`
-    }
-  }
-  ctx.tokens.remove(endpoint)
-  stdout.write(`signed out${note}\n`)
-  return note ? 1 : 0
-}
-
-async function readSecret(stdin, stderr, prompt) {
-  if (!stdin.isTTY) {
-    let data = ''
-    for await (const chunk of stdin) data += chunk
-    return data.split('\n')[0].trim()
-  }
-  stderr.write(prompt)
-  stdin.setRawMode(true)
-  stdin.resume()
-  return new Promise((resolve, reject) => {
-    let value = ''
-    const onData = (buf) => {
-      for (const ch of buf.toString('utf8')) {
-        if (ch === '\r' || ch === '\n') return finish(null, value.trim())
-        if (ch === '\u0003') return finish(new Error('cancelled'))
-        if (ch === '\u007f') value = value.slice(0, -1)
-        else value += ch
-      }
-    }
-    const finish = (err, v) => {
-      stdin.off('data', onData)
-      stdin.setRawMode(false)
-      stdin.pause()
-      stderr.write('\n')
-      if (err) reject(err)
-      else resolve(v)
-    }
-    stdin.on('data', onData)
-  })
-}
-
-// ---------- rsh ----------
-
-export function rshCommand(ctx, argv) {
-  return rsh(argv, { connect: (override) => connect(ctx, override), env: ctx.env })
-}
-
-// ---------- offload ----------
-
-/** offloadKey is the repo key of --dir or the working directory; for an offload in flight it falls back to the record of the same top level. */
-function offloadKey(ctx, flags, { inFlight = false } = {}) {
-  const dir = path.resolve(flags.dir || process.cwd())
-  const repo = GitRepo.open(dir, ctx.env)
-  if (!repo) throw new OffloadError('failed', `${dir} is not in a git repository`)
-  if (!inFlight || ctx.store.record(repo.key)) return repo.key
-  return ctx.store.records().filter((r) => r.top === repo.top).pop()?.repo || repo.key
-}
-
-async function runningBox(connection, ref) {
-  const boxes = await connection.listBoxes()
-  const box = ref ? boxes.find((b) => b.id === ref || b.name === ref) : boxes[0]
-  if (!box) throw new Error(ref ? `no box named ${ref}` : 'no box yet; create one at https://box.simular.ai')
-  return wake(connection, box)
-}
-
-function offloader(ctx, connection, box, stderr) {
-  const rsh = [process.execPath, BIN].map(quote).join(' ') + ` rsh --box ${quote(box.id)}`
-  return new Offloader({ connection, box, store: ctx.store, rsh, env: ctx.env, progress: (l) => stderr.write(`${l}\n`) })
-}
-
-function printFindings(findings, out) {
-  for (const f of findings) out.write(`${f.outcome.padEnd(8)}${f.check}: ${f.detail}\n`)
-}
-
-const json = (out, obj) => out.write(JSON.stringify(obj, null, 2) + '\n')
-
-export function offloadFailed(err, flags, { stdout, stderr }) {
-  const code = err.kind === 'refused' ? 3 : err.kind === 'needsYes' ? 4 : 1
-  if (flags.json) {
-    json(stdout, { ok: false, code: code === 3 ? 'refused' : code === 4 ? 'confirm' : 'failed', error: err.message, findings: err.findings })
-  } else {
-    printFindings(err.findings, stdout)
-    if (err.findings.some((f) => f.outcome === 'block' && f.check.includes('cli'))) {
-      const k = `--kind ${flags.kind || currentKind(process.env) || '<claude|codex|cursor>'}${flags.box ? ` --box ${flags.box}` : ''}`
-      stdout.write(`Install or sign in the box CLI from your own terminal: ${CMD} offload install-cli ${k} (when it is missing), then ${CMD} offload sign-in ${k}\n`)
-    }
-    stderr.write(`box: ${err.message}${code === 1 ? '; nothing changed on this computer' : ''}\n`)
-  }
-  return code
-}
-
-export function handoverPrompt(handoverPath, kindName) {
-  const k = kindOf(kindName)
-  return `OFFLOAD: move this task into my box, where a fresh ${k.title} session continues it while I am away. It knows only what your hand-over says, plus the repo.
-1. Finish the step you are in, or stop at a safe point. Do not start new work.
-2. Write a hand-over of this session to ${handoverPath} with the template below. Fill every section; write "none" for an empty one. Be concrete: exact commands, versions, paths, errors, decisions with their reasons. Names only for secrets, never values. The file is outside this repo: if your sandbox refuses the write, ask me to approve it.
-3. Run in this repo: ${CMD} offload --kind ${kindName}
-   It needs the network: if your sandbox refuses, ask me to approve it. Exit 3 is a block: tell me why, one line per finding. Exit 4 is warnings: tell me each one and run again with --yes only if I agree. Exit 1: tell me its last line.
-4. When it prints "offloaded", tell me the box, end your turn and change nothing more in this repo. \`${CMD} back\` in this repo brings the work back.
-
-${HANDOVER_TEMPLATE}`
-}
-
-export async function offload(ctx, flags, rest, io = {}) {
-  const stdout = io.stdout || process.stdout
-  const stderr = io.stderr || process.stderr
-  const sub = ['handover-path', 'inbox', 'status', 'send', 'secrets', 'install-cli', 'sign-in'].includes(rest[0]) ? rest[0] : null
-  const words = sub ? rest.slice(1) : rest
-  try {
-    if (sub === 'handover-path') {
-      stdout.write(ctx.store.handover(offloadKey(ctx, flags)) + '\n')
-      return 0
-    }
-    if (sub === 'secrets') return secretsCommand(ctx, flags, words, stdout)
-    const kindName = flags.kind || currentKind(ctx.env)
-    if (flags.kind) kindOf(flags.kind)
-    if (flags['handover-prompt']) {
-      stdout.write(handoverPrompt(ctx.store.handover(offloadKey(ctx, flags)), kindName || 'codex') + '\n')
-      return 0
-    }
-    if (sub === 'install-cli' || sub === 'sign-in') return boxCli(ctx, flags, sub, kindName, { stdout, stderr })
-    const connection = connect(ctx, flags.endpoint)
-    try {
-      if (sub) return await inboxCommand(ctx, flags, sub, words, connection, { stdout, stderr })
-      if (!kindName) throw new OffloadError('failed', 'name the box CLI with --kind claude, codex or cursor')
-      const key = offloadKey(ctx, flags)
-      const file = flags.handover ? path.resolve(flags.handover) : ctx.store.handover(key)
-      let handover
-      try {
-        handover = fs.readFileSync(file, 'utf8')
-      } catch {
-        throw new OffloadError('failed', `no hand-over at ${file}; write it there first (${CMD} offload handover-path)`)
-      }
-      const box = await runningBox(connection, flags.box)
-      const outcome = await offloader(ctx, connection, box, stderr).offload({ directory: path.resolve(flags.dir || process.cwd()), kind: kindName, handover, yes: Boolean(flags.yes) })
-      const r = outcome.record
-      if (flags.json) {
-        json(stdout, {
-          ok: true, box: box.name, box_id: box.id, dir: r.dir, tmux: tmuxSession(r), offload_id: r.id, repo: r.repo, accepted: outcome.accepted,
-          sent_bytes: outcome.sent, findings: outcome.findings, timings_ms: Object.fromEntries(outcome.timings),
-        })
-        return 0
-      }
-      printFindings(outcome.findings, stdout)
-      stdout.write(`offloaded to ${box.name}: ${outcome.cli}\n`)
-      stdout.write(`  copy ${r.dir}, tmux ${tmuxSession(r)}, offload ${r.id}\n`)
-      stdout.write(`  sent ${(outcome.sent / 1e6).toFixed(1)} MB; ${outcome.timings.map(([s, ms]) => `${s} ${(ms / 1000).toFixed(1)} s`).join(', ')}\n`)
-      if (!outcome.accepted) stdout.write(`  the box CLI has not taken the hand-over yet; watch it with \`${CMD} offload status\`\n`)
-      stdout.write(`  watch its terminal: ${CMD} rsh -t --box ${box.name} tmux attach -t ${tmuxSession(r)}\n`)
-      stdout.write(`Bring it back with /simular-box:back or \`${CMD} back\`.\n`)
-      return 0
-    } finally {
-      connection.close()
-    }
-  } catch (err) {
-    if (err instanceof OffloadError) return offloadFailed(err, flags, { stdout, stderr })
-    throw new Error(describe(err))
-  }
-}
-
-async function inboxCommand(ctx, flags, sub, words, connection, { stdout }) {
-  const all = Boolean(flags.all)
-  const key = all && sub === 'status' ? null : offloadKey(ctx, flags, { inFlight: true })
-  const record = key ? ctx.store.record(key) : null
-  const box = await runningBox(connection, flags.box || record?.box)
-  const packer = offloader(ctx, connection, box, process.stderr)
-  if (sub === 'status') {
-    const sessions = await packer.status(key)
-    if (flags.json) return json(stdout, { sessions: sessions.map((s) => ({ repo: s.repo, name: s.name, cli: s.cli, offload_id: s.offload_id, status: s.status, hooks_silent: Boolean(s.hooks_silent) })) }), 0
-    if (!sessions.length) stdout.write('no box CLI session\n')
-    for (const s of sessions) {
-      stdout.write(`${s.name} ${s.cli} ${s.status} offload ${s.offload_id} (repo ${s.repo})${s.hooks_silent ? '; its hooks do not run, so the status comes from its transcript' : ''}\n`)
-    }
-    return 0
-  }
-  if (sub === 'send') {
-    let text = words.join(' ')
-    if (!text) for await (const chunk of process.stdin) text += chunk
-    if (!text.trim()) throw new OffloadError('failed', 'no message')
-    const delivery = await packer.send(key, text, Boolean(flags.interrupt))
-    if (flags.json) json(stdout, { delivery })
-    else stdout.write(`sent to the box agent: ${delivery}\n`)
-    return 0
-  }
-  // inbox
-  const since = all ? 0 : record?.seen || 0
-  const wait = flags.wait ? Number(flags.wait) : undefined
-  let { entries, status } = await packer.read(key, since, wait)
-  let newest = entries.length ? entries[entries.length - 1].seq : since
-  if (!all && record) {
-    const current = (e) => e.offload_id === record.id || !e.offload_id
-    if (entries.length && !entries.some(current)) {
-      ;({ entries, status } = await packer.read(key, newest, wait))
-      newest = entries.length ? entries[entries.length - 1].seq : newest
-    }
-    entries = entries.filter(current)
-  }
-  if (record && newest > (record.seen || 0)) ctx.store.save({ ...record, seen: newest })
-  if (flags.json) return json(stdout, { status, entries }), 0
-  if (!entries.length) stdout.write(`nothing new from the box agent (${status || 'no session'})\n`)
-  for (const e of entries) stdout.write(`#${e.seq} ${e.kind} at ${new Date(e.time_ms).toLocaleTimeString()}\n${e.body}\n\n`)
-  return 0
-}
-
-function secretsCommand(ctx, flags, words, stdout) {
-  const key = offloadKey(ctx, flags)
-  let entries = ctx.store.secrets(key)
-  if (words.length) {
-    const [action, entry] = words
-    if (!['add', 'remove'].includes(action) || words.length !== 2) throw new OffloadError('failed', `usage: ${CMD} offload secrets [add|remove ENTRY]`)
-    const rel = entry.startsWith('file:') || entry.startsWith('ssh:') ? entry.slice(entry.indexOf(':') + 1) : null
-    if (rel !== null && (!rel || path.isAbsolute(rel) || rel.split(/[\\/]/).includes('..'))) {
-      throw new OffloadError('failed', `${entry}: name a path inside the repo (file:) or a key in ~/.ssh (ssh:), without ..`)
-    }
-    if (!(entry.startsWith('file:') || entry.startsWith('ssh:') || ['aws', 'kube', 'gcloud'].includes(entry))) {
-      throw new OffloadError('failed', 'an entry is file:PATH, aws, kube, gcloud or ssh:KEY')
-    }
-    entries = entries.filter((e) => e !== entry)
-    if (action === 'add') entries.push(entry)
-    ctx.store.setSecrets(key, entries)
-  }
-  stdout.write((entries.length ? entries.join('\n') : 'no secrets opted in') + '\n')
-  return 0
-}
-
-export async function back(ctx, flags, io = {}) {
-  const stdout = io.stdout || process.stdout
-  const stderr = io.stderr || process.stderr
-  try {
-    const key = offloadKey(ctx, flags, { inFlight: true })
-    const record = ctx.store.record(key)
-    if (!record) {
-      const last = path.join(ctx.store.root, key, 'back.md')
-      const st = fs.existsSync(last) ? fs.statSync(last) : null
-      throw new OffloadError('failed', 'nothing of this repo is in a box' + (st ? `; the hand-over brought back at ${st.mtime.toLocaleString()} is in ${last}` : ''))
-    }
-    const connection = connect(ctx, flags.endpoint)
-    try {
-      const box = await runningBox(connection, record.box)
-      const outcome = await offloader(ctx, connection, box, stderr).back(key, {
-        interrupt: Boolean(flags.interrupt),
-        onEntry: (e) => stderr.write(`box agent ${e.kind} #${e.seq}${e.kind === 'question' ? ':\n' + e.body : ''}\n`),
-      })
-      const landing = outcome.landing ? landingSummary(outcome.landing) : 'no repo'
-      if (flags.json) return json(stdout, { ok: true, landing, handover: outcome.handover, file: outcome.file, offload_id: record.id }), 0
-      stdout.write(`${landing}\nThe box agent's hand-over (also in ${outcome.file}):\n\n${outcome.handover}\n`)
-      return 0
-    } finally {
-      connection.close()
-    }
-  } catch (err) {
-    if (err instanceof OffloadError) return offloadFailed(err, flags, { stdout, stderr })
-    throw new Error(describe(err))
-  }
-}
-
-// ---------- the box CLI: install and sign in ----------
-
-async function boxCli(ctx, flags, sub, kindName, { stdout, stderr }) {
-  if (!kindName) throw new OffloadError('failed', 'name the box CLI with --kind claude, codex or cursor')
-  const k = kindOf(kindName)
-  const connection = connect(ctx, flags.endpoint)
-  try {
-    const box = await runningBox(connection, flags.box)
-    if (sub === 'install-cli') {
-      // The vendor's official installer, as the box's desktop user into its home, so it stays across saves and upgrades.
-      stderr.write(`box: installing ${k.title} in ${box.name}: ${k.install}\n`)
-      const code = await attach(connection, box.id, { command: k.install }, { stdin: null })
-      if (code !== 0) {
-        stderr.write(`box: the installer failed (exit ${code})\n`)
-        return 1
-      }
-      stdout.write(`installed ${k.title} in ${box.name}; next: ${CMD} offload sign-in --kind ${kindName}${flags.box ? ` --box ${flags.box}` : ''}\n`)
-      return 0
-    }
-    if (!process.stdin.isTTY) throw new OffloadError('failed', 'sign-in needs a terminal: the CLI asks you to paste a code')
-    // The CLI's own login on a terminal in the box. Its first https link on the vendor's own hosts opens here, once; the
-    // box is untrusted, so no other link from its output is opened. The login stays in the box.
-    stderr.write(`box: signing ${k.title} in inside ${box.name}. Approve in the browser, then paste the code here.\n`)
-    let seen = ''
-    let opened = false
-    const tap = (data) => {
-      if (opened) return
-      seen = (seen + data.toString('utf8')).slice(-(64 << 10))
-      const link = findSignInLink(seen, kindName)
-      if (!link) return
-      opened = true
-      openBrowser(link, { env: ctx.env })
-      stderr.write(`\r\nbox: opened the sign-in page in your browser (${new URL(link).hostname})\r\n`)
-    }
-    const term = ctx.env.TERM || ''
-    const code = await attach(
-      connection,
-      box.id,
-      { command: loginCommand(kindName), tty: { term, window: { rows: process.stdout.rows || 24, cols: process.stdout.columns || 80 } } },
-      { tty: true, tap },
-    )
-    stdout.write(code === 0 ? `\nsigned ${k.title} in inside ${box.name}\n` : `\nthe sign-in ended with exit ${code}\n`)
-    return code === 0 ? 0 : 1
-  } finally {
-    connection.close()
-  }
-}
-
diff --git a/cli/src/offload/env-probe.js b/cli/src/offload/env-probe.js
deleted file mode 100644
index 990940e..0000000
--- a/cli/src/offload/env-probe.js
+++ /dev/null
@@ -1,69 +0,0 @@
-import fs from 'node:fs'
-import path from 'node:path'
-import { runSync } from './run.js'
-
-// EnvProbe writes env.json: the versions this computer runs of the tools the repo uses, its package manager, and which
-// toolchain files and lockfiles it has (contracts.md "Environment"). Ported from upstream OffloadEnvironment.swift.
-
-export const FILES = [
-  '.mise.toml', 'mise.toml', '.tool-versions', '.nvmrc', '.node-version', '.python-version', '.go-version', 'rust-toolchain',
-  'rust-toolchain.toml', 'go.mod', 'package.json', 'Cargo.toml', '.devcontainer/devcontainer.json', 'flake.nix', 'shell.nix',
-]
-export const LOCKFILES = ['go.sum', 'Cargo.lock', 'package-lock.json', 'pnpm-lock.yaml', 'yarn.lock', 'uv.lock']
-
-const TOOLS = [
-  { name: 'go', markers: ['go.mod', 'go.sum', '.go-version'], argv: ['go', 'env', 'GOVERSION'] },
-  { name: 'rust', markers: ['Cargo.toml', 'rust-toolchain', 'rust-toolchain.toml'], argv: ['rustc', '-V'] },
-  { name: 'node', markers: ['package.json', '.nvmrc', '.node-version', 'package-lock.json', 'pnpm-lock.yaml', 'yarn.lock'], argv: ['node', '-v'] },
-  { name: 'python', markers: ['pyproject.toml', 'requirements.txt', 'setup.py', 'uv.lock', '.python-version'], argv: ['python3', '-V'] },
-]
-const MANAGERS = [
-  { lockfile: 'pnpm-lock.yaml', name: 'pnpm', argv: ['pnpm', '-v'] },
-  { lockfile: 'yarn.lock', name: 'yarn', argv: ['yarn', '-v'] },
-  { lockfile: 'package-lock.json', name: 'npm', argv: ['npm', '-v'] },
-  { lockfile: 'uv.lock', name: 'uv', argv: ['uv', '--version'] },
-]
-
-export function envJson(top, env) {
-  const exists = (name) => fs.existsSync(path.join(top, name))
-  const tools = {}
-  for (const tool of TOOLS) {
-    if (!tool.markers.some(exists)) continue
-    const v = version(tool.argv, env)
-    if (v) tools[tool.name] = v
-  }
-  const managers = {}
-  let pinned = null
-  try {
-    pinned = JSON.parse(fs.readFileSync(path.join(top, 'package.json'), 'utf8')).packageManager
-  } catch {
-    // no package.json
-  }
-  if (typeof pinned === 'string' && pinned.includes('@')) {
-    const at = pinned.indexOf('@')
-    managers[pinned.slice(0, at)] = pinned.slice(at + 1).split('+')[0]
-  } else {
-    for (const m of MANAGERS) {
-      if (!exists(m.lockfile)) continue
-      const v = version(m.argv, env)
-      if (v) managers[m.name] = v
-    }
-  }
-  const sorted = (o) => Object.fromEntries(Object.entries(o).sort(([a], [b]) => (a < b ? -1 : 1)))
-  return JSON.stringify({ files: FILES.filter(exists), lockfiles: LOCKFILES.filter(exists), package_managers: sorted(managers), tools: sorted(tools), v: 1 })
-}
-
-/** version takes the first version-looking word of a tool's output: go1.26.5, rustc 1.88.0, v22.11.0, Python 3.12.7. */
-export function version(argv, env) {
-  const r = runSync(argv, { env, timeoutMs: 10000 })
-  if (r.status !== 0) return null
-  return parseVersion(r.text)
-}
-
-export function parseVersion(text) {
-  for (const word of text.split(/\s+/)) {
-    const trimmed = word.replace(/^[^0-9]+/, '')
-    if (/^[0-9]/.test(trimmed) && trimmed.includes('.')) return trimmed
-  }
-  return null
-}
diff --git a/cli/src/offload/git.js b/cli/src/offload/git.js
deleted file mode 100644
index 4485d03..0000000
--- a/cli/src/offload/git.js
+++ /dev/null
@@ -1,273 +0,0 @@
-import fs from 'node:fs'
-import path from 'node:path'
-import { repoKey } from './model.js'
-import { runSync, run } from './run.js'
-
-// GitRepo runs git in one work tree for the packer: the snapshot, the ignored list, the bundle and the merge at back.
-// Ported from upstream loomhand/cocoonbox macos/Sources/CocoonBoxKit/OffloadGit.swift.
-
-export class OffloadError extends Error {
-  constructor(kind, message, { findings = [], reply } = {}) {
-    super(message)
-    this.kind = kind // handover | refused | needsYes | box | failed
-    this.findings = findings
-    this.reply = reply
-  }
-}
-
-const IDENT = { GIT_AUTHOR_NAME: 'box', GIT_AUTHOR_EMAIL: 'box@localhost', GIT_COMMITTER_NAME: 'box', GIT_COMMITTER_EMAIL: 'box@localhost' }
-
-export class GitRepo {
-  constructor(top, env) {
-    this.top = top
-    this.env = env
-  }
-
-  /** open finds the top level of the repository dir is in; null outside one. */
-  static open(dir, env = process.env) {
-    const r = runSync(['git', '-C', dir, 'rev-parse', '--show-toplevel'], { env })
-    if (r.status !== 0 || !r.text) return null
-    return new GitRepo(r.text, env)
-  }
-
-  run(args, { input, extra = {} } = {}) {
-    return runSync(['git', '-C', this.top, ...args], { env: { ...this.env, ...extra }, input })
-  }
-
-  runAsync(args, { extra = {} } = {}) {
-    return run(['git', '-C', this.top, ...args], { env: { ...this.env, ...extra } })
-  }
-
-  git(args, opts) {
-    const r = this.run(args, opts)
-    if (r.status !== 0) throw new OffloadError('failed', `git ${args.slice(0, 2).join(' ')}: ${r.error.split('\n').pop() || `exit ${r.status}`}`)
-    return r.text
-  }
-
-  verify(rev) {
-    const r = this.run(['rev-parse', '-q', '--verify', `${rev}^{commit}`])
-    return r.status === 0 ? r.text : null
-  }
-
-  get head() {
-    return this.verify('HEAD')
-  }
-
-  /** root is the oldest root commit of HEAD, empty for an unborn HEAD. */
-  get root() {
-    if (!this.head) return ''
-    const r = this.run(['rev-list', '--max-parents=0', 'HEAD'])
-    return r.status === 0 ? r.text.split('\n').pop() : ''
-  }
-
-  get key() {
-    return repoKey(this.top, this.root)
-  }
-
-  /** linked is true for a linked worktree, whose .git is a file naming a local path. */
-  get linked() {
-    try {
-      return fs.statSync(path.join(this.top, '.git')).isFile()
-    } catch {
-      return false
-    }
-  }
-
-  gitPath(name) {
-    const p = this.git(['rev-parse', '--git-path', name])
-    return path.isAbsolute(p) ? p : path.join(this.top, p)
-  }
-
-  /** snapshot commits the work tree, tracked and untracked files that are not ignored, through a temporary index over HEAD's tree. */
-  snapshot(index, message) {
-    fs.rmSync(index, { force: true })
-    try {
-      const real = this.gitPath('index')
-      if (fs.existsSync(real)) fs.copyFileSync(real, index)
-      const extra = { GIT_INDEX_FILE: index }
-      const head = this.head
-      if (head) {
-        if (this.run(['read-tree', '-m', head], { extra }).status !== 0) this.git(['read-tree', head], { extra })
-      } else this.git(['read-tree', '--empty'], { extra })
-      this.git(['add', '-A'], { extra })
-      const tree = this.git(['write-tree'], { extra })
-      return this.git(['commit-tree', tree, ...(head ? ['-p', head] : []), '-m', message], { extra: IDENT })
-    } finally {
-      fs.rmSync(index, { force: true })
-    }
-  }
-
-  /** keepIndex points ref at a commit of the index's tree, so a bundle carries staged content no other ref reaches. */
-  keepIndex(ref, scratch) {
-    fs.rmSync(scratch, { force: true })
-    try {
-      const real = this.gitPath('index')
-      if (!fs.existsSync(real)) return
-      fs.copyFileSync(real, scratch)
-      const w = this.run(['write-tree'], { extra: { GIT_INDEX_FILE: scratch } })
-      if (w.status !== 0) return // a conflicted index is left out
-      this.git(['update-ref', ref, this.git(['commit-tree', w.text, '-m', 'box index'], { extra: IDENT })])
-    } finally {
-      fs.rmSync(scratch, { force: true })
-    }
-  }
-
-  /** ignored lists the git-ignored entries, directories ending in /, relative to the top level. */
-  ignored() {
-    const r = this.run(['ls-files', '-z', '-o', '-i', '--exclude-standard', '--directory'])
-    if (r.status !== 0) throw new OffloadError('failed', `git ls-files: ${r.error}`)
-    return r.out.toString('utf8').split('\0').filter(Boolean)
-  }
-
-  /** bundle writes every ref's history the box lacks to file; false when there is none. */
-  bundle(file, notRefs) {
-    fs.rmSync(file, { force: true })
-    const known = notRefs.length
-      ? this.run(['cat-file', '--batch-check'], { input: notRefs.map((r) => r + '\n').join('') })
-          .text.split('\n')
-          .filter((l) => l && !l.endsWith(' missing'))
-          .map((l) => l.split(' ')[0])
-      : []
-    const r = this.run(['bundle', 'create', '-q', file, '--all', ...(known.length ? ['--not', ...known] : [])])
-    if (r.status === 0) return true
-    if (r.error.includes('empty bundle')) return false
-    throw new OffloadError('failed', `git bundle: ${r.error}`)
-  }
-
-  // ---------- back ----------
-
-  /**
-   * land brings the box's snapshot S' home against base S: a fast-forward when this repo still equals S, else a clean
-   * three-way merge applied uncommitted that leaves the user's uncommitted paths alone, else a branch at S' with this
-   * work tree untouched. Returns {kind: unchanged|fastForward|merged|branch, files?, branch?, conflicts?}; fastForward and
-   * merged also carry head (the box's commit HEAD's branch moved to, else null) and uncommitted (paths the work tree holds
-   * beyond that HEAD).
-   */
-  land({ id, base, box, index, now = new Date() }) {
-    const start = this.verify(base + '^')
-    const boxHead = this.verify(box + '^')
-    const head = this.head
-    const local = this.snapshot(index, 'box local')
-    const tree = (c) => this.git(['rev-parse', c + '^{tree}'])
-    const [baseTree, localTree, boxTree] = [tree(base), tree(local), tree(box)]
-    if (boxTree === baseTree && boxHead === start) return { kind: 'unchanged' }
-    const follows = boxHead ? (start ? boxHead === start || this.run(['merge-base', '--is-ancestor', start, boxHead]).status === 0 : true) : false
-    const move = boxHead && boxHead !== head && head === start && follows ? { old: head, new: boxHead } : null
-    // uncommitted lists what the work tree now holds that the (possibly moved) HEAD does not
-    const uncommitted = (to) => {
-      const at = move ? move.new : head
-      return this.git(['diff-tree', '-r', '--name-only', '--no-renames', at ? tree(at) : this.git(['mktree'], { input: '' }), to]).split('\n').filter(Boolean)
-    }
-    if (head === start && localTree === baseTree && (follows || !boxHead)) {
-      if (!this.#settle({ id, from: base, to: box, move, scratch: index })) return this.#branch(box, [], now)
-      return { kind: 'fastForward', head: move ? move.new : null, uncommitted: uncommitted(boxTree) }
-    }
-    const merge = this.run(['merge-tree', '--write-tree', '--name-only', `--merge-base=${base}`, local, box])
-    const lines = merge.out.toString('utf8').replace(/\n$/, '').split('\n')
-    if (merge.status !== 0 || !lines[0]) {
-      const conflicts = []
-      if (merge.status === 1) for (const l of lines.slice(1)) {
-        if (!l) break
-        conflicts.push(l)
-      }
-      return this.#branch(box, conflicts, now)
-    }
-    const merged = lines[0]
-    const files = this.git(['diff-tree', '-r', '--name-only', '--no-renames', localTree, merged]).split('\n').filter(Boolean)
-    const headTree = head ? tree(head) : this.git(['mktree'], { input: '' })
-    const dirty = new Set(this.git(['diff-tree', '-r', '--name-only', '--no-renames', headTree, localTree]).split('\n').filter(Boolean))
-    const touched = files.filter((f) => dirty.has(f))
-    if (touched.length) return this.#branch(box, touched, now)
-    if (!this.#settle({ id, from: localTree, to: merged, move, scratch: index })) return this.#branch(box, [], now)
-    return { kind: 'merged', files, head: move ? move.new : null, uncommitted: uncommitted(merged) }
-  }
-
-  // settle moves the work tree between trees and, with move, HEAD's branch and the index; the index is built aside under
-  // git's index.lock first, so a held lock or a patch that does not apply changes nothing.
-  #settle({ id, from, to, move, scratch }) {
-    let lock = null
-    try {
-      if (move) {
-        fs.rmSync(scratch, { force: true })
-        try {
-          const real = this.gitPath('index')
-          if (fs.existsSync(real)) fs.copyFileSync(real, scratch)
-          const extra = { GIT_INDEX_FILE: scratch }
-          let carried = false
-          if (move.old) {
-            const patch = this.#diff(move.old, move.new)
-            carried = !patch.length || this.run(['apply', '--cached', '--binary', '--whitespace=nowarn', '-'], { input: patch, extra }).status === 0
-          }
-          if (!carried) this.git(['read-tree', '-m', move.new], { extra })
-          const lockPath = this.gitPath('index.lock')
-          let fd
-          try {
-            fd = fs.openSync(lockPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, 0o644)
-          } catch {
-            throw new OffloadError('failed', `another git command holds ${lockPath}; nothing changed, try again`)
-          }
-          lock = lockPath
-          fs.writeSync(fd, fs.readFileSync(scratch))
-          fs.closeSync(fd)
-        } finally {
-          fs.rmSync(scratch, { force: true })
-        }
-      }
-      const patch = this.#diff(from, to)
-      if (patch.length && this.run(['apply', '--binary', '--whitespace=nowarn', '-'], { input: patch }).status !== 0) return false
-      if (move && lock) {
-        if (move.old) this.git(['update-ref', `refs/cocoonbox/pre-back/${id}`, move.old])
-        const sym = this.run(['symbolic-ref', '-q', 'HEAD'])
-        const ref = sym.status === 0 && sym.text ? [sym.text] : ['--no-deref', 'HEAD']
-        this.git(['update-ref', '-m', 'box back', ...ref, move.new, ...(move.old ? [move.old] : [])])
-        fs.renameSync(lock, this.gitPath('index'))
-        lock = null
-        this.run(['update-index', '-q', '--refresh'])
-      }
-      return true
-    } finally {
-      if (lock) fs.rmSync(lock, { force: true })
-    }
-  }
-
-  // diff is a binary patch between two trees that the user's diff settings cannot change.
-  #diff(from, to) {
-    const r = this.run([
-      'diff-tree', '-p', '--binary', '--full-index', '--no-renames', '--no-ext-diff', '--no-textconv', '--no-color',
-      '--src-prefix=a/', '--dst-prefix=b/', from, to,
-    ])
-    if (r.status !== 0) throw new OffloadError('failed', `git diff-tree: ${r.error}`)
-    return r.out
-  }
-
-  #branch(box, conflicts, now) {
-    const stamp = now.toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, 'Z')
-    const name = `cocoonbox/back-${stamp}`
-    this.git(['branch', '-f', name, box])
-    return { kind: 'branch', branch: name, conflicts }
-  }
-}
-
-const left = (paths) => (paths && paths.length ? `; uncommitted: ${paths.join(', ')}` : '')
-
-export function landingSummary(l) {
-  switch (l.kind) {
-    case 'unchanged':
-      return 'unchanged: the box made no change'
-    case 'fastForward':
-      return l.head
-        ? `fast-forward: this branch now points at the box's commit ${l.head.slice(0, 7)}${left(l.uncommitted)}`
-        : `fast-forward: the box made no commit; its changes are applied uncommitted (${(l.uncommitted || []).join(', ')})`
-    case 'merged':
-      return l.head
-        ? `merged: this branch now points at the box's commit ${l.head.slice(0, 7)}; the changes you made meanwhile are kept${left(l.uncommitted)}`
-        : `merged: the box's changes are applied uncommitted (${l.files.join(', ')})`
-    case 'branch':
-      return (
-        `conflict: the box's work is on the branch ${l.branch}; your work tree is untouched` +
-        (l.conflicts.length ? ` (it conflicts with, or would change your uncommitted, ${l.conflicts.join(', ')})` : '')
-      )
-    default:
-      return l.kind
-  }
-}
diff --git a/cli/src/offload/model.js b/cli/src/offload/model.js
deleted file mode 100644
index 494d983..0000000
--- a/cli/src/offload/model.js
+++ /dev/null
@@ -1,192 +0,0 @@
-import crypto from 'node:crypto'
-import path from 'node:path'
-
-// Ported from upstream loomhand/cocoonbox macos/Sources/CocoonBoxKit/Offload.swift and SignInLink.swift
-// (contracts.md "Offload"). The box side is cocoonbox-agent's, unchanged in simular-ai/box.
-
-/** The box CLIs a task can continue in. */
-export const KINDS = {
-  claude: {
-    title: 'Claude Code',
-    executable: 'claude',
-    install: 'curl -fsSL https://claude.ai/install.sh | bash',
-    login: 'claude auth login',
-    hosts: ['claude.ai', 'claude.com', 'anthropic.com'],
-  },
-  codex: {
-    title: 'Codex',
-    executable: 'codex',
-    install: 'curl -fsSL https://github.com/openai/codex/releases/latest/download/install.sh | CODEX_NON_INTERACTIVE=1 sh',
-    login: 'codex login --device-auth',
-    hosts: ['auth.openai.com', 'chatgpt.com'],
-  },
-  cursor: {
-    title: 'Cursor',
-    executable: 'cursor-agent',
-    install: 'curl -fsSL https://cursor.com/install | bash',
-    login: 'cursor-agent login',
-    hosts: ['cursor.com'],
-  },
-}
-
-export function kind(name) {
-  const k = KINDS[name]
-  if (!k) throw new Error('--kind is claude, codex or cursor')
-  return { name, ...k }
-}
-
-/** loginCommand keeps the box's browser shut, so the user approves on this computer. */
-export function loginCommand(name) {
-  return `BROWSER=true NO_OPEN_BROWSER=1 ${kind(name).login}`
-}
-
-/** currentKind is the coding agent this process runs under; only Claude Code says so. */
-export function currentKind(env) {
-  return env.CLAUDECODE === '1' ? 'claude' : null
-}
-
-// ---------- hand-over ----------
-
-export const HANDOVER_TITLE = '# Hand-over: '
-export const HANDOVER_HEADINGS = [
-  '## Goal and definition of done',
-  '## User preferences and constraints',
-  '## Current state',
-  '## Decisions made',
-  '## Files touched',
-  '## Next steps',
-  '## Commands',
-  '## Environment facts',
-  '## Gotchas learned',
-  '## Open questions',
-]
-export const HANDOVER_LIMIT = 256 << 10
-
-export const HANDOVER_TEMPLATE = `# Hand-over: <one-line goal>
-
-From: <local | box>   Agent: <claude|codex|cursor>   Repo: <path>   Branch: <branch> @ <short sha>
-
-## Goal and definition of done
-<what the user asked for, in their words where it matters; what "done" means>
-
-## User preferences and constraints
-<style, scope limits, things the user said not to do, deadlines; or none>
-
-## Current state
-<where the work stands in one paragraph: what works, what is broken, what is half-done>
-
-## Decisions made
-- <decision> — <why>; rejected: <alternative and why>
-
-## Files touched
-- \`<path>\` — <what changed and why; whether it is finished>
-
-## Next steps
-1. <the very next action, specific enough to start without asking>
-2. <…>
-
-## Commands
-- Build: \`<command>\`   Test: \`<command>\`   Lint: \`<command>\`   Run: \`<command>\`
-- Verify the current state: \`<command>\` → <what passing looks like>
-
-## Environment facts
-- Tools and versions: <go 1.26.x, rustc 1.9x, node 22.x, …; where each came from>
-- Services: <local databases, ports, docker compose services; or none>
-- Hosts: <APIs or internal hosts the task calls; or none>
-- Secrets needed: <names only, never values; or none>
-- Installed during this session: <packages and tools added; or none>
-
-## Gotchas learned
-- <non-obvious things that cost time: flaky tests, a wrong doc, a tool quirk>
-
-## Open questions
-- <what needs the user, and what to do meanwhile>
-`
-
-/** handoverProblems lists what breaks the template; empty for a valid hand-over. */
-export function handoverProblems(text) {
-  const problems = []
-  if (Buffer.byteLength(text) > HANDOVER_LIMIT) problems.push(`larger than ${HANDOVER_LIMIT >> 10} KiB`)
-  const lines = text.split('\n').map((l) => (l.endsWith('\r') ? l.slice(0, -1) : l))
-  if (!(lines[0] || '').startsWith(HANDOVER_TITLE)) problems.push(`the first line does not start with "${HANDOVER_TITLE}"`)
-  for (const heading of HANDOVER_HEADINGS) {
-    const count = lines.filter((l) => l.trim() === heading).length
-    if (count === 0) problems.push(`missing "${heading}"`)
-    if (count > 1) problems.push(`"${heading}" appears ${count} times`)
-  }
-  return problems
-}
-
-/** section returns the lines under heading, up to the next ## heading. */
-export function section(text, heading) {
-  let inside = false
-  const out = []
-  for (const line of text.split('\n')) {
-    const t = line.trim()
-    if (t.startsWith('## ')) {
-      inside = t === heading
-      continue
-    }
-    if (inside) out.push(line)
-  }
-  return out
-}
-
-// ---------- names ----------
-
-const sha256 = (s) => crypto.createHash('sha256').update(s).digest('hex')
-
-/** repoKey is the first 12 hex of sha256 of the top level and the oldest root commit of HEAD. */
-export function repoKey(top, root) {
-  return sha256(`${top}\n${root}`).slice(0, 12)
-}
-
-/** copyName is the box copy's name before the box adds a -2, -3 suffix. */
-export function copyName(top) {
-  const mapped = [...path.basename(top)].map((c) => (/[A-Za-z0-9._-]/.test(c) ? c : '-')).join('')
-  const name = mapped.replace(/^\.+/, '').slice(0, 64)
-  return name || 'repo'
-}
-
-export function newId() {
-  return crypto.randomBytes(6).toString('hex')
-}
-
-export function tmuxSession(record) {
-  return `cb-off-${record.repo}-${record.kind}`
-}
-
-// ---------- sign-in link ----------
-
-// The box is untrusted: only an https link on the vendor's own hosts may open in the local browser.
-// eslint-disable-next-line no-control-regex
-const OSC8 = /\x1B\]8;[^;\x07\x1B]*;([^\x07\x1B]+)(?:\x07|\x1B\\)/g
-// eslint-disable-next-line no-control-regex
-const ESCAPES = /\x1B(?:\][^\x07\x1B]*(?:\x07|\x1B\\)|\[[0-?]*[ -/]*[@-~]|[@-Z\\-_])/g
-// A link is only RFC 3986 URL characters; quotes, spaces, control bytes, ^ | < > \ { } and backticks end it.
-const LINK = /https:\/\/[A-Za-z0-9\-._~:/?#[\]@!$&*+,;=%]+/g
-const WHOLE_LINK = /^https:\/\/[A-Za-z0-9\-._~:/?#[\]@!$&*+,;=%]+$/
-
-/** findSignInLink returns the first allowed link in output: an OSC 8 target, else a link in the text without escapes. */
-export function findSignInLink(output, kindName) {
-  const targets = [...output.matchAll(OSC8)].map((m) => m[1])
-  const text = output.replace(ESCAPES, '')
-  const links = [...text.matchAll(LINK)].map((m) => m[0].replace(/[.,;:!?)\]}]+$/, ''))
-  for (const candidate of [...targets, ...links]) {
-    // the parsed, normalized form is what opens; a target with characters outside a URL's is skipped
-    if (WHOLE_LINK.test(candidate) && signInAllowed(candidate, kindName)) return new URL(candidate).href
-  }
-  return null
-}
-
-export function signInAllowed(link, kindName) {
-  let url
-  try {
-    url = new URL(link)
-  } catch {
-    return false
-  }
-  if (url.protocol !== 'https:' || url.username || url.password) return false
-  const host = url.hostname.toLowerCase()
-  return kind(kindName).hosts.some((h) => host === h || host.endsWith('.' + h))
-}
diff --git a/cli/src/offload/offloader.js b/cli/src/offload/offloader.js
deleted file mode 100644
index 0b53c14..0000000
--- a/cli/src/offload/offloader.js
+++ /dev/null
@@ -1,392 +0,0 @@
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { frames } from '../box/connection.js'
-import { envJson } from './env-probe.js'
-import { GitRepo, OffloadError } from './git.js'
-import { copyName, handoverProblems, kind as kindOf, newId } from './model.js'
-import { finding, imageFinding, localFindings, sizeFinding } from './preflight.js'
-import { quote, run, runSync } from './run.js'
-import { tarParts } from './tar.js'
-
-// Offloader is the local packer (design.md §27): the preflight, the snapshot, the transfer and the way back, over
-// Session.Exec to `cocoonbox-agent offload` in the box and rsync and git over `rsh`. Ported from upstream
-// loomhand/cocoonbox macos/Sources/CocoonBoxKit/Offloader.swift.
-
-export const BACK_WAIT_S = 600
-// How long a BACK may go without any hook from the box CLI before it is pasted again.
-export const BACK_RETRY_S = 60
-// How often back polls the box CLI's status while it waits for it to go idle before asking for the hand-over.
-export const IDLE_POLL_MS = 2000
-
-export class Offloader {
-  /**
-   * rsh is the remote-shell command rsync and git run (this CLI's `rsh --box <id>`); its children get the endpoint and
-   * token through env, never argv.
-   */
-  constructor({ connection, box, store, rsh, env, progress = () => {} }) {
-    this.connection = connection
-    this.box = box
-    this.store = store
-    this.rsh = rsh
-    this.env = env
-    // Only rsync and git, which run this CLI's rsh, get the token; the preflight's and the probe's tools never see it.
-    this.rshEnv = { ...env, BOX_ENDPOINT: connection.endpoint, BOX_TOKEN: connection.token }
-    this.progress = progress
-  }
-
-  // ---------- offload ----------
-
-  async offload({ directory, kind, handover, yes }) {
-    const problems = handoverProblems(handover)
-    if (problems.length) throw new OffloadError('handover', `the hand-over breaks the template: ${problems.join('; ')}`)
-    kindOf(kind)
-    const timings = []
-    let lap = Date.now()
-    const mark = (step) => {
-      timings.push([step, Date.now() - lap])
-      lap = Date.now()
-    }
-    const findings = []
-    const img = imageFinding(this.box.image)
-    if (img) findings.push(img)
-    const repo = GitRepo.open(directory, this.env)
-    if (!repo) throw new OffloadError('refused', 'refused by the preflight; nothing changed', { findings: [finding('git', 'block', `${directory} is not in a git repository`)] })
-    const key = repo.key
-    const stage = this.store.directory(key)
-    const excludes = path.join(stage, 'excludes')
-    const bundle = path.join(stage, 'offload.bundle')
-    const refs = []
-    try {
-      if (runSync(['rsync', '--version'], { env: this.env }).status !== 0) {
-        findings.push(finding('rsync', 'block', 'rsync is not installed on this computer; offload copies the repo with it (macOS ships it; on Linux install the rsync package)'))
-      }
-      findings.push(...(await localFindings(repo, { handover, optedIn: this.store.secrets(key), env: this.env })))
-      fs.writeFileSync(excludes, repo.ignored().map((p) => '/' + escape(p) + '\n').join(''))
-      if (!this.store.sizeConfirmed(key)) {
-        const size = sizeFinding(this.dryRun(repo, excludes, stage))
-        if (size) findings.push(size)
-      }
-      mark('preflight')
-      if (findings.some((f) => f.outcome === 'block')) throw refused(findings)
-
-      const id = newId()
-      const name = copyName(repo.top)
-      let begin
-      try {
-        begin = await this.verb(['begin', '--repo', key, '--name', name, '--kind', kind, '--id', id])
-      } catch (err) {
-        if (err instanceof OffloadError && err.kind === 'box' && err.reply?.code === 'refused') {
-          const refusal = replyFindings(err.reply)
-          throw refused([...findings, ...(refusal.length ? refusal : [finding('box', 'block', err.message)])])
-        }
-        throw err
-      }
-      findings.push(...replyFindings(begin))
-      mark('begin')
-      if (findings.some((f) => f.outcome === 'block')) throw refused(findings)
-      if (!yes && findings.length) throw new OffloadError('needsYes', "the preflight has warnings; go on only with the user's yes (--yes)", { findings })
-      const dir = begin.dir
-      if (!dir) throw new OffloadError('failed', 'begin named no directory')
-      if (Array.isArray(begin.ignored) && begin.ignored.length) fs.appendFileSync(excludes, begin.ignored.map((p) => '/' + escape(p) + '\n').join(''))
-
-      refs.push(`refs/cocoonbox/offload/${id}`, `refs/cocoonbox/index/${id}`)
-      const record = {
-        id, repo: key, box: this.box.id, box_name: this.box.name, name, dir, kind, base: null, top: repo.top,
-        started_at_ms: Date.now(), seen: 0,
-      }
-      let sent = 0
-      let sending = false
-      let reply
-      try {
-        const members = [['handover.md', Buffer.from(handover)]]
-        const index = path.join(stage, 'snapshot.index')
-        const snapshot = repo.snapshot(index, `box offload ${id}`)
-        record.base = snapshot
-        repo.git(['update-ref', refs[0], snapshot])
-        repo.keepIndex(refs[1], index)
-        const env = envJson(repo.top, this.env)
-        fs.writeFileSync(path.join(stage, 'env.json'), env)
-        members.push(['env.json', Buffer.from(env)])
-        mark('snapshot')
-        sent = await this.rsync(repo, dir, excludes)
-        mark('rsync')
-        if (repo.bundle(bundle, Object.values(begin.refs || {}))) {
-          members.push(['offload.bundle', { file: bundle }])
-          sent += fs.statSync(bundle).size
-        }
-        if (repo.linked) {
-          members.push(['HEAD', fs.readFileSync(repo.gitPath('HEAD'))])
-          members.push(['index', fs.readFileSync(repo.gitPath('index'))])
-        }
-        for (const [n, data] of this.secrets(this.store.secrets(key), repo.top)) members.push([n, data])
-        mark('bundle')
-        this.store.save(record)
-        sending = true
-        reply = await this.verb(['send', '--repo', key, '--kind', kind, '--id', id], tarParts(members))
-        mark('send')
-      } catch (err) {
-        // a send cut off in transit may have started the box CLI, so its record stays for back
-        if (sending && !(err instanceof OffloadError)) {
-          throw new OffloadError('failed', `the connection broke while the box took the task (${err.message}); check \`npx @simular-ai/box offload status\`, then offload again or bring it back`)
-        }
-        this.store.remove(key)
-        for (const ref of refs) repo.run(['update-ref', '-d', ref])
-        throw err
-      }
-      if (findings.some((f) => f.check === 'size')) this.store.confirmSize(key)
-      const cli = begin.cli || {}
-      if (cli.hooks_blocked) this.progress(`warning: ${cli.hooks_blocked} turns off the hooks the box reads the CLI's status from; it reads the transcript instead`)
-      const account = cli.account ? `, signed in as ${cli.account}` : ''
-      return { record, accepted: Boolean(reply.accepted), findings, cli: `${kindOf(kind).title} ${cli.version || ''}`.trim() + account, timings, sent }
-    } finally {
-      fs.rmSync(excludes, { force: true })
-      fs.rmSync(bundle, { force: true })
-    }
-  }
-
-  /** rsync copies the work tree and .git without its objects, leaving the box's ignored files alone; returns the bytes sent. */
-  async rsync(repo, dir, excludes) {
-    const report = path.join(path.dirname(excludes), 'rsh-report')
-    fs.rmSync(report, { force: true })
-    try {
-      const argv = ['rsync', '-az', '--stats', '--delete', `--exclude-from=${excludes}`, '--exclude=/.git/objects/', ...(repo.linked ? ['--exclude=/.git'] : []), '-e', this.rsh, repo.top + '/', `box:${dir}/`]
-      const r = await run(argv, { env: { ...this.rshEnv, BOX_RSH_REPORT: report } })
-      if (r.status !== 0) {
-        let side = 'rsh never reported, so it did not start or was killed'
-        try {
-          const text = fs.readFileSync(report, 'utf8')
-          const [head, ...rest] = text.split('\n')
-          const tail = rest.join('\n').trim()
-          side = (head.startsWith('exit ') ? `the box command exited ${head.slice(5)}` : `rsh ${head}`) + (tail ? `, with stderr:\n${tail}` : '')
-        } catch {
-          // no report
-        }
-        throw new OffloadError('failed', `rsync to the box failed (${r.status}); ${side}\nrsync stderr:\n${r.error}`)
-      }
-      const line = r.text.split('\n').find((l) => l.startsWith('Total sent:') || l.startsWith('Total bytes sent:')) || ''
-      return Number(line.replace(/[^0-9]/g, '')) || 0
-    } finally {
-      fs.rmSync(report, { force: true })
-    }
-  }
-
-  /** dryRun is the bytes rsync would send to an empty copy. */
-  dryRun(repo, excludes, stage) {
-    const empty = fs.mkdtempSync(path.join(stage, 'dry-run-'))
-    try {
-      const argv = ['rsync', '-an', '--stats', `--exclude-from=${excludes}`, '--exclude=/.git/objects/', ...(repo.linked ? ['--exclude=/.git'] : []), repo.top + '/', empty + '/']
-      const res = runSync(argv, { env: this.env }).text
-      const line = res.split('\n').find((l) => l.startsWith('Total transferred file size:')) || ''
-      return Number(line.replace(/[^0-9]/g, '')) || 0
-    } finally {
-      fs.rmSync(empty, { recursive: true, force: true })
-    }
-  }
-
-  /** secrets reads the opted-in entries as stream members; values never reach argv, the environment or a log. */
-  secrets(entries, top) {
-    const home = this.env.HOME || os.homedir()
-    const read = (file, name) => {
-      try {
-        return [name, fs.readFileSync(file)]
-      } catch {
-        throw new OffloadError('failed', `the opted-in secret ${name} is missing on this computer (${file})`)
-      }
-    }
-    return entries.flatMap((entry) => {
-      if (entry.startsWith('file:')) return [read(path.join(top, entry.slice(5)), 'secrets/file/' + entry.slice(5))]
-      if (entry === 'aws') return [read(path.join(home, '.aws/credentials'), 'secrets/aws')]
-      if (entry === 'kube') return [read((this.env.KUBECONFIG || '').split(':')[0] || path.join(home, '.kube/config'), 'secrets/kube')]
-      if (entry === 'gcloud') {
-        const root = path.join(home, '.config/gcloud')
-        const out = []
-        const walk = (dir) => {
-          let list = []
-          try {
-            list = fs.readdirSync(dir, { withFileTypes: true })
-          } catch {
-            return
-          }
-          for (const d of list) {
-            const full = path.join(dir, d.name)
-            const rel = path.relative(root, full)
-            if (rel.startsWith('logs')) continue
-            if (d.isDirectory()) walk(full)
-            else if (d.isFile()) out.push(read(full, 'secrets/gcloud/' + rel))
-          }
-        }
-        walk(root)
-        return out
-      }
-      if (entry.startsWith('ssh:')) return [read(path.join(home, '.ssh', entry.slice(4)), 'secrets/ssh/' + entry.slice(4))]
-      throw new OffloadError('failed', `unknown secret entry ${entry}`)
-    })
-  }
-
-  // ---------- back ----------
-
-  /** back asks the box agent for its hand-over, waits for it, fetches the box's commits and lands them against S, then ends the box CLI session. */
-  async back(key, { interrupt = false, onEntry = () => {}, waitS = BACK_WAIT_S, retryS = BACK_RETRY_S, pollMs = IDLE_POLL_MS } = {}) {
-    const record = this.store.record(key)
-    if (!record) throw new OffloadError('failed', 'nothing of this repo is in the box')
-    let { entries } = await this.read(key, 0)
-    let back = [...entries].reverse().find((e) => e.kind === 'back' && e.offload_id === record.id)
-    let since = Math.max(0, ...entries.map((e) => e.seq))
-    // A pasted BACK that the box CLI never took (seen on prod: the paste vanished and the session stayed "working" with no
-    // hook) is pasted again once, with --interrupt so it is not queued behind that phantom turn.
-    let hookBefore = null
-    let retryAt = null
-    const deadline = Date.now() + waitS * 1000
-    if (!back) {
-      // BACK pasted while the box CLI is still ending a turn can vanish (delivery_unconfirmed), so wait for it to be idle;
-      // --interrupt stops the current step anyway and skips the wait.
-      if (!interrupt) await this.#untilIdle(key, deadline, waitS, pollMs)
-      hookBefore = await this.#hookAt(key)
-      const sent = await this.verb(['send', '--repo', key, '--back', ...(interrupt ? ['--interrupt'] : [])], [Buffer.alloc(0)])
-      this.progress('asked the box agent for its hand-over; waiting')
-      // only a paste into an idle CLI can vanish; a queued BACK waits for a real turn to end
-      if (sent.delivery === 'pasted') retryAt = Date.now() + retryS * 1000
-    }
-    while (!back) {
-      let left = Math.max(1, Math.ceil((deadline - Date.now()) / 1000))
-      if (retryAt) left = Math.min(left, Math.max(1, Math.ceil((retryAt - Date.now()) / 1000)))
-      const res = await this.read(key, since, left)
-      for (const entry of res.entries) {
-        since = Math.max(since, entry.seq)
-        if (entry.offload_id === record.id || !entry.offload_id) onEntry(entry)
-        if (entry.kind === 'blocked') throw new OffloadError('failed', `back is blocked in the box: ${entry.body}`)
-      }
-      back = [...res.entries].reverse().find((e) => e.kind === 'back' && e.offload_id === record.id)
-      if (!back && res.status === 'stopped') throw new OffloadError('failed', 'the box CLI session stopped without handing the work back')
-      if (!back && retryAt && Date.now() >= retryAt) {
-        retryAt = null
-        if (res.status === 'working' && (await this.#hookAt(key)) === hookBefore) {
-          this.progress('the box CLI has not taken BACK; asking again')
-          await this.verb(['send', '--repo', key, '--back', '--interrupt'], [Buffer.alloc(0)])
-        }
-      }
-      if (!back && Date.now() >= deadline) {
-        throw new OffloadError(
-          'failed',
-          `the box agent has not handed the work back after ${Math.round(waitS / 60)} min (status ${res.status}); BACK stays queued for its next idle. Run back again later, or back --interrupt to stop its current step`,
-        )
-      }
-    }
-    const file = this.store.back(key)
-    fs.writeFileSync(file, back.body)
-    let landing = null
-    if (record.base && record.top) {
-      const repo = GitRepo.open(record.top, this.env)
-      if (!repo) throw new OffloadError('failed', `${record.top} is no longer a git repository`)
-      const ref = `refs/cocoonbox/back/${record.id}`
-      const fetch = await repo.runAsync(['fetch', '-q', `box:${record.dir}`, '+refs/heads/*:refs/cocoonbox/box/*', `+${ref}:${ref}`], {
-        extra: { GIT_SSH_COMMAND: this.rsh, GIT_SSH_VARIANT: 'simple', BOX_ENDPOINT: this.rshEnv.BOX_ENDPOINT, BOX_TOKEN: this.rshEnv.BOX_TOKEN },
-      })
-      if (fetch.status !== 0) throw new OffloadError('failed', `git fetch from the box failed (${fetch.status}):\n${fetch.error}`)
-      landing = repo.land({ id: record.id, base: record.base, box: ref, index: path.join(this.store.directory(key), 'snapshot.index') })
-    }
-    await this.verb(['end', '--repo', key])
-    this.store.remove(key)
-    return { record, handover: back.body, file, landing }
-  }
-
-  /**
-   * untilIdle returns once the repo's box CLI session has been idle (or blocked, after an unconfirmed delivery) on two
-   * polls in a row, or at once when the box reports no session status. It fails on a stopped session, and when the
-   * session is still busy at the deadline, before anything was sent.
-   */
-  async #untilIdle(key, deadline, waitS, pollMs) {
-    let readyBefore = false
-    let said = false
-    for (;;) {
-      const status = (await this.status(key)).find((x) => x.repo === key)?.status || ''
-      if (status === 'stopped') throw new OffloadError('failed', 'the box CLI session stopped without handing the work back')
-      const ready = !status || status === 'idle' || status === 'blocked'
-      if (ready && (readyBefore || !status)) return
-      readyBefore = ready
-      if (!ready && !said) {
-        this.progress(`the box agent is ${status}; waiting for it to go idle before asking for its hand-over`)
-        said = true
-      }
-      if (Date.now() >= deadline) {
-        throw new OffloadError(
-          'failed',
-          `the box agent is still ${status} after ${Math.round(waitS / 60)} min; nothing was sent. Run back again later, or back --interrupt to stop its current step and hand back now`,
-        )
-      }
-      await new Promise((resolve) => setTimeout(resolve, Math.max(0, Math.min(pollMs, deadline - Date.now()))))
-    }
-  }
-
-  /** hookAt is when the repo's box CLI last ran a hook, from `offload status`; null when unknown. */
-  async #hookAt(key) {
-    try {
-      return (await this.status(key)).find((x) => x.repo === key)?.hook_at_ms ?? null
-    } catch {
-      return null
-    }
-  }
-
-  // ---------- inbox ----------
-
-  async read(key, since, wait) {
-    const reply = await this.verb(['read', '--repo', key, '--since', String(since), ...(wait ? ['--wait', String(wait)] : [])])
-    return { entries: reply.entries || [], status: reply.status || '' }
-  }
-
-  async status(key) {
-    const reply = await this.verb(['status', ...(key ? ['--repo', key] : [])])
-    return reply.sessions || []
-  }
-
-  /** send hands the box agent a message: pasted when it is idle, queued while it works. */
-  async send(key, message, interrupt) {
-    const reply = await this.verb(['send', '--repo', key, '--message', ...(interrupt ? ['--interrupt'] : [])], [Buffer.from(message)])
-    return reply.delivery || ''
-  }
-
-  // ---------- transport ----------
-
-  async verb(args, input = []) {
-    const command = 'cocoonbox-agent offload ' + args.map(quote).join(' ')
-    const { code, out, err } = await this.exec(command, input)
-    const line = out.toString('utf8').split('\n').filter(Boolean).pop() || ''
-    let reply
-    try {
-      reply = JSON.parse(line)
-    } catch {
-      const reason = err.split('\n').filter(Boolean).pop() || `exit ${code}`
-      throw new OffloadError('failed', `the box cannot run \`cocoonbox-agent offload ${args[0]}\` (${reason}); upgrade the box (npx @simular-ai/box doctor)`)
-    }
-    if (code !== 0 || reply.ok !== true) throw new OffloadError('box', `the box said ${reply.code || 'failed'}: ${reply.error || `exit ${code}`}`, { reply })
-    return reply
-  }
-
-  async exec(command, input = []) {
-    const out = []
-    let err = ''
-    const code = await this.connection.exec(this.box.id, { command }, frames(input), (data, isStderr) => {
-      if (!isStderr) return void out.push(data)
-      const text = data.toString('utf8')
-      err += text
-      for (const l of text.split('\n')) if (l) this.progress(l)
-    })
-    if (code === null) throw new OffloadError('failed', `the box ended \`${command.slice(0, 60)}\` without an exit code`)
-    return { code, out: Buffer.concat(out), err }
-  }
-}
-
-function refused(findings) {
-  return new OffloadError('refused', 'refused by the preflight; nothing changed', { findings })
-}
-
-/** replyFindings reads a box reply's findings, in begin's output and in its refusal. */
-export function replyFindings(reply) {
-  return (reply.findings || []).map((f) => finding(f.check || 'box', ['block', 'warn', 'confirm'].includes(f.outcome) ? f.outcome : 'warn', f.detail || ''))
-}
-
-/** escape makes a path a literal rsync pattern. */
-export function escape(p) {
-  return p.replace(/[*?[\\]/g, (c) => '\\' + c)
-}
diff --git a/cli/src/offload/preflight.js b/cli/src/offload/preflight.js
deleted file mode 100644
index f5be727..0000000
--- a/cli/src/offload/preflight.js
+++ /dev/null
@@ -1,290 +0,0 @@
-import dns from 'node:dns'
-import fs from 'node:fs'
-import path from 'node:path'
-import { section } from './model.js'
-import { runSync } from './run.js'
-
-// The local half of the offload preflight (contracts.md "Offload", Preflight), ported from upstream OffloadPreflight.swift.
-// A block stops with nothing changed; a warn, or a confirm (a warn naming the size), goes on only with the user's yes.
-// The lsof and scutil checks run where those tools exist (macOS, most Linux); elsewhere they find nothing.
-
-export const SIZE_LIMIT = 500_000_000
-const MAC_TOOLS = new Set(['xcodebuild', 'xcrun', 'security', 'launchctl', 'open'])
-const APPLE_PLATFORMS = new Set(['macOS', 'iOS', 'tvOS', 'watchOS', 'visionOS', 'macCatalyst', 'driverKit'])
-const COMMON_NAMES = new Set([
-  'HOME', 'PATH', 'USER', 'LOGNAME', 'SHELL', 'TERM', 'TMPDIR', 'PWD', 'LANG', 'LC_ALL', 'CI', 'DEBUG', 'EDITOR', 'TZ',
-  'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'http_proxy', 'https_proxy', 'no_proxy', 'XDG_CONFIG_HOME', 'XDG_CACHE_HOME', 'XDG_DATA_HOME',
-])
-
-export const finding = (check, outcome, detail) => ({ check, outcome, detail })
-
-/** imageFinding blocks an upstream cbdesk image older than v22; our sbxdesk images all carry the box packer, and begin checks the rest. */
-export function imageFinding(image) {
-  const m = /^cbdesk:v(\d+)/.exec(image || '')
-  if (!m || Number(m[1]) >= 22) return null
-  return finding('image', 'block', `the box runs ${image}, older than cbdesk:v22; upgrade the box first`)
-}
-
-export async function localFindings(repo, { handover, optedIn, env }) {
-  const files = repo.run(['ls-files', '-z', '-c', '-o', '--exclude-standard']).out.toString('utf8').split('\0').filter(Boolean)
-  let ignored = []
-  try {
-    ignored = repo.ignored()
-  } catch {
-    // reported by the caller's own ignored() call
-  }
-  const texts = configTexts(repo.top)
-  return [
-    ...macOSOnly(repo.top, files, handover),
-    ...services(texts, repo.top, env),
-    ...(await vpnHosts(repo, texts, env)),
-    ...secrets(repo, ignored, handover, optedIn, env),
-    ...carried(repo.top),
-  ]
-}
-
-// ---------- macOS-only work ----------
-
-export function macOSOnly(top, files, handover) {
-  const used = [...new Set(commands(handover).filter((c) => MAC_TOOLS.has(c)))].sort()
-  if (used.length) return [finding('macos-only', 'block', `the hand-over's Commands run ${used.join(', ')}, which the box (Linux) lacks`)]
-  const markers = new Set()
-  for (const file of files) {
-    const parts = file.split('/')
-    const bundle = parts.find((p) => p.endsWith('.xcodeproj') || p.endsWith('.xcworkspace'))
-    if (bundle) markers.add(bundle)
-    if (parts[parts.length - 1] === 'Podfile') markers.add(file)
-    if (parts[0] === 'fastlane' && parts.length > 1) markers.add('fastlane/')
-  }
-  try {
-    if (appleOnly(fs.readFileSync(path.join(top, 'Package.swift'), 'utf8'))) markers.add('Package.swift')
-  } catch {
-    // no manifest
-  }
-  if (!markers.size) return []
-  return [finding('macos-only', 'warn', `the repo has an Apple target (${[...markers].sort().slice(0, 4).join(', ')}); the box cannot build or run it`)]
-}
-
-/** commands lists the programs the hand-over's Commands section runs, from its code spans. */
-export function commands(handover) {
-  const spans = section(handover, '## Commands').join('\n').split('`')
-  const out = []
-  spans.forEach((span, i) => {
-    if (i % 2 === 0) return
-    for (const part of span.split(/[;|&\n]/)) {
-      const word = part.split(' ').filter(Boolean).find((w) => !w.includes('=') && !['sudo', 'env', 'time', 'exec', '$'].includes(w))
-      if (word) out.push(path.posix.basename(word))
-    }
-  })
-  return out
-}
-
-export function appleOnly(manifest) {
-  const start = manifest.indexOf('platforms:')
-  if (start < 0) return false
-  const open = manifest.indexOf('[', start)
-  const close = open < 0 ? -1 : manifest.indexOf(']', open)
-  if (open < 0 || close < 0) return false
-  const list = manifest.slice(open, close + 1)
-  const names = [...list.matchAll(/\.([A-Za-z]+)\(/g), ...list.matchAll(/\.([A-Za-z]+)\s*[,\]]/g)].map((m) => m[1])
-  return names.length > 0 && names.every((n) => APPLE_PLATFORMS.has(n))
-}
-
-// ---------- local services and hosts ----------
-
-/** configTexts is the repo's .env* files, compose files and top-level config, which name services and hosts. */
-export function configTexts(top) {
-  let names = []
-  try {
-    names = fs.readdirSync(top)
-  } catch {
-    return []
-  }
-  names = names.filter((name) => {
-    const lower = name.toLowerCase()
-    return (
-      lower.startsWith('.env') || lower.startsWith('docker-compose') || lower.startsWith('compose.') ||
-      ['.toml', '.yaml', '.yml', '.json', '.ini', '.conf', '.properties'].some((s) => lower.endsWith(s))
-    )
-  })
-  try {
-    names.push(...fs.readdirSync(path.join(top, 'config')).map((n) => 'config/' + n))
-  } catch {
-    // no config/
-  }
-  const out = []
-  for (const name of names.sort()) {
-    try {
-      const st = fs.statSync(path.join(top, name))
-      if (!st.isFile() || st.size > 256 << 10) continue
-      out.push({ name, text: fs.readFileSync(path.join(top, name), 'utf8') })
-    } catch {
-      // unreadable
-    }
-  }
-  return out
-}
-
-export function services(texts, top, env) {
-  const findings = []
-  const lsof = runSync(['lsof', '-nP', '-iTCP', '-sTCP:LISTEN', '-F', 'cn'], { env, timeoutMs: 5000 })
-  if (lsof.status === 0) {
-    const listening = new Map()
-    let command = ''
-    for (const line of lsof.text.split('\n')) {
-      if (line.startsWith('c')) command = line.slice(1)
-      if (line.startsWith('n')) {
-        const port = Number(line.split(':').pop())
-        if (Number.isInteger(port)) listening.set(port, command)
-      }
-    }
-    for (const [port, cmd] of [...listening].sort((a, b) => a[0] - b[0])) {
-      const file = texts.find((t) => namesPort(port, t.text))?.name
-      if (file) findings.push(finding('services', 'warn', `${cmd} listens on port ${port} on this computer, and ${file} names it; the box cannot reach it`))
-    }
-  }
-  const compose = runSync(['docker', 'compose', 'ls', '--format', 'json'], { env, timeoutMs: 5000 })
-  if (compose.status === 0) {
-    try {
-      for (const project of JSON.parse(compose.text)) {
-        if (String(project.ConfigFiles || '').includes(top + '/')) {
-          findings.push(finding('services', 'warn', `the docker compose project ${project.Name || ''} of this repo runs on this computer; the box has no container runtime`))
-        }
-      }
-    } catch {
-      // not JSON
-    }
-  }
-  return findings
-}
-
-export function namesPort(port, text) {
-  const p = String(port)
-  return [
-    new RegExp(`(localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|\\[::1\\]):${p}\\b`),
-    new RegExp(`port"?\\s*[:=]\\s*["']?${p}\\b`, 'i'),
-    new RegExp(`["' -]${p}:[0-9]+`),
-  ].some((re) => re.test(text))
-}
-
-export async function vpnHosts(repo, texts, env, { resolve = resolveHost } = {}) {
-  const hosts = []
-  const remotes = repo.run(['remote', '-v']).text
-  for (const line of remotes.split('\n')) {
-    const url = (line.split('\t')[1] || '').split(' ')[0]
-    if (!url) continue
-    try {
-      const u = new URL(url)
-      if (u.hostname) {
-        hosts.push(u.hostname)
-        continue
-      }
-    } catch {
-      // scp-like host:path
-    }
-    const at = url.split(':')[0]
-    hosts.push(at.split('@').pop())
-  }
-  for (const { text } of texts) for (const m of text.matchAll(/[a-z][a-z0-9+.-]*:\/\/(?:[^@/\s"']+@)?([A-Za-z0-9.-]+)/g)) hosts.push(m[1])
-  const split = splitDomains(env)
-  const findings = []
-  const seen = new Set()
-  for (const host of hosts.map((h) => h.toLowerCase())) {
-    if (seen.has(host) || seen.size >= 20) continue
-    seen.add(host)
-    if (host === 'localhost' || host.startsWith('127.') || !host.includes('.')) continue
-    const domain = split.find((d) => host === d || host.endsWith('.' + d))
-    if (domain) {
-      findings.push(finding('vpn-hosts', 'warn', `${host} resolves through this computer's split DNS for ${domain} (a VPN); the box cannot reach it`))
-      continue
-    }
-    const addresses = await resolve(host)
-    if (addresses?.length && addresses.every(isPrivate)) {
-      findings.push(finding('vpn-hosts', 'warn', `${host} resolves to a private address (${addresses[0]}); the box cannot reach it`))
-    }
-  }
-  return findings
-}
-
-/** splitDomains is the domains of macOS's supplemental resolvers, as `scutil --dns` lists them; none elsewhere. */
-export function splitDomains(env) {
-  const r = runSync(['scutil', '--dns'], { env, timeoutMs: 5000 })
-  if (r.status !== 0) return []
-  return r.text
-    .split('\n')
-    .map((line) => {
-      const i = line.indexOf(':')
-      if (i < 0) return null
-      const [k, v] = [line.slice(0, i).trim(), line.slice(i + 1).trim()]
-      return k === 'domain' && !v.endsWith('.arpa') && v !== 'local' ? v.toLowerCase() : null
-    })
-    .filter(Boolean)
-}
-
-function resolveHost(host) {
-  return Promise.race([
-    dns.promises.lookup(host, { all: true }).then((a) => a.map((x) => x.address), () => null),
-    new Promise((r) => setTimeout(() => r(null), 2000).unref()),
-  ])
-}
-
-export function isPrivate(address) {
-  const lower = address.toLowerCase()
-  if (lower.includes(':')) return lower.startsWith('fc') || lower.startsWith('fd') || lower.startsWith('fe80')
-  const o = address.split('.').map(Number)
-  if (o.length !== 4 || o.some((x) => !Number.isInteger(x))) return false
-  return o[0] === 10 || (o[0] === 172 && o[1] >= 16 && o[1] <= 31) || (o[0] === 192 && o[1] === 168) || (o[0] === 100 && o[1] >= 64 && o[1] <= 127)
-}
-
-// ---------- secrets, LFS and submodules ----------
-
-export function secrets(repo, ignored, handover, optedIn, env) {
-  const findings = []
-  for (const p of ignored) {
-    if (!p.endsWith('/') && path.posix.basename(p).startsWith('.env') && !optedIn.includes('file:' + p)) {
-      findings.push(finding('secrets', 'warn', `${p} is git-ignored and stays on this computer; if the box needs it, opt it in: npx @simular-ai/box offload secrets add file:${p}`))
-    }
-  }
-  const line = section(handover, '## Environment facts').find((l) => l.includes('Secrets needed:'))
-  const needed = line ? line.split('Secrets needed:').pop().trim() : ''
-  if (needed && !needed.toLowerCase().startsWith('none') && !optedIn.length) {
-    findings.push(finding('secrets', 'warn', `the hand-over needs secrets (${needed}) and none are opted in for this repo`))
-  }
-  const pattern = `(os\\.Getenv\\(|process\\.env\\.|process\\.env\\[|env::var\\(|os\\.environ\\.get\\(|os\\.environ\\[|os\\.getenv\\()["']?[A-Z][A-Z0-9_]+`
-  const grep = repo.run(['grep', '-h', '-o', '-I', '-E', pattern]).text
-  const provided = new Set()
-  for (const entry of optedIn.filter((e) => e.startsWith('file:'))) {
-    let text = ''
-    try {
-      text = fs.readFileSync(path.join(repo.top, entry.slice(5)), 'utf8')
-    } catch {
-      // missing; offload reports it
-    }
-    for (const l of text.split('\n')) {
-      const name = l.split('=')[0].replace('export ', '').trim()
-      if (name) provided.add(name)
-    }
-  }
-  const read = new Set(grep.split('\n').map((m) => m.split(/[(.["']/).filter(Boolean).pop()).filter(Boolean))
-  const unset = [...read].filter((n) => env[n] !== undefined && !COMMON_NAMES.has(n) && !provided.has(n)).sort()
-  if (unset.length) findings.push(finding('secrets', 'warn', `the code reads ${unset.slice(0, 10).join(', ')}, set on this computer and unset in the box`))
-  return findings
-}
-
-export function carried(top) {
-  const findings = []
-  try {
-    if (fs.readFileSync(path.join(top, '.gitattributes'), 'utf8').includes('filter=lfs')) {
-      findings.push(finding('lfs', 'warn', 'Git LFS files are not carried; the box copy holds their pointers'))
-    }
-  } catch {
-    // none
-  }
-  if (fs.existsSync(path.join(top, '.gitmodules'))) findings.push(finding('submodules', 'warn', 'submodule contents are not carried; the box copy holds only their commits'))
-  return findings
-}
-
-export function sizeFinding(bytes) {
-  if (bytes <= SIZE_LIMIT) return null
-  return finding('size', 'confirm', `about ${(bytes / 1e6).toFixed(0)} MB to send to the box`)
-}
diff --git a/cli/src/offload/run.js b/cli/src/offload/run.js
deleted file mode 100644
index e04103e..0000000
--- a/cli/src/offload/run.js
+++ /dev/null
@@ -1,47 +0,0 @@
-import { spawn, spawnSync } from 'node:child_process'
-
-/** runSync runs argv on env's PATH with input, collecting stdout and stderr as Buffers. */
-export function runSync(argv, { cwd, env = process.env, input, timeoutMs } = {}) {
-  const res = spawnSync(argv[0], argv.slice(1), { cwd, env, input, timeout: timeoutMs, maxBuffer: 1 << 30 })
-  return {
-    status: res.error ? 127 : (res.status ?? 1),
-    out: res.stdout || Buffer.alloc(0),
-    err: res.stderr || Buffer.from(res.error ? String(res.error.message) : ''),
-    get text() {
-      return this.out.toString('utf8').trim()
-    },
-    get error() {
-      return this.err.toString('utf8').trim()
-    },
-  }
-}
-
-/** run is runSync without blocking the event loop, for commands that call back into this CLI (rsync and git over rsh). */
-export function run(argv, { cwd, env = process.env } = {}) {
-  return new Promise((resolve) => {
-    const child = spawn(argv[0], argv.slice(1), { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] })
-    const out = []
-    const err = []
-    child.stdout.on('data', (d) => out.push(d))
-    child.stderr.on('data', (d) => err.push(d))
-    child.on('error', (e) => err.push(Buffer.from(e.message)))
-    child.on('close', (code) =>
-      resolve({
-        status: code ?? 1,
-        out: Buffer.concat(out),
-        err: Buffer.concat(err),
-        get text() {
-          return this.out.toString('utf8').trim()
-        },
-        get error() {
-          return this.err.toString('utf8').trim()
-        },
-      }),
-    )
-  })
-}
-
-/** quote makes word one shell word for the box's bash -lc. */
-export function quote(word) {
-  return /^[A-Za-z0-9\-_./=:]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`
-}
diff --git a/cli/src/offload/store.js b/cli/src/offload/store.js
deleted file mode 100644
index c9778d5..0000000
--- a/cli/src/offload/store.js
+++ /dev/null
@@ -1,99 +0,0 @@
-import fs from 'node:fs'
-import path from 'node:path'
-
-// OffloadStore keeps this computer's side of offloads under <boxHome>/offload (0700): per repo key handover.md, env.json,
-// back.md and offload.json while an offload is in flight; repos.json (0600) keeps opted-in secret entries (names and paths
-// only, never a value) and whether the user said yes to the size confirm. Ported from upstream OffloadStore.
-export class OffloadStore {
-  constructor(boxHome) {
-    this.root = path.join(boxHome, 'offload')
-  }
-
-  directory(key) {
-    const dir = path.join(this.root, key)
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
-    fs.chmodSync(path.dirname(this.root), 0o700)
-    fs.chmodSync(this.root, 0o700)
-    fs.chmodSync(dir, 0o700)
-    return dir
-  }
-
-  handover(key) {
-    return path.join(this.directory(key), 'handover.md')
-  }
-
-  back(key) {
-    return path.join(this.directory(key), 'back.md')
-  }
-
-  record(key) {
-    try {
-      return JSON.parse(fs.readFileSync(path.join(this.root, key, 'offload.json'), 'utf8'))
-    } catch {
-      return null
-    }
-  }
-
-  save(record) {
-    writeAtomic(path.join(this.directory(record.repo), 'offload.json'), JSON.stringify(record, null, 2) + '\n', 0o600)
-  }
-
-  remove(key) {
-    fs.rmSync(path.join(this.root, key, 'offload.json'), { force: true })
-  }
-
-  /** records lists every offload in flight, oldest first. */
-  records() {
-    let keys = []
-    try {
-      keys = fs.readdirSync(this.root)
-    } catch {
-      return []
-    }
-    return keys
-      .map((k) => this.record(k))
-      .filter(Boolean)
-      .sort((a, b) => a.started_at_ms - b.started_at_ms)
-  }
-
-  secrets(key) {
-    return this.#repos()[key]?.secrets || []
-  }
-
-  setSecrets(key, entries) {
-    this.#update(key, (s) => (s.secrets = entries))
-  }
-
-  sizeConfirmed(key) {
-    return Boolean(this.#repos()[key]?.size_confirmed)
-  }
-
-  confirmSize(key) {
-    this.#update(key, (s) => (s.size_confirmed = true))
-  }
-
-  #update(key, change) {
-    const all = this.#repos()
-    const settings = all[key] || { secrets: [], size_confirmed: false }
-    change(settings)
-    if (!settings.secrets.length && !settings.size_confirmed) delete all[key]
-    else all[key] = settings
-    fs.mkdirSync(this.root, { recursive: true, mode: 0o700 })
-    writeAtomic(path.join(this.root, 'repos.json'), JSON.stringify(all, null, 2) + '\n', 0o600)
-  }
-
-  #repos() {
-    try {
-      return JSON.parse(fs.readFileSync(path.join(this.root, 'repos.json'), 'utf8')) || {}
-    } catch {
-      return {}
-    }
-  }
-}
-
-function writeAtomic(file, text, mode) {
-  const tmp = `${file}.${process.pid}.tmp`
-  fs.writeFileSync(tmp, text, { mode })
-  fs.chmodSync(tmp, mode)
-  fs.renameSync(tmp, file)
-}
diff --git a/cli/src/offload/tar.js b/cli/src/offload/tar.js
deleted file mode 100644
index f678212..0000000
--- a/cli/src/offload/tar.js
+++ /dev/null
@@ -1,50 +0,0 @@
-import fs from 'node:fs'
-
-// The send stream is a ustar archive of regular files, with a pax header for a path over 100 bytes (contracts.md "Send
-// stream"). tarParts returns Exec stdin parts: Buffers and {file} parts that frames() reads lazily, so a large bundle is
-// never held in memory. Ported from upstream ExecFrames.tar.
-
-export function tarParts(members, { now = Math.floor(Date.now() / 1000) } = {}) {
-  const parts = []
-  for (const [name, part] of members) {
-    const size = Buffer.isBuffer(part) ? part.length : fs.statSync(part.file).size
-    if (Buffer.byteLength(name) > 100) {
-      let length = 0
-      let record = ''
-      do {
-        length = Buffer.byteLength(record)
-        record = `${length} path=${name}\n`
-      } while (Buffer.byteLength(record) !== length)
-      parts.push(Buffer.concat([header('PaxHeader', length, 'x', now), pad(Buffer.from(record))]))
-    }
-    parts.push(header(Buffer.from(name).subarray(0, 100).toString('utf8'), size, '0', now))
-    parts.push(part)
-    parts.push(Buffer.alloc((512 - (size % 512)) % 512))
-  }
-  parts.push(Buffer.alloc(1024))
-  return parts
-}
-
-function pad(buf) {
-  return Buffer.concat([buf, Buffer.alloc((512 - (buf.length % 512)) % 512)])
-}
-
-export function header(name, size, type, now) {
-  const block = Buffer.alloc(512)
-  const put = (text, offset) => Buffer.from(text).copy(block, offset)
-  const octal = (value, offset, width) => put(value.toString(8).padStart(width - 1, '0'), offset)
-  put(name, 0)
-  octal(0o600, 100, 8)
-  octal(0, 108, 8)
-  octal(0, 116, 8)
-  octal(size, 124, 12)
-  octal(now, 136, 12)
-  put('        ', 148)
-  put(type, 156)
-  put('ustar\u000000', 257)
-  let sum = 0
-  for (const b of block) sum += b
-  octal(sum, 148, 7)
-  block[155] = 0x20
-  return block
-}
diff --git a/cli/src/probe.js b/cli/src/probe.js
deleted file mode 100644
index 8c1c834..0000000
--- a/cli/src/probe.js
+++ /dev/null
@@ -1,108 +0,0 @@
-// Network checks for `doctor`. Uses Node's built-in fetch (Node >= 18).
-
-const INIT_BODY = JSON.stringify({
-  jsonrpc: '2.0',
-  id: 1,
-  method: 'initialize',
-  params: {
-    protocolVersion: '2025-06-18',
-    capabilities: {},
-    clientInfo: { name: 'simular-box-doctor', version: '0' },
-  },
-})
-
-const HEADERS = {
-  'content-type': 'application/json',
-  accept: 'application/json, text/event-stream',
-}
-
-async function post(url, headers, { timeoutMs = 10000, fetchImpl = fetch } = {}) {
-  return fetchImpl(url, {
-    method: 'POST',
-    headers: { ...HEADERS, ...headers },
-    body: INIT_BODY,
-    signal: AbortSignal.timeout(timeoutMs),
-    redirect: 'manual',
-  })
-}
-
-/** Parse `Bearer resource_metadata="...", scope="...", error="..."`. */
-export function parseWwwAuthenticate(value) {
-  if (!value) return null
-  const match = /^\s*Bearer\b(.*)$/i.exec(value)
-  if (!match) return null
-  const params = {}
-  for (const m of match[1].matchAll(/([a-zA-Z_]+)="([^"]*)"/g)) params[m[1]] = m[2]
-  return params
-}
-
-/**
- * Unauthenticated probe. A healthy box endpoint answers 401 with a WWW-Authenticate header that
- * points at its protected-resource metadata (RFC 9728), which names the authorization server.
- */
-export async function probeEndpoint(url, opts = {}) {
-  const result = { url, ok: false, status: null, resourceMetadata: null, authorizationServer: null, error: null }
-  let res
-  try {
-    res = await post(url, {}, opts)
-  } catch (err) {
-    result.error = `cannot reach ${url}: ${err.cause?.code || err.name || err.message}`
-    return result
-  }
-  result.status = res.status
-  if (res.status !== 401) {
-    result.error = `expected 401 from an unauthenticated request, got ${res.status}`
-    return result
-  }
-  const auth = parseWwwAuthenticate(res.headers.get('www-authenticate'))
-  if (!auth?.resource_metadata) {
-    result.error = '401 without a WWW-Authenticate resource_metadata link; OAuth clients cannot discover sign-in'
-    return result
-  }
-  result.resourceMetadata = auth.resource_metadata
-  try {
-    const meta = await (opts.fetchImpl || fetch)(auth.resource_metadata, {
-      signal: AbortSignal.timeout(opts.timeoutMs || 10000),
-    })
-    if (!meta.ok) throw new Error(`HTTP ${meta.status}`)
-    const doc = await meta.json()
-    result.authorizationServer = doc.authorization_servers?.[0] || null
-    if (!result.authorizationServer) throw new Error('no authorization_servers')
-    result.resource = doc.resource || null
-  } catch (err) {
-    result.error = `protected-resource metadata at ${auth.resource_metadata} is unusable: ${err.message}`
-    return result
-  }
-  // MCP clients refuse to sign in when the metadata names another resource (RFC 9728 section 3.3),
-  // which is what an old address that now points at a new one looks like.
-  if (result.resource && trimSlash(result.resource) !== trimSlash(url)) {
-    result.error = `the sign-in metadata names ${result.resource}, not ${url}, so apps will refuse to sign in (box may have moved there)`
-    return result
-  }
-  result.ok = true
-  return result
-}
-
-function trimSlash(u) {
-  return String(u).replace(/\/+$/, '')
-}
-
-/**
- * Check a personal key without printing it. 200 = valid; 401 with error="invalid_token" = rejected.
- */
-export async function checkKey(url, key, opts = {}) {
-  let res
-  try {
-    res = await post(url, { authorization: `Bearer ${key}` }, opts)
-  } catch (err) {
-    return { valid: null, status: null, error: `cannot reach ${url}: ${err.cause?.code || err.name}` }
-  }
-  // Drain the body so the connection can close; it may be an SSE stream, so do not wait on it.
-  res.body?.cancel?.().catch(() => {})
-  if (res.status >= 200 && res.status < 300) return { valid: true, status: res.status, error: null }
-  if (res.status === 401 || res.status === 403) {
-    const auth = parseWwwAuthenticate(res.headers.get('www-authenticate'))
-    return { valid: false, status: res.status, error: auth?.error || 'rejected' }
-  }
-  return { valid: null, status: res.status, error: `unexpected HTTP ${res.status}` }
-}
diff --git a/cli/test/cli.test.js b/cli/test/cli.test.js
deleted file mode 100644
index ee4214e..0000000
--- a/cli/test/cli.test.js
+++ /dev/null
@@ -1,191 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawnSync } from 'node:child_process'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { parseArgs } from '../src/args.js'
-import { mcpUrl, maskKey, isOldUrl, isOurUrl, DEFAULT_MCP_URL, EXAMPLE_PROMPTS } from '../src/constants.js'
-import { parseWwwAuthenticate, probeEndpoint, checkKey } from '../src/probe.js'
-import { runDoctor } from '../src/cli.js'
-import { sandbox } from './helpers.js'
-import fs from 'node:fs'
-import { createContext } from '../src/context.js'
-import { findClient } from '../src/clients/index.js'
-
-const BIN = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'simular-box.js')
-const KEY = 'cb_test_fake_key_123'
-
-test('args: --client lists, --auth, and keys are never accepted as arguments', () => {
-  assert.deepEqual(parseArgs(['connect', '--client', 'cursor,codex', '-c', 'hermes', '--yes']).flags, { client: ['cursor', 'codex', 'hermes'], yes: true })
-  assert.equal(parseArgs(['connect', '--auth=key']).flags.auth, 'key')
-  assert.throws(() => parseArgs(['connect', '--key', KEY]), /never as an argument/)
-  assert.throws(() => parseArgs(['connect', '--auth', 'password']), /oauth or key/)
-})
-
-test('url: one default, BOX_MCP_URL override, https only (http for localhost)', () => {
-  assert.equal(mcpUrl({}), DEFAULT_MCP_URL)
-  assert.equal(mcpUrl({ BOX_MCP_URL: 'https://mcp.box.simular.ai/mcp/' }), 'https://mcp.box.simular.ai/mcp')
-  assert.equal(mcpUrl({ BOX_MCP_URL: 'http://127.0.0.1:8080/mcp' }), 'http://127.0.0.1:8080/mcp')
-  assert.throws(() => mcpUrl({ BOX_MCP_URL: 'http://evil.example/mcp' }), /https/)
-  assert.equal(maskKey(KEY), 'cb_****')
-})
-
-test('probe: parses WWW-Authenticate and follows resource metadata', async () => {
-  assert.deepEqual(parseWwwAuthenticate('Bearer resource_metadata="https://r/.well-known/x", scope="boxes", error="invalid_token"'), {
-    resource_metadata: 'https://r/.well-known/x',
-    scope: 'boxes',
-    error: 'invalid_token',
-  })
-  const fetchImpl = async (url, init) => {
-    if (url.includes('.well-known')) return new Response(JSON.stringify({ authorization_servers: ['https://as'] }), { status: 200 })
-    if (init.headers.authorization === `Bearer ${KEY}`) return new Response('{}', { status: 200 })
-    return new Response(null, { status: 401, headers: { 'www-authenticate': `Bearer resource_metadata="https://r/.well-known/x"${init.headers.authorization ? ', error="invalid_token"' : ''}` } })
-  }
-  const ep = await probeEndpoint('https://r/mcp', { fetchImpl })
-  assert.equal(ep.ok, true)
-  assert.equal(ep.authorizationServer, 'https://as')
-  assert.equal((await checkKey('https://r/mcp', KEY, { fetchImpl })).valid, true)
-  assert.deepEqual(await checkKey('https://r/mcp', 'cb_wrong_key', { fetchImpl }), { valid: false, status: 401, error: 'invalid_token' })
-  const down = await probeEndpoint('https://r/mcp', { fetchImpl: async () => new Response('', { status: 200 }) })
-  assert.match(down.error, /expected 401/)
-})
-
-test('probe: metadata naming another resource fails (what the old relay address now returns)', async () => {
-  const fetchImpl = async (url) => {
-    if (url.includes('.well-known')) return new Response(JSON.stringify({ resource: 'https://mcp.box.simular.ai/mcp', authorization_servers: ['https://mcp.box.simular.ai'] }), { status: 200 })
-    return new Response(null, { status: 401, headers: { 'www-authenticate': 'Bearer resource_metadata="https://mcp.box.simular.ai/.well-known/oauth-protected-resource/mcp"' } })
-  }
-  const old = await probeEndpoint('https://relay.simular.cloud/mcp', { fetchImpl })
-  assert.equal(old.ok, false)
-  assert.match(old.error, /names https:\/\/mcp\.box\.simular\.ai\/mcp, not https:\/\/relay\.simular\.cloud\/mcp/)
-  assert.equal((await probeEndpoint('https://mcp.box.simular.ai/mcp', { fetchImpl })).ok, true)
-  assert.equal((await probeEndpoint('https://mcp.box.simular.ai/mcp/', { fetchImpl })).ok, true, 'a trailing slash is the same resource')
-})
-
-test('url: the old relay address is ours but outdated; staging is not', () => {
-  assert.equal(DEFAULT_MCP_URL, 'https://mcp.box.simular.ai/mcp')
-  for (const u of ['https://relay.simular.cloud/mcp', 'https://staging.relay.simular.cloud/mcp', DEFAULT_MCP_URL]) assert.ok(isOurUrl(u, DEFAULT_MCP_URL), u)
-  assert.equal(isOurUrl('https://mcp.box.com', DEFAULT_MCP_URL), false)
-  assert.equal(isOldUrl('https://relay.simular.cloud/mcp', DEFAULT_MCP_URL), true)
-  assert.equal(isOldUrl('https://staging.relay.simular.cloud/mcp', DEFAULT_MCP_URL), false)
-  assert.equal(isOldUrl(DEFAULT_MCP_URL, DEFAULT_MCP_URL), false)
-  assert.equal(isOldUrl('https://relay.simular.cloud/mcp', 'https://relay.simular.cloud/mcp'), false, 'not outdated when BOX_MCP_URL points there')
-  assert.equal(isOldUrl('not a url', DEFAULT_MCP_URL), false)
-})
-
-test('doctor: flags a stale URL, a legacy server and a rejected key, with fixes', async () => {
-  const sb = sandbox()
-  sb.write('.cursor/mcp.json', JSON.stringify({ mcpServers: { box: { url: 'https://relay.simular.cloud/old' }, 'box-control': { url: 'https://relay.simular.cloud/control' } } }))
-  sb.write('.hermes/config.yaml', 'mcp_servers:\n  box:\n    url: https://relay.simular.cloud/mcp\n    headers:\n      Authorization: Bearer ${MCP_BOX_API_KEY}\n')
-  sb.write('.hermes/.env', `MCP_BOX_API_KEY=${KEY}\n`)
-  const report = await runDoctor(sb.ctx, {}, {
-    probe: async (url) => ({ url, ok: true, status: 401 }),
-    check: async () => ({ valid: false, status: 401, error: 'invalid_token' }),
-  })
-  const cursor = report.clients.find((c) => c.id === 'cursor')
-  assert.equal(cursor.ok, false)
-  assert.match(cursor.problems.join('\n'), /points at https:\/\/relay.simular.cloud\/old, box's old address/)
-  assert.match(cursor.problems.join('\n'), /box-control/)
-  assert.deepEqual(cursor.fixes, ['npx @simular-ai/box connect --client cursor'])
-  const hermes = report.clients.find((c) => c.id === 'hermes')
-  assert.match(hermes.problems.join('\n'), /relay\.simular\.cloud\/mcp, box's old address, which no longer signs in; box is now at https:\/\/mcp\.box\.simular\.ai\/mcp/)
-  assert.deepEqual(hermes.key, { configured: true, valid: false, status: 401 })
-  assert.ok(hermes.fixes.some((f) => f.includes('--auth key')))
-  assert.ok(!JSON.stringify(report).includes(KEY), 'the report never contains the key')
-  assert.equal(report.ok, false)
-})
-
-function run(args, sb, extraEnv = {}) {
-  return spawnSync(process.execPath, [BIN, ...args], { env: { ...sb.env, PATH: `${sb.env.PATH}${path.delimiter}${path.dirname(process.execPath)}`, ...extraEnv }, encoding: 'utf8' })
-}
-
-test('real CLI: connect --client cursor,codex --yes in a temp HOME, then remove', () => {
-  const sb = sandbox()
-  const res = run(['connect', '--client', 'cursor,codex', '--yes'], sb)
-  assert.equal(res.status, 0, res.stderr + res.stdout)
-  // No `codex` on PATH (the Codex app alone): the hint points at the app's Settings.
-  assert.match(res.stdout, /Settings -> MCP servers and click Authenticate next to box/)
-  assert.ok(!res.stdout.includes('codex mcp login'), 'does not assume the codex CLI')
-  assert.match(res.stdout, /start a new chat \(or restart the app\)/)
-  for (const e of EXAMPLE_PROMPTS) assert.ok(res.stdout.includes(e), `shows the example prompt: ${e}`)
-  assert.deepEqual(JSON.parse(sb.read('.cursor/mcp.json')), { mcpServers: { box: { url: DEFAULT_MCP_URL } } })
-  assert.match(sb.read('.codex/config.toml'), /\[mcp_servers\.box\]\nurl = "https:\/\/mcp\.box\.simular\.ai\/mcp"/)
-  const rm = run(['remove', '--client', 'cursor,codex', '--yes'], sb)
-  assert.equal(rm.status, 0, rm.stderr)
-  assert.ok(!rm.stdout.includes(EXAMPLE_PROMPTS[0]), 'remove shows no example prompts')
-  assert.deepEqual(JSON.parse(sb.read('.cursor/mcp.json')), { mcpServers: {} })
-})
-
-test('real CLI: connect moves old relay entries to the new URL and says to sign in again; remove takes either', () => {
-  const sb = sandbox()
-  sb.write('.cursor/mcp.json', JSON.stringify({ mcpServers: { box: { url: 'https://relay.simular.cloud/mcp' }, 'box-control': { url: 'https://relay.simular.cloud/control' }, other: { url: 'https://example.com/mcp' } } }))
-  sb.write('.codex/config.toml', '[mcp_servers.box]\nurl = "https://relay.simular.cloud/mcp"\n')
-  const res = run(['connect', '--client', 'cursor,codex', '--yes'], sb)
-  assert.equal(res.status, 0, res.stderr + res.stdout)
-  assert.match(res.stdout, /Cursor: wrote box/)
-  assert.match(res.stdout, /box moved from https:\/\/relay\.simular\.cloud\/mcp to https:\/\/mcp\.box\.simular\.ai\/mcp\. Cursor may ask you to sign in to box again/)
-  assert.match(res.stdout, /Codex may ask you to sign in to box again/)
-  assert.deepEqual(JSON.parse(sb.read('.cursor/mcp.json')).mcpServers, { other: { url: 'https://example.com/mcp' }, box: { url: DEFAULT_MCP_URL } })
-  assert.match(sb.read('.codex/config.toml'), /url = "https:\/\/mcp\.box\.simular\.ai\/mcp"/)
-  const again = run(['connect', '--client', 'cursor,codex', '--yes'], sb)
-  assert.ok(!again.stdout.includes('sign in to box again'), 'a re-run says nothing about moving')
-
-  // remove takes an entry at the old address too.
-  sb.write('.cursor/mcp.json', JSON.stringify({ mcpServers: { box: { url: 'https://relay.simular.cloud/mcp' } } }))
-  assert.equal(run(['remove', '--client', 'cursor', '--yes'], sb).status, 0)
-  assert.deepEqual(JSON.parse(sb.read('.cursor/mcp.json')), { mcpServers: {} })
-})
-
-test('real CLI: key mode without a key fails clearly; with BOX_TOKEN it never prints the key', () => {
-  const sb = sandbox()
-  sb.write('.hermes/config.yaml', '')
-  const noKey = run(['connect', '--client', 'hermes', '--auth', 'key', '--yes'], sb)
-  assert.notEqual(noKey.status, 0)
-  assert.match(noKey.stderr, /BOX_TOKEN=cb_/)
-  const withKey = run(['connect', '--client', 'hermes', '--auth', 'key', '--yes'], sb, { BOX_TOKEN: KEY })
-  assert.equal(withKey.status, 0, withKey.stderr)
-  assert.ok(!(withKey.stdout + withKey.stderr).includes(KEY))
-  // Hermes keeps its home in %LOCALAPPDATA%\\hermes on Windows and ~/.hermes elsewhere.
-  const hermesEnv = path.join(path.dirname(findClient('hermes').configLocation(createContext({ env: sb.env }))), '.env')
-  assert.match(fs.readFileSync(hermesEnv, 'utf8'), new RegExp(`^MCP_BOX_API_KEY=${KEY}$`, 'm'))
-  const bad = run(['connect', '--client', 'hermes', '--auth', 'key', '--yes'], sb, { BOX_TOKEN: 'not-a-key' })
-  assert.notEqual(bad.status, 0)
-})
-
-test('real CLI: unknown client and missing --client in non-interactive mode', () => {
-  const sb = sandbox()
-  assert.match(run(['connect', '--client', 'notepad'], sb).stderr, /unknown client/)
-  sb.write('.cursor/mcp.json', '{}')
-  assert.match(run(['connect'], sb).stderr, /--client cursor/)
-})
-
-test('real CLI: example prompts only after something was set up', () => {
-  const sb = sandbox()
-  assert.equal(EXAMPLE_PROMPTS.length, 3)
-  for (const e of EXAMPLE_PROMPTS) assert.match(e, /^Use box to /)
-  const dry = run(['connect', '--client', 'cursor', '--yes', '--dry-run'], sb)
-  assert.equal(dry.status, 0, dry.stderr)
-  assert.ok(!dry.stdout.includes(EXAMPLE_PROMPTS[0]), 'a dry run sets nothing up')
-  sb.write('.cursor/mcp.json', '{ not json')
-  const broken = run(['connect', '--client', 'cursor', '--yes'], sb)
-  assert.notEqual(broken.status, 0)
-  assert.ok(!broken.stdout.includes(EXAMPLE_PROMPTS[0]), 'no example prompts when every app failed')
-  const doctor = run(['doctor', '--client', 'cursor'], sb)
-  assert.ok(!doctor.stdout.includes(EXAMPLE_PROMPTS[0]), 'doctor shows no example prompts')
-})
-
-test('real CLI: a config it may not write gets a clear message (and the Codex app steps)', { skip: (process.platform === 'win32' || process.getuid?.() === 0) && 'needs POSIX permissions and a non-root user' }, () => {
-  const sb = sandbox()
-  sb.write('.codex/config.toml', 'model = "gpt-5"\n')
-  fs.chmodSync(path.join(sb.home, '.codex'), 0o500)
-  try {
-    const res = run(['connect', '--client', 'codex', '--yes'], sb)
-    assert.notEqual(res.status, 0)
-    const out = res.stdout + res.stderr
-    assert.match(out, /could not change .*config\.toml: the file or its folder/)
-    assert.match(out, /Settings -> MCP servers -> Add server, name it box, choose Streamable HTTP, paste https:\/\/mcp\.box\.simular\.ai\/mcp/)
-    assert.match(out, /click Authenticate next to box/)
-  } finally {
-    fs.chmodSync(path.join(sb.home, '.codex'), 0o700)
-  }
-})
diff --git a/cli/test/clients.test.js b/cli/test/clients.test.js
deleted file mode 100644
index faa6e51..0000000
--- a/cli/test/clients.test.js
+++ /dev/null
@@ -1,414 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import path from 'node:path'
-import * as TOML from 'smol-toml'
-import YAML from 'yaml'
-import * as jsonc from 'jsonc-parser'
-import { findClient } from '../src/clients/index.js'
-import { DEFAULT_MCP_URL } from '../src/constants.js'
-import { FAKE_CLAUDE, FAKE_OPENCLAW, fixture, sandbox } from './helpers.js'
-
-const KEY = 'cb_test_fake_key_123'
-const client = (id) => findClient(id)
-const WIN = process.platform === 'win32'
-// Fake client CLIs are shebang scripts, and Windows has no POSIX file modes.
-const NO_FAKE_BINS = WIN && 'fake CLIs are shebang scripts; Windows runs the real clients in the install matrix'
-const plain = (v) => JSON.parse(JSON.stringify(v))
-const backups = (dir) => fs.readdirSync(dir).filter((f) => f.includes('.box-backup-'))
-
-test('cursor: merges into mcpServers, keeps comments and other servers, drops box-control, idempotent', () => {
-  const sb = sandbox()
-  const file = sb.write('.cursor/mcp.json', fixture('cursor.before.json'))
-  const first = client('cursor').connect(sb.ctx)
-  assert.equal(first.actions.length, 1)
-  assert.equal(first.backups.length, 1)
-  const text = sb.read('.cursor/mcp.json')
-  assert.match(text, /\/\/ Cursor servers the user already has/)
-  const doc = jsonc.parse(text)
-  assert.deepEqual(doc.mcpServers.box, { url: DEFAULT_MCP_URL })
-  assert.deepEqual(doc.mcpServers.github, { url: 'https://api.githubcopilot.com/mcp/' })
-  assert.equal(doc.mcpServers['box-control'], undefined)
-  const again = client('cursor').connect(sb.ctx)
-  assert.deepEqual(again.actions, [])
-  assert.equal(backups(path.dirname(file)).length, 1, 'a no-op re-run makes no new backup')
-  client('cursor').remove(sb.ctx)
-  const after = jsonc.parse(sb.read('.cursor/mcp.json'))
-  assert.equal(after.mcpServers.box, undefined)
-  assert.ok(after.mcpServers.github)
-})
-
-test('cursor: refuses to touch a file it cannot parse', () => {
-  const sb = sandbox()
-  sb.write('.cursor/mcp.json', fixture('broken.json'))
-  assert.throws(() => client('cursor').connect(sb.ctx), /not valid JSON/)
-  assert.equal(sb.read('.cursor/mcp.json'), fixture('broken.json'))
-})
-
-test('cursor: creates the file when missing; BOX_MCP_URL overrides the URL', () => {
-  const sb = sandbox({ env: { BOX_MCP_URL: 'https://staging.example.test/mcp' } })
-  client('cursor').connect(sb.ctx)
-  assert.deepEqual(JSON.parse(sb.read('.cursor/mcp.json')), { mcpServers: { box: { url: 'https://staging.example.test/mcp' } } })
-})
-
-test('codex: rewrites only [mcp_servers.box] (and its subtables), keeps comments, removes box-control', () => {
-  const sb = sandbox()
-  sb.write('.codex/config.toml', fixture('codex.before.toml'))
-  client('codex').connect(sb.ctx)
-  assert.equal(sb.read('.codex/config.toml'), fixture('codex.after.toml'))
-  assert.deepEqual(client('codex').connect(sb.ctx).actions, [])
-  const st = client('codex').status(sb.ctx)
-  assert.equal(st.entries[0].url, DEFAULT_MCP_URL)
-  client('codex').remove(sb.ctx)
-  const doc = TOML.parse(sb.read('.codex/config.toml'))
-  assert.equal(doc.mcp_servers.box, undefined)
-  assert.deepEqual(plain(doc.mcp_servers.docs), { command: 'npx', args: ['docs-mcp'] })
-  assert.match(sb.read('.codex/config.toml'), /# keep this comment/)
-  assert.match(sb.read('.codex/config.toml'), /# Profiles: keep this comment with its table\n\[profiles\.fast\]/)
-})
-
-test('codex: keeps CRLF line endings', () => {
-  const sb = sandbox()
-  sb.write('.codex/config.toml', 'model = "gpt-5"\r\n\r\n[mcp_servers.box]\r\nurl = "https://relay.simular.cloud/old"\r\n\r\n[profiles.x]\r\nmodel = "m"\r\n')
-  client('codex').connect(sb.ctx)
-  assert.equal(sb.read('.codex/config.toml'), 'model = "gpt-5"\r\n\r\n[profiles.x]\r\nmodel = "m"\r\n\r\n[mcp_servers.box]\r\nurl = "https://mcp.box.simular.ai/mcp"\r\n')
-  client('codex').remove(sb.ctx)
-  assert.equal(sb.read('.codex/config.toml'), 'model = "gpt-5"\r\n\r\n[profiles.x]\r\nmodel = "m"\r\n')
-})
-
-test('codex: honours CODEX_HOME', () => {
-  const sb = sandbox()
-  const codexHome = path.join(sb.home, 'elsewhere')
-  const ctx = { ...sb.ctx, env: { ...sb.env, CODEX_HOME: codexHome } }
-  client('codex').connect(ctx)
-  assert.deepEqual(plain(TOML.parse(fs.readFileSync(path.join(codexHome, 'config.toml'), 'utf8'))), { mcp_servers: { box: { url: DEFAULT_MCP_URL } } })
-})
-
-test('codex: refuses an inline box table it cannot edit safely', () => {
-  const sb = sandbox()
-  const text = 'mcp_servers = { box = { url = "https://relay.simular.cloud/mcp-old" } }\n'
-  sb.write('.codex/config.toml', text)
-  assert.throws(() => client('codex').connect(sb.ctx), /inline/)
-  assert.equal(sb.read('.codex/config.toml'), text)
-})
-
-test('opencode: prefers opencode.jsonc, writes a remote entry, keeps comments', () => {
-  const sb = sandbox()
-  sb.write('.config/opencode/opencode.jsonc', fixture('opencode.before.jsonc'))
-  client('opencode').connect(sb.ctx)
-  const text = sb.read('.config/opencode/opencode.jsonc')
-  assert.match(text, /\/\/ theme first/)
-  const doc = jsonc.parse(text)
-  assert.deepEqual(doc.mcp.box, { type: 'remote', url: DEFAULT_MCP_URL, enabled: true })
-  assert.ok(doc.mcp.local)
-  assert.equal(sb.read('.config/opencode/opencode.json'), null)
-})
-
-test('vscode: writes servers.box with type http next to other servers', () => {
-  const sb = sandbox()
-  sb.write('.config/Code/User/mcp.json', fixture('vscode.before.json'))
-  client('vscode').connect(sb.ctx)
-  const doc = JSON.parse(sb.read('.config/Code/User/mcp.json'))
-  assert.deepEqual(doc.servers.box, { type: 'http', url: DEFAULT_MCP_URL })
-  assert.ok(doc.servers.playwright)
-  assert.deepEqual(doc.inputs, [])
-})
-
-test('gemini-cli: merges mcpServers.box as an http server, keeps comments and settings, idempotent, removes', () => {
-  const sb = sandbox()
-  const file = sb.write('.gemini/settings.json', '{\n  // mine\n  "theme": "Default",\n  "mcpServers": { "other": { "httpUrl": "https://example.com/mcp" } }\n}\n')
-  const res = client('gemini').connect(sb.ctx)
-  assert.match(res.next[0], /\/mcp auth box/)
-  assert.equal(res.backups.length, 1)
-  const text = sb.read('.gemini/settings.json')
-  assert.match(text, /\/\/ mine/)
-  const doc = jsonc.parse(text)
-  assert.deepEqual(doc.mcpServers.box, { type: 'http', url: DEFAULT_MCP_URL })
-  assert.equal(doc.theme, 'Default')
-  assert.deepEqual(client('gemini').connect(sb.ctx).actions, [])
-  assert.equal(backups(path.dirname(file)).length, 1, 'a no-op re-run makes no new backup')
-  assert.equal(client('gemini-cli').status(sb.ctx).entries[0].url, DEFAULT_MCP_URL)
-  client('gemini-cli').remove(sb.ctx)
-  assert.deepEqual(Object.keys(jsonc.parse(sb.read('.gemini/settings.json')).mcpServers), ['other'])
-})
-
-test('gemini-cli: a foreign box given as httpUrl is recognised and left alone', () => {
-  const sb = sandbox()
-  const original = JSON.stringify({ mcpServers: { box: { httpUrl: 'https://mcp.box.com' } } }, null, 2)
-  sb.write('.gemini/settings.json', original)
-  assert.throws(() => client('gemini-cli').connect(sb.ctx), (e) => e.foreign)
-  assert.equal(client('gemini-cli').status(sb.ctx).foreign.url, 'https://mcp.box.com')
-  client('gemini-cli').remove(sb.ctx)
-  assert.equal(sb.read('.gemini/settings.json'), original)
-})
-
-test('hermes: OAuth entry keeps comments; key mode puts the key only in .env (0600)', () => {
-  const sb = sandbox()
-  sb.write('.hermes/config.yaml', fixture('hermes.before.yaml'))
-  client('hermes').connect(sb.ctx, { mode: 'oauth' })
-  let text = sb.read('.hermes/config.yaml')
-  assert.match(text, /# GitHub server/)
-  assert.deepEqual(YAML.parse(text).mcp_servers.box, { url: DEFAULT_MCP_URL, auth: 'oauth', enabled: true })
-
-  sb.write('.hermes/.env', 'OPENROUTER_API_KEY=sk-other\n', 0o644)
-  client('hermes').connect(sb.ctx, { mode: 'key', key: KEY })
-  text = sb.read('.hermes/config.yaml')
-  assert.ok(!text.includes(KEY), 'the key is never written to config.yaml')
-  assert.deepEqual(YAML.parse(text).mcp_servers.box, { url: DEFAULT_MCP_URL, headers: { Authorization: 'Bearer ${MCP_BOX_API_KEY}' }, enabled: true })
-  assert.equal(sb.read('.hermes/.env'), `OPENROUTER_API_KEY=sk-other\nMCP_BOX_API_KEY=${KEY}\n`)
-  if (!WIN) assert.equal(fs.statSync(path.join(sb.home, '.hermes/.env')).mode & 0o777, 0o600)
-  for (const b of WIN ? [] : backups(path.join(sb.home, '.hermes')).filter((f) => f.startsWith('.env'))) {
-    assert.equal(fs.statSync(path.join(sb.home, '.hermes', b)).mode & 0o777, 0o600, 'a backup of .env is private too')
-  }
-  const st = client('hermes').status(sb.ctx)
-  assert.equal(st.key, KEY)
-  assert.equal(st.entries[0].mode, 'key')
-  // Re-run without a key keeps the stored one.
-  assert.deepEqual(client('hermes').connect(sb.ctx, { mode: 'key' }).actions, [])
-
-  client('hermes').remove(sb.ctx)
-  assert.equal(sb.read('.hermes/.env'), 'OPENROUTER_API_KEY=sk-other\n')
-  assert.equal(YAML.parse(sb.read('.hermes/config.yaml')).mcp_servers.box, undefined)
-  assert.ok(YAML.parse(sb.read('.hermes/config.yaml')).mcp_servers.github)
-})
-
-test('openclaw: OAuth via `openclaw mcp set` with streamable-http; key mode references ${BOX_TOKEN} from .env', { skip: NO_FAKE_BINS }, () => {
-  const sb = sandbox({ bins: { openclaw: FAKE_OPENCLAW } })
-  client('openclaw').connect(sb.ctx, { mode: 'oauth' })
-  const cfg = () => JSON.parse(sb.read('.openclaw/openclaw.json'))
-  assert.deepEqual(cfg().mcp.servers.box, { url: DEFAULT_MCP_URL, transport: 'streamable-http', auth: 'oauth' })
-
-  client('openclaw').connect(sb.ctx, { mode: 'key', key: KEY })
-  assert.deepEqual(cfg().mcp.servers.box, { url: DEFAULT_MCP_URL, transport: 'streamable-http', headers: { Authorization: 'Bearer ${BOX_TOKEN}' } })
-  assert.ok(!sb.read('.openclaw/openclaw.json').includes(KEY))
-  assert.equal(sb.read('.openclaw/.env'), `BOX_TOKEN=${KEY}\n`)
-  assert.equal(fs.statSync(path.join(sb.home, '.openclaw/.env')).mode & 0o777, 0o600)
-
-  const st = client('openclaw').status(sb.ctx)
-  assert.equal(st.key, KEY)
-  assert.deepEqual(st.warnings, [], '`mcp show` substitutes the key, but status reads the raw file')
-  const setsBefore = sb.read('fake-openclaw-calls.log').split('\n').filter((l) => l.startsWith('mcp set')).length
-  assert.deepEqual(client('openclaw').connect(sb.ctx, { mode: 'key' }).actions, [])
-  const setsAfter = sb.read('fake-openclaw-calls.log').split('\n').filter((l) => l.startsWith('mcp set')).length
-  assert.equal(setsAfter, setsBefore, 'idempotent re-run does not call mcp set')
-
-  client('openclaw').remove(sb.ctx)
-  assert.equal(cfg().mcp.servers.box, undefined)
-  assert.equal(sb.read('.openclaw/.env'), '')
-})
-
-test('openclaw: warns when the header references BOX_TOKEN but .env lacks it (the literal-placeholder 401)', { skip: NO_FAKE_BINS }, () => {
-  const sb = sandbox({ bins: { openclaw: FAKE_OPENCLAW } })
-  sb.write('.openclaw/openclaw.json', JSON.stringify({ mcp: { servers: { box: { url: DEFAULT_MCP_URL, transport: 'streamable-http', headers: { Authorization: 'Bearer ${BOX_TOKEN}' } } } } }))
-  const st = client('openclaw').status(sb.ctx)
-  assert.match(st.warnings.join(' '), /placeholder and get 401/)
-})
-
-test('claude-code: default URL installs the plugin from the marketplace; override uses claude mcp add', { skip: NO_FAKE_BINS }, () => {
-  const sb = sandbox({ bins: { claude: FAKE_CLAUDE } })
-  sb.write('.claude.json', JSON.stringify({ mcpServers: { 'box-control': { url: 'https://relay.simular.cloud/control' }, box: { type: 'http', url: DEFAULT_MCP_URL }, other: { command: 'y' } } }))
-  client('claude').connect(sb.ctx)
-  const state = () => JSON.parse(sb.read('fake-claude-state.json'))
-  assert.deepEqual(state().plugins, { 'simular-box@simular-box': { enabled: true, url: DEFAULT_MCP_URL } })
-  assert.deepEqual(Object.keys(JSON.parse(sb.read('.claude.json')).mcpServers), ['other'])
-  assert.ok(state().calls.includes('plugin marketplace add simular-ai/box-plugin'))
-  assert.deepEqual(client('claude').connect(sb.ctx).actions, [])
-
-  const ctx = { ...sb.ctx, url: 'https://staging.example.test/mcp' }
-  client('claude').connect(ctx)
-  assert.deepEqual(JSON.parse(sb.read('.claude.json')).mcpServers.box, { type: 'http', url: 'https://staging.example.test/mcp' })
-  assert.equal(state().plugins['simular-box@simular-box'].enabled, false)
-  assert.equal(client('claude').status(ctx).entries.length, 1)
-
-  // remove runs with the same BOX_MCP_URL, so the staging host counts as ours.
-  client('claude').remove(ctx)
-  assert.deepEqual(state().plugins, {})
-  assert.equal(JSON.parse(sb.read('.claude.json')).mcpServers.box, undefined)
-})
-
-test('claude-code: a plugin installed before the move is updated to the new URL', { skip: NO_FAKE_BINS }, () => {
-  const sb = sandbox({ bins: { claude: FAKE_CLAUDE } })
-  const old = 'https://relay.simular.cloud/mcp'
-  sb.write('fake-claude-state.json', JSON.stringify({ marketplaces: ['simular-box'], plugins: { 'simular-box@simular-box': { enabled: true, url: old } }, calls: [] }))
-  const state = () => JSON.parse(sb.read('fake-claude-state.json'))
-  assert.equal(client('claude').status(sb.ctx).entries[0].url, old)
-  const dry = client('claude').connect({ ...sb.ctx, dryRun: true })
-  assert.match(dry.actions.join(' '), /would update plugin simular-box@simular-box/)
-  assert.equal(state().plugins['simular-box@simular-box'].url, old, 'a dry run updates nothing')
-  const res = client('claude').connect(sb.ctx)
-  assert.match(res.actions.join(' '), /updated plugin simular-box@simular-box/)
-  assert.match(res.next[0], /^Restart Claude Code/)
-  assert.ok(state().calls.includes('plugin marketplace update simular-box'))
-  assert.ok(state().calls.includes('plugin update simular-box@simular-box --scope user'))
-  assert.equal(state().plugins['simular-box@simular-box'].url, DEFAULT_MCP_URL)
-  assert.deepEqual(client('claude').connect(sb.ctx).actions, [], 'idempotent once updated')
-  // Our own old user-scope box next to the plugin is removed; remove takes the plugin either way.
-  sb.write('.claude.json', JSON.stringify({ mcpServers: { box: { type: 'http', url: old } } }))
-  assert.match(client('claude').connect(sb.ctx).actions.join(' '), /removed the user-scope box server/)
-  client('claude').remove(sb.ctx)
-  assert.deepEqual(state().plugins, {})
-})
-
-test('claude-code: the plugin installed under its old name box is replaced by simular-box', { skip: NO_FAKE_BINS }, () => {
-  const sb = sandbox({ bins: { claude: FAKE_CLAUDE } })
-  sb.write('fake-claude-state.json', JSON.stringify({ marketplaces: ['simular-box'], plugins: { 'box@simular-box': { enabled: true, url: DEFAULT_MCP_URL } }, calls: [] }))
-  const state = () => JSON.parse(sb.read('fake-claude-state.json'))
-  const st = client('claude').status(sb.ctx)
-  assert.deepEqual(st.legacy, ['plugin box@simular-box'])
-  assert.equal(st.entries[0].where, 'plugin box@simular-box')
-  const dry = client('claude').connect({ ...sb.ctx, dryRun: true })
-  assert.match(dry.actions.join(' '), /would uninstall old plugin box@simular-box/)
-  assert.ok(state().plugins['box@simular-box'], 'a dry run uninstalls nothing')
-  const res = client('claude').connect(sb.ctx)
-  assert.match(res.actions.join('; '), /installed plugin simular-box@simular-box \(box server \+ box skill\); uninstalled old plugin box@simular-box/)
-  assert.match(res.next[0], /plugin:simular-box:box/)
-  assert.ok(state().calls.includes('plugin marketplace update simular-box'), 'the marketplace is refreshed before the install')
-  assert.deepEqual(state().plugins, { 'simular-box@simular-box': { enabled: true, url: DEFAULT_MCP_URL } })
-  assert.deepEqual(client('claude').status(sb.ctx).legacy, [])
-  assert.deepEqual(client('claude').connect(sb.ctx).actions, [], 'idempotent once replaced')
-})
-
-test('claude-code: remove takes the old-named plugin too', { skip: NO_FAKE_BINS }, () => {
-  const sb = sandbox({ bins: { claude: FAKE_CLAUDE } })
-  sb.write('fake-claude-state.json', JSON.stringify({ marketplaces: ['simular-box'], plugins: { 'box@simular-box': { enabled: true, url: DEFAULT_MCP_URL } }, calls: [] }))
-  assert.match(client('claude').remove(sb.ctx).actions.join(' '), /uninstalled plugin box@simular-box/)
-  assert.deepEqual(JSON.parse(sb.read('fake-claude-state.json')).plugins, {})
-})
-
-test('claude-code: an update that leaves the old URL fails instead of claiming success', { skip: NO_FAKE_BINS }, () => {
-  const sb = sandbox({ bins: { claude: FAKE_CLAUDE } })
-  sb.write('fake-claude-state.json', JSON.stringify({ marketplaces: ['simular-box'], plugins: { 'simular-box@simular-box': { enabled: true, url: 'https://relay.simular.cloud/mcp' } }, staleMarketplace: true, calls: [] }))
-  assert.throws(() => client('claude').connect(sb.ctx), /still points at https:\/\/relay\.simular\.cloud\/mcp after an update/)
-})
-
-test('claude-desktop: writes nothing, prints connector steps', () => {
-  const sb = sandbox()
-  const res = client('claude-desktop').connect(sb.ctx)
-  assert.match(res.next[0], /Add custom connector/)
-  assert.deepEqual(fs.readdirSync(sb.home), ['.bin'])
-})
-
-test('dry run writes nothing for file-based clients', () => {
-  const sb = sandbox()
-  const ctx = { ...sb.ctx, dryRun: true }
-  for (const id of ['cursor', 'codex', 'opencode', 'vscode', 'gemini-cli', 'hermes']) {
-    const res = client(id).connect(ctx, { mode: 'oauth' })
-    assert.ok(res.actions[0].startsWith('would'), id)
-  }
-  assert.deepEqual(fs.readdirSync(sb.home), ['.bin'])
-})
-
-// ---- someone else's `box` (e.g. box.com's MCP server) is never ours to change or remove ----
-
-const BOX_COM = 'https://mcp.box.com'
-
-test('json clients: a foreign box blocks connect, survives remove, and --name installs next to it', () => {
-  const cases = [
-    ['cursor', '.cursor/mcp.json', ['mcpServers']],
-    ['opencode', '.config/opencode/opencode.json', ['mcp']],
-    ['vscode', '.config/Code/User/mcp.json', ['servers']],
-    ['gemini-cli', '.gemini/settings.json', ['mcpServers']],
-  ]
-  for (const [id, rel, container] of cases) {
-    const sb = sandbox()
-    const foreign = { url: BOX_COM, headers: { Authorization: 'Bearer box-com-token' } }
-    const original = JSON.stringify(container.reduceRight((acc, k) => ({ [k]: acc }), { box: foreign }), null, 2)
-    sb.write(rel, original)
-    assert.throws(() => client(id).connect(sb.ctx), (e) => e.foreign && /--name/.test(e.message), id)
-    assert.equal(sb.read(rel), original, `${id}: file untouched`)
-    const rm = client(id).remove(sb.ctx)
-    assert.equal(sb.read(rel), original, `${id}: remove leaves it`)
-    assert.match(rm.warnings.join(' '), /not box by Simular/)
-    assert.ok(client(id).status(sb.ctx).foreign, `${id}: status reports it`)
-
-    const named = { ...sb.ctx, name: 'simular-box' }
-    client(id).connect(named)
-    let doc = jsonc.parse(sb.read(rel))
-    let map = container.reduce((acc, k) => acc[k], doc)
-    assert.deepEqual(map.box, foreign, `${id}: foreign box kept`)
-    assert.equal(map['simular-box'].url, DEFAULT_MCP_URL)
-    client(id).remove(named)
-    doc = jsonc.parse(sb.read(rel))
-    map = container.reduce((acc, k) => acc[k], doc)
-    assert.deepEqual(Object.keys(map), ['box'])
-  }
-})
-
-test('codex: a foreign [mcp_servers.box] is left alone, fields and all', () => {
-  const sb = sandbox()
-  const original = `[mcp_servers.box]\nurl = "${BOX_COM}"\nbearer_token_env_var = "BOX_COM_TOKEN"\n`
-  sb.write('.codex/config.toml', original)
-  assert.throws(() => client('codex').connect(sb.ctx), /not box by Simular/)
-  client('codex').remove(sb.ctx)
-  assert.equal(sb.read('.codex/config.toml'), original)
-  client('codex').connect({ ...sb.ctx, name: 'simular-box' })
-  const doc = plain(TOML.parse(sb.read('.codex/config.toml')))
-  assert.deepEqual(doc.mcp_servers.box, { url: BOX_COM, bearer_token_env_var: 'BOX_COM_TOKEN' })
-  assert.deepEqual(doc.mcp_servers['simular-box'], { url: DEFAULT_MCP_URL })
-})
-
-test('codex: removing box keeps the comment above the next table', () => {
-  const sb = sandbox()
-  sb.write('.codex/config.toml', `model = "o3"\n\n[mcp_servers.box]\nurl = "${DEFAULT_MCP_URL}"\n\n# Linear: my work tracker (keep!)\n[mcp_servers.linear]\nurl = "https://mcp.linear.app/mcp"\n`)
-  client('codex').remove(sb.ctx)
-  assert.equal(sb.read('.codex/config.toml'), `model = "o3"\n\n# Linear: my work tracker (keep!)\n[mcp_servers.linear]\nurl = "https://mcp.linear.app/mcp"\n`)
-})
-
-test('hermes: a foreign box blocks connect and survives remove', () => {
-  const sb = sandbox()
-  const original = `mcp_servers:\n  box:\n    url: ${BOX_COM}\n    headers:\n      Authorization: Bearer \${BOX_COM_TOKEN}\n`
-  sb.write('.hermes/config.yaml', original)
-  assert.throws(() => client('hermes').connect(sb.ctx, { mode: 'oauth' }), /--name/)
-  client('hermes').remove(sb.ctx)
-  assert.equal(sb.read('.hermes/config.yaml'), original)
-})
-
-test('openclaw: a foreign box blocks connect and survives remove', { skip: NO_FAKE_BINS }, () => {
-  const sb = sandbox({ bins: { openclaw: FAKE_OPENCLAW } })
-  sb.write('.openclaw/openclaw.json', JSON.stringify({ mcp: { servers: { box: { url: BOX_COM, transport: 'streamable-http' } } } }))
-  assert.throws(() => client('openclaw').connect(sb.ctx, { mode: 'oauth' }), /--name/)
-  const rm = client('openclaw').remove(sb.ctx)
-  assert.deepEqual(rm.actions, [])
-  assert.equal(JSON.parse(sb.read('.openclaw/openclaw.json')).mcp.servers.box.url, BOX_COM)
-})
-
-test('claude-code: a foreign user-scope box is never removed', { skip: NO_FAKE_BINS }, () => {
-  const sb = sandbox({ bins: { claude: FAKE_CLAUDE } })
-  sb.write('.claude.json', JSON.stringify({ mcpServers: { box: { type: 'http', url: BOX_COM } } }))
-  client('claude').connect(sb.ctx) // plugin route: its server is plugin:simular-box:box, no clash
-  assert.equal(JSON.parse(sb.read('.claude.json')).mcpServers.box.url, BOX_COM)
-  const override = { ...sb.ctx, url: 'https://staging.relay.simular.cloud/mcp' }
-  assert.throws(() => client('claude').connect(override), /--name/)
-  client('claude').remove(sb.ctx)
-  assert.equal(JSON.parse(sb.read('.claude.json')).mcpServers.box.url, BOX_COM)
-  assert.ok(!JSON.parse(sb.read('fake-claude-state.json')).calls.some((c) => c.startsWith('mcp remove')))
-})
-
-test('a symlinked config stays a symlink and the target is updated', { skip: WIN && 'symlinks need admin on Windows' }, () => {
-  const sb = sandbox()
-  const real = sb.write('dotfiles/cursor-mcp.json', '{ "mcpServers": {} }\n')
-  fs.mkdirSync(path.join(sb.home, '.cursor'))
-  fs.symlinkSync(real, path.join(sb.home, '.cursor', 'mcp.json'))
-  client('cursor').connect(sb.ctx)
-  assert.ok(fs.lstatSync(path.join(sb.home, '.cursor', 'mcp.json')).isSymbolicLink())
-  assert.equal(JSON.parse(fs.readFileSync(real, 'utf8')).mcpServers.box.url, DEFAULT_MCP_URL)
-})
-
-test('key files: no backup keeps an old key after rotation or remove', () => {
-  const sb = sandbox()
-  client('hermes').connect(sb.ctx, { mode: 'key', key: KEY })
-  client('hermes').connect(sb.ctx, { mode: 'key', key: 'cb_rotated_key_456' })
-  client('hermes').remove(sb.ctx)
-  const leftovers = fs.readdirSync(path.join(sb.home, '.hermes')).filter((f) => f.startsWith('.env'))
-  assert.deepEqual(leftovers, ['.env'])
-  assert.equal(sb.read('.hermes/.env'), '')
-})
-
-test('opencode: reads box sign-in from `opencode mcp auth list`', async () => {
-  const { authListSaysSignedIn } = await import('../src/clients/opencode.js')
-  const out = (mark, status) => `\x1b[0m\n┌  MCP OAuth Status\n│\n●  ${mark} box \x1b[90m${status}\n│      \x1b[90mhttps://mcp.box.simular.ai/mcp\n│\n└  1 OAuth-capable server(s)\n`
-  assert.equal(authListSaysSignedIn(out('✗', 'not authenticated'), 'box'), false)
-  assert.equal(authListSaysSignedIn(out('✓', 'authenticated'), 'box'), true)
-  assert.equal(authListSaysSignedIn(out('⚠', 'expired'), 'box'), false)
-  assert.equal(authListSaysSignedIn(out('✓', 'authenticated'), 'simular-box'), undefined)
-})
diff --git a/cli/test/fakebox/bin/cocoonbox-agent b/cli/test/fakebox/bin/cocoonbox-agent
deleted file mode 100755
index 410592e..0000000
--- a/cli/test/fakebox/bin/cocoonbox-agent
+++ /dev/null
@@ -1,127 +0,0 @@
-#!/usr/bin/env node
-// A fake box packer for tests: the `cocoonbox-agent offload` verbs as contracts.md "Offload" states them, with the box
-// copy under $FAKE_BOX_WORKSPACE and the inbox and outbox as files under $FAKE_BOX_STATE. It does what the CLI depends
-// on (begin's refs, send's tar stream with the bundle indexed by `git index-pack --fix-thin`, read, end) and no CLI
-// session: a test plays the box agent by committing in the copy and posting `back` with FAKE_POST.
-import { execFileSync, spawnSync } from 'node:child_process'
-import fs from 'node:fs'
-import path from 'node:path'
-
-const [verb, ...args] = process.argv.slice(3)
-const opt = (name) => {
-  const i = args.indexOf(name)
-  return i < 0 ? undefined : args[i + 1]
-}
-const has = (name) => args.includes(name)
-const state = process.env.FAKE_BOX_STATE
-const reply = (obj, code = 0) => {
-  process.stdout.write(JSON.stringify(obj) + '\n')
-  process.exit(code)
-}
-const repo = opt('--repo')
-const file = (name) => path.join(state, `${repo}.${name}.json`)
-const load = (name, fallback) => {
-  try {
-    return JSON.parse(fs.readFileSync(file(name), 'utf8'))
-  } catch {
-    return fallback
-  }
-}
-const save = (name, v) => fs.writeFileSync(file(name), JSON.stringify(v))
-
-function stdin() {
-  return fs.readFileSync(0)
-}
-
-function untar(buf) {
-  const members = {}
-  let off = 0
-  let longName = null
-  while (off + 512 <= buf.length) {
-    const h = buf.subarray(off, off + 512)
-    if (h.every((b) => b === 0)) break
-    const name = h.subarray(0, 100).toString('utf8').replace(/\0.*$/s, '')
-    const size = parseInt(h.subarray(124, 136).toString('utf8').replace(/\0.*$/s, '').trim(), 8)
-    const type = String.fromCharCode(h[156])
-    const body = buf.subarray(off + 512, off + 512 + size)
-    off += 512 + Math.ceil(size / 512) * 512
-    if (type === 'x') {
-      longName = /path=(.*)\n/.exec(body.toString('utf8'))[1]
-      continue
-    }
-    members[longName || name] = Buffer.from(body)
-    longName = null
-  }
-  return members
-}
-
-switch (verb) {
-  case 'begin': {
-    if (process.env.FAKE_BEGIN_BLOCK) {
-      reply({ ok: false, code: 'refused', error: 'the box CLI is signed out', findings: [{ check: 'cli', outcome: 'block', detail: 'claude is signed out' }], cli: {} }, 3)
-    }
-    const dir = path.join(process.env.FAKE_BOX_WORKSPACE, opt('--name'))
-    fs.mkdirSync(dir, { recursive: true })
-    let refs = {}
-    if (fs.existsSync(path.join(dir, '.git', 'objects'))) {
-      const out = spawnSync('git', ['-C', dir, 'for-each-ref', '--format=%(refname) %(objectname)'], { encoding: 'utf8' }).stdout
-      for (const line of out.split('\n').filter(Boolean)) {
-        const [ref, oid] = line.split(' ')
-        refs[ref] = oid
-      }
-    }
-    save('session', { id: opt('--id'), dir, kind: opt('--kind') })
-    reply({ ok: true, dir, copy: Object.keys(refs).length ? 'mirror' : 'absent', refs, cli: { kind: opt('--kind'), version: '9.9.9', signed_in: true, account: 'test@example.com' }, ignored: [], findings: [] })
-    break
-  }
-  case 'send': {
-    const input = stdin()
-    if (has('--back') || has('--message')) {
-      const inbox = load('inbox', [])
-      inbox.push({ back: has('--back'), body: input.toString('utf8') })
-      save('inbox', inbox)
-      reply({ ok: true, seq: inbox.length, delivery: 'pasted' })
-    }
-    const session = load('session', null)
-    if (!session || session.id !== opt('--id')) reply({ ok: false, code: 'refused', error: 'another offload holds the copy' }, 3)
-    const members = untar(input)
-    fs.writeFileSync(path.join(state, `${repo}.handover.md`), members['handover.md'] || '')
-    fs.writeFileSync(path.join(state, `${repo}.env.json`), members['env.json'] || '')
-    const secrets = Object.keys(members).filter((n) => n.startsWith('secrets/'))
-    fs.writeFileSync(path.join(state, `${repo}.secrets.json`), JSON.stringify(secrets))
-    const dir = session.dir
-    fs.mkdirSync(path.join(dir, '.git', 'objects', 'pack'), { recursive: true })
-    fs.mkdirSync(path.join(dir, '.git', 'objects', 'info'), { recursive: true })
-    const bundle = members['offload.bundle']
-    if (bundle) {
-      // header lines up to a blank line, then the pack
-      const end = bundle.indexOf('\n\n')
-      const header = bundle.subarray(0, end).toString('utf8').split('\n').slice(1)
-      execFileSync('git', ['-C', dir, 'index-pack', '--stdin', '--fix-thin'], { input: bundle.subarray(end + 2), stdio: ['pipe', 'ignore', 'inherit'] })
-      for (const line of header) {
-        if (line.startsWith('-') || line.startsWith('@')) continue
-        const [oid, ref] = line.split(' ')
-        if (ref && ref.startsWith('refs/')) execFileSync('git', ['-C', dir, 'update-ref', ref, oid])
-      }
-    }
-    execFileSync('git', ['-C', dir, 'update-index', '-q', '--refresh'], { stdio: 'ignore' })
-    save('session', { ...session, started: true })
-    reply({ ok: true, delivery: 'started', accepted: true, tmux: `cb-off-${repo}-${opt('--kind')}`, timings_ms: {} })
-    break
-  }
-  case 'read': {
-    const since = Number(opt('--since') || 0)
-    const outbox = load('outbox', [])
-    reply({ ok: true, entries: outbox.filter((e) => e.seq > since), status: 'idle' })
-    break
-  }
-  case 'status':
-    reply({ ok: true, sessions: [] })
-    break
-  case 'end':
-    save('ended', true)
-    reply({ ok: true })
-    break
-  default:
-    reply({ ok: false, code: 'usage', error: `unknown verb ${verb}` }, 2)
-}
diff --git a/cli/test/fakebox/fake-box.js b/cli/test/fakebox/fake-box.js
deleted file mode 100644
index eefcf5b..0000000
--- a/cli/test/fakebox/fake-box.js
+++ /dev/null
@@ -1,93 +0,0 @@
-import { spawn } from 'node:child_process'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import grpc from '@grpc/grpc-js'
-import { loadServices } from '../../src/box/connection.js'
-
-// FakeBox is a local stand-in for the relay and one box: Boxes.List/Ensure, and Session.Exec running `bash -c` in a
-// workspace directory with a fake `cocoonbox-agent` first on PATH. It checks the bearer token and the box header as the
-// edge does, so the CLI's real gRPC, rsh, rsync and git paths run against it.
-
-const HERE = path.dirname(fileURLToPath(import.meta.url))
-export const TOKEN = 'cb_test_token'
-
-export async function startFakeBox({ workspace, state, box = { id: 'cb-test', name: 'main', state: 'BOX_STATE_RUNNING', image: 'sbxdesk:v7' }, env = {} }) {
-  const { Session, Boxes } = loadServices()
-  const server = new grpc.Server()
-  const calls = []
-  const authed = (call) => {
-    const auth = call.metadata.get('authorization')[0]
-    if (auth !== `Bearer ${TOKEN}`) return { code: grpc.status.UNAUTHENTICATED, details: auth ? 'invalid bearer token' : 'missing bearer token' }
-    return null
-  }
-  server.addService(Boxes.service, {
-    List(call, cb) {
-      const err = authed(call)
-      if (err) return cb(err)
-      calls.push('List')
-      cb(null, { boxes: [box] })
-    },
-    Ensure(call, cb) {
-      const err = authed(call)
-      if (err) return cb(err)
-      calls.push('Ensure')
-      box.state = 'BOX_STATE_RUNNING'
-      cb(null, { box })
-    },
-  })
-  server.addService(Session.service, {
-    Exec(call) {
-      const err = authed(call)
-      if (err) return call.destroy(Object.assign(new Error(err.details), err))
-      if (call.metadata.get('x-cocoonbox-box')[0] !== box.id) {
-        return call.destroy(Object.assign(new Error('no such box'), { code: grpc.status.NOT_FOUND }))
-      }
-      let child = null
-      call.on('data', (frame) => {
-        if (!child) {
-          if (frame.body !== 'start') return call.destroy(Object.assign(new Error('first frame must be start'), { code: grpc.status.INVALID_ARGUMENT }))
-          calls.push(frame.start.command)
-          child = spawn('bash', ['-c', frame.start.command], {
-            cwd: workspace,
-            detached: true,
-            env: { ...process.env, ...env, PATH: `${path.join(HERE, 'bin')}:${process.env.PATH}`, FAKE_BOX_STATE: state, FAKE_BOX_WORKSPACE: workspace },
-          })
-          child.stdin.on('error', () => {})
-          child.stdout.on('data', (d) => {
-            if (!call.write({ stdout: d })) {
-              child.stdout.pause()
-              call.once('drain', () => child.stdout.resume())
-            }
-          })
-          child.stderr.on('data', (d) => call.write({ stderr: d }))
-          child.on('close', (code, signal) => {
-            call.write({ exit_code: code ?? 128 + (signal === 'SIGINT' ? 2 : 15) })
-            call.end()
-          })
-          return
-        }
-        if (frame.body === 'stdin') child.stdin.write(frame.stdin)
-        else if (frame.body === 'eof') child.stdin.end()
-        else if (frame.body === 'signal') {
-          try {
-            process.kill(-child.pid, frame.signal === 'EXEC_SIGNAL_INT' ? 'SIGINT' : 'SIGTERM')
-          } catch {
-            // gone
-          }
-        }
-      })
-      call.on('end', () => child?.stdin.end())
-      call.on('cancelled', () => {
-        try {
-          process.kill(-child.pid, 'SIGKILL')
-        } catch {
-          // gone
-        }
-      })
-    },
-  })
-  const port = await new Promise((resolve, reject) =>
-    server.bindAsync('127.0.0.1:0', grpc.ServerCredentials.createInsecure(), (err, p) => (err ? reject(err) : resolve(p))),
-  )
-  return { endpoint: `http://127.0.0.1:${port}`, calls, box, stop: () => new Promise((r) => server.tryShutdown(r)) }
-}
diff --git a/cli/test/fixtures/broken.json b/cli/test/fixtures/broken.json
deleted file mode 100644
index 86a71ee..0000000
--- a/cli/test/fixtures/broken.json
+++ /dev/null
@@ -1 +0,0 @@
-{ "mcpServers": { "github": { "url": "x" }
diff --git a/cli/test/fixtures/codex.after.toml b/cli/test/fixtures/codex.after.toml
deleted file mode 100644
index 31019ec..0000000
--- a/cli/test/fixtures/codex.after.toml
+++ /dev/null
@@ -1,17 +0,0 @@
-# Codex config written by hand
-model = "gpt-5"
-
-[mcp_servers.docs]
-command = "npx"
-args = ["docs-mcp"] # keep this comment
-
-[mcp_servers.box.tools.shell]
-approval_mode = "approve"
-
-# Profiles: keep this comment with its table
-[profiles.fast]
-model = "gpt-5-mini"
-
-[mcp_servers.box]
-url = "https://mcp.box.simular.ai/mcp"
-startup_timeout_sec = 30
diff --git a/cli/test/fixtures/codex.before.toml b/cli/test/fixtures/codex.before.toml
deleted file mode 100644
index 76a1154..0000000
--- a/cli/test/fixtures/codex.before.toml
+++ /dev/null
@@ -1,21 +0,0 @@
-# Codex config written by hand
-model = "gpt-5"
-
-[mcp_servers.docs]
-command = "npx"
-args = ["docs-mcp"] # keep this comment
-
-[mcp_servers.box]
-url = "https://relay.simular.cloud/old-mcp"
-bearer_token_env_var = "OLD"
-startup_timeout_sec = 30
-
-[mcp_servers.box.tools.shell]
-approval_mode = "approve"
-
-[mcp_servers."box-control"]
-url = "https://relay.simular.cloud/control"
-
-# Profiles: keep this comment with its table
-[profiles.fast]
-model = "gpt-5-mini"
diff --git a/cli/test/fixtures/cursor.before.json b/cli/test/fixtures/cursor.before.json
deleted file mode 100644
index 7efb675..0000000
--- a/cli/test/fixtures/cursor.before.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  // Cursor servers the user already has
-  "mcpServers": {
-    "github": { "url": "https://api.githubcopilot.com/mcp/" },
-    "box-control": { "url": "https://relay.simular.cloud/control" },
-  },
-}
diff --git a/cli/test/fixtures/hermes.before.yaml b/cli/test/fixtures/hermes.before.yaml
deleted file mode 100644
index b38b7a7..0000000
--- a/cli/test/fixtures/hermes.before.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# Hermes settings
-model:
-  default: anthropic/claude-sonnet-4.5
-mcp_servers:
-  github:
-    command: npx   # GitHub server
-    args: [github-mcp]
diff --git a/cli/test/fixtures/opencode.before.jsonc b/cli/test/fixtures/opencode.before.jsonc
deleted file mode 100644
index ecee7b9..0000000
--- a/cli/test/fixtures/opencode.before.jsonc
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "$schema": "https://opencode.ai/config.json",
-  // theme first
-  "theme": "tokyonight",
-  "mcp": {
-    "local": { "type": "local", "command": ["bun", "x", "my-mcp"] }
-  }
-}
diff --git a/cli/test/fixtures/vscode.before.json b/cli/test/fixtures/vscode.before.json
deleted file mode 100644
index 56cddbd..0000000
--- a/cli/test/fixtures/vscode.before.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  "inputs": [],
-  "servers": {
-    "playwright": { "command": "npx", "args": ["@playwright/mcp@latest"] }
-  }
-}
diff --git a/cli/test/fsutil.test.js b/cli/test/fsutil.test.js
deleted file mode 100644
index 95694cb..0000000
--- a/cli/test/fsutil.test.js
+++ /dev/null
@@ -1,39 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { updateFile } from '../src/fsutil.js'
-
-test('updateFile backs up, writes atomically, and is a no-op when nothing changes', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'box-fs-'))
-  const file = path.join(dir, 'a.json')
-  fs.writeFileSync(file, 'old\n', { mode: 0o640 })
-  const first = updateFile(file, () => 'new\n')
-  assert.equal(first.changed, true)
-  assert.equal(fs.readFileSync(first.backup, 'utf8'), 'old\n')
-  assert.equal(fs.readFileSync(file, 'utf8'), 'new\n')
-  if (process.platform !== 'win32') assert.equal(fs.statSync(file).mode & 0o777, 0o640)
-  const second = updateFile(file, () => 'new\n')
-  assert.deepEqual(second, { changed: false, backup: null })
-  assert.equal(fs.readdirSync(dir).length, 2)
-})
-
-test('updateFile creates new key files 0600 and tightens existing ones', { skip: process.platform === 'win32' && 'no POSIX file modes on Windows' }, () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'box-fs-'))
-  const fresh = path.join(dir, 'sub', 'new.env')
-  updateFile(fresh, () => 'X=1\n', { mode: 0o600 })
-  assert.equal(fs.statSync(fresh).mode & 0o777, 0o600)
-  const loose = path.join(dir, 'loose.env')
-  fs.writeFileSync(loose, 'A=1\n', { mode: 0o644 })
-  updateFile(loose, (t) => t + 'B=2\n', { mode: 0o600 })
-  assert.equal(fs.statSync(loose).mode & 0o777, 0o600)
-})
-
-test('dry run changes nothing', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'box-fs-'))
-  const file = path.join(dir, 'a.json')
-  const res = updateFile(file, () => 'x', { dryRun: true })
-  assert.equal(res.changed, true)
-  assert.equal(fs.existsSync(file), false)
-})
diff --git a/cli/test/helpers.js b/cli/test/helpers.js
deleted file mode 100644
index 1edc2fe..0000000
--- a/cli/test/helpers.js
+++ /dev/null
@@ -1,94 +0,0 @@
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { createContext } from '../src/context.js'
-
-export const FIXTURES = path.join(path.dirname(fileURLToPath(import.meta.url)), 'fixtures')
-export const fixture = (name) => fs.readFileSync(path.join(FIXTURES, name), 'utf8')
-
-/** A temporary HOME with an empty bin dir on PATH; nothing outside it is touched. */
-export function sandbox({ env = {}, bins = {} } = {}) {
-  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'box-cli-test-'))
-  const bin = path.join(home, '.bin')
-  fs.mkdirSync(bin)
-  for (const [name, source] of Object.entries(bins)) {
-    const file = path.join(bin, name)
-    fs.writeFileSync(file, `#!${process.execPath}\n${source}`, { mode: 0o755 })
-  }
-  // On Windows, libuv copies USERPROFILE (and a few others) from the parent into a child env
-  // that lacks them, so point every home-like variable into the sandbox explicitly.
-  const fullEnv = {
-    HOME: home,
-    USERPROFILE: home,
-    APPDATA: path.join(home, 'AppData', 'Roaming'),
-    LOCALAPPDATA: path.join(home, 'AppData', 'Local'),
-    PATH: bin,
-    ...env,
-  }
-  const ctx = createContext({ env: fullEnv, platform: 'linux' })
-  const write = (rel, text, mode) => {
-    const file = path.join(home, rel)
-    fs.mkdirSync(path.dirname(file), { recursive: true })
-    fs.writeFileSync(file, text, mode ? { mode } : undefined)
-    return file
-  }
-  const read = (rel) => {
-    try {
-      return fs.readFileSync(path.join(home, rel), 'utf8')
-    } catch {
-      return null
-    }
-  }
-  return { home, ctx, write, read, env: fullEnv }
-}
-
-/** Fake `claude`: records calls and keeps plugin / user-scope server state in $HOME. */
-export const FAKE_CLAUDE = String.raw`
-const fs = require('fs'), path = require('path')
-const home = process.env.HOME
-const stateFile = path.join(home, 'fake-claude-state.json')
-const cfgFile = path.join(home, '.claude.json')
-const state = fs.existsSync(stateFile) ? JSON.parse(fs.readFileSync(stateFile, 'utf8')) : { marketplaces: [], plugins: {}, calls: [] }
-const cfg = fs.existsSync(cfgFile) ? JSON.parse(fs.readFileSync(cfgFile, 'utf8')) : {}
-const a = process.argv.slice(2)
-state.calls.push(a.join(' '))
-const save = () => { fs.writeFileSync(stateFile, JSON.stringify(state)); fs.writeFileSync(cfgFile, JSON.stringify(cfg)) }
-const is = (...w) => w.every((x, i) => a[i] === x)
-// The marketplace's plugin points at state.latestUrl (default: the current URL); an installed plugin keeps the URL it was installed with until updated.
-const latest = () => state.latestUrl || 'https://mcp.box.simular.ai/mcp'
-if (is('plugin', 'list')) console.log(JSON.stringify(Object.entries(state.plugins).map(([id, p]) => ({ id, scope: 'user', enabled: p.enabled, mcpServers: { box: { type: 'http', url: p.url } } }))))
-else if (is('plugin', 'marketplace', 'list')) console.log(JSON.stringify(state.marketplaces.map((name) => ({ name }))))
-else if (is('plugin', 'marketplace', 'add')) state.marketplaces.push('simular-box')
-else if (is('plugin', 'install')) { if (!state.marketplaces.includes('simular-box')) { console.error('marketplace not found'); process.exit(1) } state.plugins[a[2]] = { enabled: true, url: latest() } }
-else if (is('plugin', 'marketplace', 'update')) {}
-else if (is('plugin', 'update')) { if (!state.staleMarketplace) state.plugins[a[2]].url = latest() }
-else if (is('plugin', 'enable')) state.plugins[a[2]].enabled = true
-else if (is('plugin', 'disable')) state.plugins[a[2]].enabled = false
-else if (is('plugin', 'uninstall')) delete state.plugins[a[2]]
-else if (is('mcp', 'add')) { cfg.mcpServers = cfg.mcpServers || {}; cfg.mcpServers[a[a.length - 2]] = { type: 'http', url: a[a.length - 1] } }
-else if (is('mcp', 'remove')) { if (cfg.mcpServers) delete cfg.mcpServers[a[a.length - 1]] }
-else { console.error('unexpected: ' + a.join(' ')); process.exit(2) }
-save()
-`
-
-/** Fake `openclaw`: like the real one, `mcp show` prints values with ${VAR} substituted from .env. */
-export const FAKE_OPENCLAW = String.raw`
-const fs = require('fs'), path = require('path')
-const dir = path.join(process.env.HOME, '.openclaw')
-const file = path.join(dir, 'openclaw.json')
-const calls = path.join(process.env.HOME, 'fake-openclaw-calls.log')
-const a = process.argv.slice(2)
-fs.appendFileSync(calls, a.slice(0, 3).join(' ') + '\n')
-const cfg = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : {}
-const servers = (cfg.mcp && cfg.mcp.servers) || {}
-const envText = fs.existsSync(path.join(dir, '.env')) ? fs.readFileSync(path.join(dir, '.env'), 'utf8') : ''
-const sub = (s) => s.replace(/\$\{([A-Z_]+)\}/g, (m, k) => { const r = new RegExp('^' + k + '=(.*)$', 'm').exec(envText); return r ? r[1] : m })
-const save = () => { fs.mkdirSync(dir, { recursive: true }); fs.writeFileSync(file, JSON.stringify(cfg, null, 2)) }
-if (a[0] === 'mcp' && a[1] === 'show') { if (!servers[a[2]]) { console.error('unknown'); process.exit(1) } console.log(sub(JSON.stringify(servers[a[2]]))) }
-else if (a[0] === 'mcp' && a[1] === 'set') { cfg.mcp = cfg.mcp || {}; cfg.mcp.servers = { ...servers, [a[2]]: JSON.parse(a[3]) }; save(); console.log('Saved MCP server "' + a[2] + '" to ' + file) }
-else if (a[0] === 'mcp' && a[1] === 'unset') { delete servers[a[2]]; cfg.mcp.servers = servers; save() }
-else if (a[0] === 'mcp' && a[1] === 'reload') {}
-else if (a[0] === 'gateway' && a[1] === 'health') process.exit(1)
-else { console.error('unexpected: ' + a.join(' ')); process.exit(2) }
-`
diff --git a/cli/test/offload-e2e.test.js b/cli/test/offload-e2e.test.js
deleted file mode 100644
index 5cec366..0000000
--- a/cli/test/offload-e2e.test.js
+++ /dev/null
@@ -1,217 +0,0 @@
-import { test, before, after } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawn, execFileSync } from 'node:child_process'
-import crypto from 'node:crypto'
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { startFakeBox, TOKEN } from './fakebox/fake-box.js'
-import { HANDOVER_TEMPLATE } from '../src/offload/model.js'
-
-// Offload and back end to end against a fake box: the CLI's real gRPC Exec, rsh as rsync's and git's remote shell, the
-// tar stream with the bundle, and the merge at back. Needs bash, git and rsync (macOS and Linux CI have them).
-
-const BIN = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'simular-box.js')
-const skip = process.platform === 'win32' || !hasRsync() ? 'needs bash, git and rsync' : false
-
-function hasRsync() {
-  try {
-    execFileSync('rsync', ['--version'], { stdio: 'ignore' })
-    return true
-  } catch {
-    return false
-  }
-}
-
-let tmp, box, env
-const git = (cwd, ...args) => execFileSync('git', args, { cwd, encoding: 'utf8', env: { ...process.env, ...IDENT } }).trim()
-const IDENT = { GIT_AUTHOR_NAME: 't', GIT_AUTHOR_EMAIL: 't@x', GIT_COMMITTER_NAME: 't', GIT_COMMITTER_EMAIL: 't@x' }
-
-function cli(args, { cwd, input, extraEnv = {} } = {}) {
-  return new Promise((resolve) => {
-    const child = spawn(process.execPath, [BIN, ...args], { cwd, env: { ...env, ...extraEnv } })
-    const out = []
-    const err = []
-    child.stdout.on('data', (d) => out.push(d))
-    child.stderr.on('data', (d) => err.push(d))
-    child.on('close', (code) => resolve({ code, stdout: Buffer.concat(out), text: Buffer.concat(out).toString('utf8'), stderr: Buffer.concat(err).toString('utf8') }))
-    if (input !== undefined) child.stdin.end(input)
-    else child.stdin.end()
-  })
-}
-
-function handover(goal) {
-  return HANDOVER_TEMPLATE.replace('<one-line goal>', goal)
-}
-
-/** playBoxAgent commits change in the copy, makes S' as the box packer's `post --back` does, and posts back. */
-function playBoxAgent({ dir, offload_id: id, repo: key }, change) {
-  for (const [file, text] of Object.entries(change)) fs.writeFileSync(path.join(dir, file), text)
-  git(dir, 'add', '-A')
-  git(dir, 'commit', '-qm', 'box work')
-  const tree = git(dir, 'rev-parse', 'HEAD^{tree}')
-  const snap = git(dir, 'commit-tree', tree, '-p', 'HEAD', '-m', 'back')
-  git(dir, 'update-ref', `refs/cocoonbox/back/${id}`, snap)
-  const outbox = path.join(tmp, 'state', `${key}.outbox.json`)
-  const entries = fs.existsSync(outbox) ? JSON.parse(fs.readFileSync(outbox, 'utf8')) : []
-  entries.push({ seq: entries.length + 1, kind: 'back', offload_id: id, cli: 'claude', time_ms: Date.now(), body: handover('done in the box') })
-  fs.writeFileSync(outbox, JSON.stringify(entries))
-}
-
-function makeRepo(name) {
-  const repo = path.join(tmp, name)
-  fs.mkdirSync(repo)
-  git(repo, 'init', '-q', '-b', 'main')
-  fs.writeFileSync(path.join(repo, 'a.txt'), 'one\n')
-  fs.writeFileSync(path.join(repo, 'b.txt'), 'bee\n')
-  fs.writeFileSync(path.join(repo, '.gitignore'), 'node_modules/\n.env\n')
-  git(repo, 'add', '-A')
-  git(repo, 'commit', '-qm', 'init')
-  return repo
-}
-
-before(async () => {
-  if (skip) return
-  tmp = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'box-offload-e2e-')))
-  for (const d of ['workspace', 'state', 'home']) fs.mkdirSync(path.join(tmp, d))
-  box = await startFakeBox({ workspace: path.join(tmp, 'workspace'), state: path.join(tmp, 'state'), env: IDENT })
-  env = { PATH: process.env.PATH, HOME: path.join(tmp, 'home'), BOX_HOME: path.join(tmp, 'home', '.simular-box'), BOX_ENDPOINT: box.endpoint, BOX_TOKEN: TOKEN, ...IDENT }
-})
-
-after(async () => {
-  if (skip) return
-  await box.stop()
-  fs.rmSync(tmp, { recursive: true, force: true })
-})
-
-test('rsh passes bytes, exit codes and stderr, and drops rsync host words', { skip, timeout: 60000 }, async () => {
-  const data = crypto.randomBytes(300 << 10)
-  const cat = await cli(['rsh', '--box', 'main', 'box', 'cat'], { input: data })
-  assert.equal(cat.code, 0)
-  assert.ok(cat.stdout.equals(data), 'cat returns the bytes unchanged')
-  const exit = await cli(['rsh', 'main', 'echo out; echo err >&2; exit 42'])
-  assert.equal(exit.code, 42)
-  assert.equal(exit.text, 'out\n')
-  assert.match(exit.stderr, /err/)
-  const none = await cli(['rsh', '--box', 'main'])
-  assert.equal(none.code, 255)
-  // a closed local reader ends rsh quietly with 255 (no stack trace), and the box command is cancelled
-  const pipe = await new Promise((resolve) => {
-    const child = spawn('bash', ['-c', `"${process.execPath}" "${BIN}" rsh --box main 'yes | head -c 50000000' | head -c 10 >/dev/null; echo "rc=\${PIPESTATUS[0]}"`], { env })
-    let out = ''
-    let err = ''
-    child.stdout.on('data', (d) => (out += d))
-    child.stderr.on('data', (d) => (err += d))
-    child.on('close', () => resolve({ out, err }))
-  })
-  assert.match(pipe.out, /rc=255/)
-  assert.ok(!/\n\s+at /.test(pipe.err), pipe.err)
-  const bad = await cli(['rsh', '--box', 'main', 'true'], { extraEnv: { BOX_TOKEN: 'cb_wrong' } })
-  assert.equal(bad.code, 255)
-  assert.match(bad.stderr, /invalid bearer token/)
-  assert.ok(!bad.stderr.includes('cb_wrong'), 'the token is never printed')
-})
-
-test('offload warns, then moves the task; back fast-forwards the box commits', { skip, timeout: 60000 }, async () => {
-  const repo = makeRepo('proj')
-  fs.writeFileSync(path.join(repo, 'a.txt'), 'one\nuncommitted\n')
-  fs.writeFileSync(path.join(repo, 'new.txt'), 'untracked\n')
-  fs.writeFileSync(path.join(repo, '.env'), 'SECRET=1\n')
-  fs.mkdirSync(path.join(repo, 'node_modules'))
-  fs.writeFileSync(path.join(repo, 'node_modules', 'big.js'), 'x')
-
-  const where = (await cli(['offload', 'handover-path'], { cwd: repo })).text.trim()
-  assert.ok(where.startsWith(env.BOX_HOME))
-  fs.writeFileSync(where, handover('finish the thing'))
-
-  const warned = await cli(['offload', '--kind', 'claude', '--json'], { cwd: repo })
-  assert.equal(warned.code, 4, warned.stderr)
-  const w = JSON.parse(warned.text)
-  assert.equal(w.code, 'confirm')
-  assert.ok(w.findings.some((f) => f.check === 'secrets' && f.detail.includes('.env')))
-
-  const done = await cli(['offload', '--kind', 'claude', '--yes', '--json'], { cwd: repo })
-  assert.equal(done.code, 0, done.stderr + done.text)
-  const r = JSON.parse(done.text)
-  assert.equal(r.accepted, true)
-  const copy = r.dir
-  assert.equal(fs.readFileSync(path.join(copy, 'a.txt'), 'utf8'), 'one\nuncommitted\n')
-  assert.equal(fs.readFileSync(path.join(copy, 'new.txt'), 'utf8'), 'untracked\n')
-  assert.ok(!fs.existsSync(path.join(copy, '.env')), 'ignored files stay here')
-  assert.ok(!fs.existsSync(path.join(copy, 'node_modules')))
-  // the bundle carried history and S
-  assert.equal(git(copy, 'rev-parse', `refs/cocoonbox/offload/${r.offload_id}`), git(repo, 'rev-parse', `refs/cocoonbox/offload/${r.offload_id}`))
-  assert.equal(git(copy, 'rev-parse', 'HEAD'), git(repo, 'rev-parse', 'HEAD'))
-  assert.equal(fs.readFileSync(path.join(tmp, 'state', `${r.repo}.handover.md`), 'utf8'), handover('finish the thing'))
-  const envJson = JSON.parse(fs.readFileSync(path.join(tmp, 'state', `${r.repo}.env.json`), 'utf8'))
-  assert.equal(envJson.v, 1)
-
-  // the record is 0600 in a 0700 directory
-  const rec = path.join(env.BOX_HOME, 'offload', r.repo, 'offload.json')
-  assert.equal(fs.statSync(rec).mode & 0o777, 0o600)
-  assert.equal(fs.statSync(path.dirname(rec)).mode & 0o777, 0o700)
-
-  playBoxAgent(r, { 'a.txt': 'one\nuncommitted\nfrom the box\n' })
-  const back = await cli(['back', '--json'], { cwd: repo })
-  assert.equal(back.code, 0, back.stderr + back.text)
-  const b = JSON.parse(back.text)
-  assert.match(b.landing, /^fast-forward: this branch now points at the box's commit [0-9a-f]{7}$/)
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'one\nuncommitted\nfrom the box\n')
-  assert.equal(git(repo, 'log', '-1', '--format=%s'), 'box work')
-  assert.equal(git(repo, 'status', '--porcelain'), '')
-  assert.equal(fs.readFileSync(path.join(repo, '.env'), 'utf8'), 'SECRET=1\n')
-  assert.ok(!fs.existsSync(rec), 'back removes the record')
-  // the three offload Execs, rsync and git over rsh, and the back verbs all went through Session.Exec
-  assert.ok(box.calls.some((c) => c.startsWith('cocoonbox-agent offload begin')))
-  assert.ok(box.calls.some((c) => /^rsync --server/.test(c)), box.calls.join('\n'))
-  assert.ok(box.calls.some((c) => /^git-upload-pack /.test(c)), box.calls.join('\n'))
-  assert.ok(box.calls.some((c) => c.startsWith('cocoonbox-agent offload end')))
-  const again = await cli(['back'], { cwd: repo })
-  assert.equal(again.code, 1)
-  assert.match(again.stderr, /back\.md/)
-})
-
-test('back applies a clean merge uncommitted when the user worked meanwhile, else a branch', { skip, timeout: 60000 }, async () => {
-  const repo = makeRepo('proj2')
-  const where = (await cli(['offload', 'handover-path'], { cwd: repo })).text.trim()
-  fs.writeFileSync(where, handover('second'))
-  const done = await cli(['offload', '--kind', 'claude', '--yes', '--json'], { cwd: repo })
-  assert.equal(done.code, 0, done.stderr)
-  const r = JSON.parse(done.text)
-  fs.writeFileSync(path.join(repo, 'b.txt'), 'bee\nlocal edit\n')
-  playBoxAgent(r, { 'a.txt': 'one\nbox edit\n' })
-  const back = JSON.parse((await cli(['back', '--json'], { cwd: repo })).text)
-  assert.match(back.landing, /^merged: this branch now points at the box's commit [0-9a-f]{7}; the changes you made meanwhile are kept; uncommitted: b\.txt$/)
-  assert.equal(git(repo, 'log', '-1', '--format=%s'), 'box work', 'HEAD moved to the box commit')
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'one\nbox edit\n')
-  assert.equal(fs.readFileSync(path.join(repo, 'b.txt'), 'utf8'), 'bee\nlocal edit\n')
-
-  // a conflict: the box changes the file the user also changed
-  fs.writeFileSync(where, handover('third'))
-  git(repo, 'add', '-A')
-  git(repo, 'commit', '-qm', 'local')
-  const third = JSON.parse((await cli(['offload', '--kind', 'claude', '--yes', '--json'], { cwd: repo })).text)
-  fs.writeFileSync(path.join(repo, 'a.txt'), 'mine\n')
-  playBoxAgent(third, { 'a.txt': 'theirs\n' })
-  const conflict = JSON.parse((await cli(['back', '--json'], { cwd: repo })).text)
-  assert.match(conflict.landing, /^conflict: the box's work is on the branch cocoonbox\/back-/)
-  assert.equal(fs.readFileSync(path.join(repo, 'a.txt'), 'utf8'), 'mine\n', 'the work tree is untouched')
-})
-
-test('a box-side block exits 3 and names the box CLI commands', { skip, timeout: 60000 }, async () => {
-  const repo = makeRepo('proj3')
-  fs.writeFileSync((await cli(['offload', 'handover-path'], { cwd: repo })).text.trim(), handover('blocked'))
-  // the block comes from begin; run the fake agent with FAKE_BEGIN_BLOCK through a box restarted with it
-  const blocked = await startFakeBox({ workspace: path.join(tmp, 'workspace'), state: path.join(tmp, 'state'), env: { ...IDENT, FAKE_BEGIN_BLOCK: '1' } })
-  try {
-    const res = await cli(['offload', '--kind', 'claude'], { cwd: repo, extraEnv: { BOX_ENDPOINT: blocked.endpoint } })
-    assert.equal(res.code, 3, res.stderr)
-    assert.match(res.text, /block\s+cli: claude is signed out/)
-    assert.match(res.text, /offload sign-in --kind claude/)
-  } finally {
-    await blocked.stop()
-  }
-  const bad = await cli(['offload', '--kind', 'claude', '--handover', path.join(tmp, 'nope.md')], { cwd: repo })
-  assert.equal(bad.code, 1)
-})
diff --git a/cli/test/offload-unit.test.js b/cli/test/offload-unit.test.js
deleted file mode 100644
index 602b305..0000000
--- a/cli/test/offload-unit.test.js
+++ /dev/null
@@ -1,363 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { execFileSync } from 'node:child_process'
-import fs from 'node:fs'
-import http from 'node:http'
-import os from 'node:os'
-import path from 'node:path'
-import { parseArgs } from '../src/args.js'
-import { endpointUrl } from '../src/box/endpoint.js'
-import { authorizeUrl, browserLogin, challenge, deviceName } from '../src/box/login.js'
-import { parseRsh, pickBox } from '../src/box/rsh.js'
-import { TokenStore } from '../src/box/token-store.js'
-import { HANDOVER_TEMPLATE, copyName, findSignInLink, handoverProblems, loginCommand, repoKey } from '../src/offload/model.js'
-import { appleOnly, commands, imageFinding, isPrivate, macOSOnly, namesPort } from '../src/offload/preflight.js'
-import { parseVersion } from '../src/offload/env-probe.js'
-import { escape } from '../src/offload/offloader.js'
-import { tarParts } from '../src/offload/tar.js'
-
-const tmpdir = () => fs.mkdtempSync(path.join(os.tmpdir(), 'box-unit-'))
-
-test('hand-over template: the template itself passes; missing, repeated and title problems are listed', () => {
-  const good = HANDOVER_TEMPLATE.replace('<one-line goal>', 'x')
-  assert.deepEqual(handoverProblems(good), [])
-  const missing = good.replace('## Gotchas learned\n', '')
-  assert.deepEqual(handoverProblems(missing), ['missing "## Gotchas learned"'])
-  assert.deepEqual(handoverProblems('x\n' + good), ['the first line does not start with "# Hand-over: "'])
-  assert.match(handoverProblems(good + '\n## Commands\n').join(), /appears 2 times/)
-  assert.match(handoverProblems(good + 'x'.repeat(256 << 10)).join(), /larger than 256 KiB/)
-})
-
-test('names: repo key, copy name', () => {
-  assert.equal(repoKey('/a/b', 'abc'), repoKey('/a/b', 'abc'))
-  assert.equal(repoKey('/a/b', '').length, 12)
-  assert.notEqual(repoKey('/a/b', 'x'), repoKey('/a/c', 'x'))
-  assert.equal(copyName('/x/my repo!'), 'my-repo-')
-  assert.equal(copyName('/x/..hidden'), 'hidden')
-  assert.equal(copyName('/x/' + 'a'.repeat(80)).length, 64)
-  assert.equal(copyName('/x/日本'), '--')
-})
-
-test('sign-in link: only https on the vendor hosts, OSC 8 targets first, escapes stripped', () => {
-  const osc = '\x1b]8;;https://claude.ai/oauth/authorize?code=1\x07click\x1b]8;;\x07'
-  assert.equal(findSignInLink(`Visit ${osc}`, 'claude'), 'https://claude.ai/oauth/authorize?code=1')
-  assert.equal(findSignInLink('go to \x1b[1mhttps://auth.openai.com/codex/device\x1b[0m.', 'codex'), 'https://auth.openai.com/codex/device')
-  assert.equal(findSignInLink('https://evil.example/claude.ai http://claude.ai/x https://claude.ai.evil.com/', 'claude'), null)
-  assert.equal(findSignInLink('https://user:pw@claude.ai/', 'claude'), null)
-  assert.equal(findSignInLink('https://console.anthropic.com/oauth', 'claude'), 'https://console.anthropic.com/oauth')
-  assert.equal(findSignInLink('https://claude.ai/x', 'codex'), null)
-  assert.equal(loginCommand('claude'), 'BROWSER=true NO_OPEN_BROWSER=1 claude auth login')
-})
-
-test('tar stream: a ustar archive with a pax path that system tar reads', () => {
-  const dir = tmpdir()
-  const big = path.join(dir, 'big.bin')
-  fs.writeFileSync(big, Buffer.alloc(70000, 7))
-  const long = 'secrets/file/' + 'd/'.repeat(60) + 'x.env'
-  const parts = tarParts([['handover.md', Buffer.from('hi\n')], ['offload.bundle', { file: big }], [long, Buffer.from('S=1\n')]])
-  const buf = Buffer.concat(parts.map((p) => (Buffer.isBuffer(p) ? p : fs.readFileSync(p.file))))
-  assert.equal(buf.length % 512, 0)
-  const tarFile = path.join(dir, 'x.tar')
-  fs.writeFileSync(tarFile, buf)
-  const out = path.join(dir, 'out')
-  fs.mkdirSync(out)
-  execFileSync('tar', ['-xf', tarFile, '-C', out])
-  assert.equal(fs.readFileSync(path.join(out, 'handover.md'), 'utf8'), 'hi\n')
-  assert.equal(fs.statSync(path.join(out, 'offload.bundle')).size, 70000)
-  assert.equal(fs.readFileSync(path.join(out, long), 'utf8'), 'S=1\n')
-})
-
-test('token store: 0600 file in a 0700 dir; BOX_TOKEN wins and is never written', () => {
-  const dir = path.join(tmpdir(), '.simular-box')
-  const store = new TokenStore(dir, {})
-  assert.equal(store.get('https://e'), null)
-  store.set('https://e', 'cb_x', 'browser')
-  if (process.platform !== 'win32') {
-    // Windows has no POSIX modes; the file sits in the user's profile
-    assert.equal(fs.statSync(store.file).mode & 0o777, 0o600)
-    assert.equal(fs.statSync(dir).mode & 0o777, 0o700)
-  }
-  assert.deepEqual(store.get('https://e'), { token: 'cb_x', source: 'browser' })
-  const env = new TokenStore(dir, { BOX_TOKEN: 'cb_env' })
-  assert.deepEqual(env.get('https://e'), { token: 'cb_env', source: 'env' })
-  assert.deepEqual(env.saved('https://e'), { token: 'cb_x', source: 'browser' })
-  assert.ok(!fs.readFileSync(store.file, 'utf8').includes('cb_env'))
-  assert.equal(store.remove('https://e'), true)
-  assert.equal(store.get('https://e'), null)
-})
-
-test('endpoint: BOX_ENDPOINT, else the origin of BOX_MCP_URL, else prod; https only off localhost', () => {
-  assert.equal(endpointUrl({}), 'https://mcp.box.simular.ai')
-  assert.equal(endpointUrl({ BOX_MCP_URL: 'https://staging.relay.simular.cloud/mcp' }), 'https://staging.relay.simular.cloud')
-  assert.equal(endpointUrl({ BOX_ENDPOINT: 'http://127.0.0.1:9' }), 'http://127.0.0.1:9')
-  assert.throws(() => endpointUrl({ BOX_ENDPOINT: 'http://relay.example' }), /https/)
-})
-
-test('args: offload flags; a token is never an argument except --token -', () => {
-  const a = parseArgs(['offload', 'send', '--interrupt', 'hello', 'there', '--box', 'main'])
-  assert.deepEqual(a.rest, ['send', 'hello', 'there'])
-  assert.equal(a.flags.box, 'main')
-  assert.equal(a.flags.interrupt, true)
-  assert.equal(parseArgs(['login', '--token', '-']).flags.token, '-')
-  assert.throws(() => parseArgs(['login', '--token', 'cb_secret']), /never as an argument/)
-  assert.throws(() => parseArgs(['login', '--token=cb_secret']), /never as an argument/)
-})
-
-test('rsh: options, host words and box choice', () => {
-  assert.deepEqual(parseRsh(['--box', 'main', '-t', 'box', 'ls', '-la']), { options: { box: 'main', tty: true }, words: ['box', 'ls', '-la'] })
-  assert.deepEqual(parseRsh(['-l', 'user', 'main', '--', 'x']).words, ['main', '--', 'x'])
-  assert.throws(() => parseRsh(['-x']), /unknown option/)
-  const boxes = [{ id: 'cb-1', name: 'main' }, { id: 'cb-2', name: 'other' }]
-  assert.equal(pickBox(boxes, 'cb-1', ['box', 'rsync', '--server']).command, 'rsync --server')
-  assert.equal(pickBox(boxes, 'main', ['u@other', 'ls']).command, 'ls')
-  assert.equal(pickBox(boxes, 'main', ['ls']).command, 'ls')
-  assert.equal(pickBox(boxes, null, ['other', 'git-upload-pack', "'/w/r'"]).box.id, 'cb-2')
-  assert.throws(() => pickBox(boxes, null, ['nobox', 'ls']), /name the box/)
-  assert.throws(() => pickBox(boxes, 'zzz', ['ls']), /no box named/)
-})
-
-test('preflight pieces', () => {
-  assert.equal(imageFinding('sbxdesk:v7'), null)
-  assert.equal(imageFinding('cbdesk:v22'), null)
-  assert.equal(imageFinding('cbdesk:v21').outcome, 'block')
-  const h = HANDOVER_TEMPLATE.replace('- Build: `<command>`', '- Build: `xcodebuild -scheme X && sudo /usr/bin/open .`')
-  assert.deepEqual(commands(h).filter((c) => c === 'xcodebuild' || c === 'open'), ['xcodebuild', 'open'])
-  assert.equal(macOSOnly('/nonexistent', [], h)[0].outcome, 'block')
-  assert.equal(macOSOnly('/nonexistent', ['App.xcodeproj/project.pbxproj'], HANDOVER_TEMPLATE)[0].outcome, 'warn')
-  assert.equal(appleOnly('platforms: [.macOS(.v14), .iOS(.v17)]'), true)
-  assert.equal(appleOnly('platforms: [.macOS(.v14), .linux]'), false)
-  assert.equal(namesPort(5432, 'DATABASE_URL=postgres://localhost:5432/x'), true)
-  assert.equal(namesPort(5432, 'nothing'), false)
-  assert.ok(isPrivate('10.1.2.3') && isPrivate('192.168.0.1') && isPrivate('100.64.0.1') && isPrivate('fd00::1'))
-  assert.ok(!isPrivate('8.8.8.8'))
-  assert.equal(parseVersion('go version go1.26.5 darwin/arm64'), '1.26.5')
-  assert.equal(parseVersion('v22.11.0'), '22.11.0')
-  assert.equal(escape('a*b?[c]\\d'), 'a\\*b\\?\\[c]\\\\d')
-})
-
-test('browser login: PKCE, state and issuer checked, the code redeemed for a device token', async () => {
-  let issuer
-  let seen
-  const server = http.createServer((req, res) => {
-    let body = ''
-    req.on('data', (d) => (body += d))
-    req.on('end', () => {
-      seen = Object.fromEntries(new URLSearchParams(body))
-      res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ access_token: 'cb_device', token_type: 'Bearer' }))
-    })
-  })
-  await new Promise((r) => server.listen(0, '127.0.0.1', r))
-  issuer = `http://127.0.0.1:${server.address().port}`
-  let authUrl
-  try {
-    const token = await browserLogin(issuer, {
-      device: 'laptop',
-      open: async (url) => {
-        authUrl = new URL(url)
-        const q = authUrl.searchParams
-        // the consent page redirects back with the code, the state and the issuer
-        const back = new URL(q.get('redirect_uri'))
-        back.search = new URLSearchParams({ code: 'c1', state: q.get('state'), iss: issuer }).toString()
-        setTimeout(() => fetch(back), 10)
-      },
-    })
-    assert.equal(token, 'cb_device')
-    assert.equal(authUrl.pathname, '/cb/oauth/authorize')
-    assert.equal(authUrl.searchParams.get('client_id'), 'cocoonbox-cli')
-    assert.equal(authUrl.searchParams.get('scope'), 'account')
-    assert.equal(authUrl.searchParams.get('device_name'), 'laptop')
-    assert.match(authUrl.searchParams.get('redirect_uri'), /^http:\/\/127\.0\.0\.1:\d+\/callback$/)
-    assert.equal(seen.grant_type, 'authorization_code')
-    assert.equal(seen.code, 'c1')
-    assert.equal(challenge(seen.code_verifier), authUrl.searchParams.get('code_challenge'))
-    await assert.rejects(
-      browserLogin(issuer, {
-        open: async (url) => {
-          const q = new URL(url).searchParams
-          setTimeout(() => fetch(`${q.get('redirect_uri')}?code=c&state=wrong&iss=${encodeURIComponent(issuer)}`), 10)
-        },
-      }),
-      /another sign-in/,
-    )
-    await assert.rejects(
-      browserLogin(issuer, {
-        open: async (url) => {
-          const q = new URL(url).searchParams
-          setTimeout(() => fetch(`${q.get('redirect_uri')}?code=c&state=${q.get('state')}&iss=https://evil.example`), 10)
-        },
-      }),
-      /not http/,
-    )
-  } finally {
-    server.close()
-  }
-  assert.equal(deviceName('mac.local'), 'mac')
-  assert.ok(authorizeUrl('https://e', { redirect: 'r', challenge: 'c', state: 's', device: 'd' }).startsWith('https://e/cb/oauth/authorize?'))
-})
-
-test('browser: one argv element, no shell, on every platform; win32 never goes through cmd', async () => {
-  const { browserCommand, openBrowser } = await import('../src/box/browser.js')
-  const evil = 'https://claude.ai/x?a=1&calc|whoami^%PATH%'
-  for (const platform of ['win32', 'darwin', 'linux']) {
-    const [cmd, args] = browserCommand(evil, { env: {}, platform })
-    assert.notEqual(cmd, 'cmd')
-    assert.equal(args[args.length - 1], new URL(evil).href, platform)
-    assert.ok(!args.some((a) => a === '/c'))
-  }
-  assert.deepEqual(browserCommand(evil, { env: {}, platform: 'win32' }), ['rundll32', ['url.dll,FileProtocolHandler', new URL(evil).href]])
-  assert.equal(browserCommand('file:///etc/passwd', { env: {} }), null)
-  assert.equal(browserCommand('javascript:alert(1)', { env: {} }), null)
-  const seen = []
-  const fakeSpawn = (cmd, args, opts) => {
-    seen.push({ cmd, args, opts })
-    return { on: () => ({ unref() {} }) }
-  }
-  assert.equal(openBrowser(evil, { env: {}, platform: 'win32', spawn: fakeSpawn }), true)
-  assert.equal(seen[0].opts.shell, false)
-  assert.equal(seen[0].args.length, 2)
-})
-
-test('browser: a real opener gets the URL as one argument and no shell runs its metacharacters', { skip: process.platform === 'win32' }, async () => {
-  const { openBrowser } = await import('../src/box/browser.js')
-  const dir = tmpdir()
-  const out = path.join(dir, 'argv.json')
-  const pwned = path.join(dir, 'pwned')
-  const opener = path.join(dir, 'opener')
-  fs.writeFileSync(opener, `#!${process.execPath}\nrequire('fs').writeFileSync(${JSON.stringify(out)}, JSON.stringify(process.argv.slice(2)))\n`, { mode: 0o755 })
-  const evil = `https://claude.ai/x?a=1&touch ${pwned};touch ${pwned}|touch ${pwned}^%PATH%$(touch ${pwned})`
-  assert.equal(openBrowser(evil, { env: { BROWSER: opener } }), true)
-  for (let i = 0; i < 100 && !fs.existsSync(out); i++) await new Promise((r) => setTimeout(r, 20))
-  const argv = JSON.parse(fs.readFileSync(out, 'utf8'))
-  assert.deepEqual(argv, [new URL(evil).href])
-  assert.ok(!fs.existsSync(pwned))
-})
-
-test('sign-in link: the normalized URL; | ^ and quotes end a link, a target with them is skipped', () => {
-  assert.equal(findSignInLink('open https://claude.ai/x?&calc now', 'claude'), 'https://claude.ai/x?&calc')
-  assert.equal(findSignInLink('https://claude.ai/x|calc', 'claude'), 'https://claude.ai/x')
-  assert.equal(findSignInLink('https://claude.ai/x^calc', 'claude'), 'https://claude.ai/x')
-  assert.equal(findSignInLink('\x1b]8;;https://claude.ai/x|calc\x07t\x1b]8;;\x07', 'claude'), null)
-  assert.equal(findSignInLink('https://CLAUDE.ai/a%20b', 'claude'), 'https://claude.ai/a%20b')
-})
-
-test('tty escape: ~. at line start disconnects, ~~ sends ~, other ~ pass through', async () => {
-  const { escapeFilter } = await import('../src/box/rsh.js')
-  let gone = 0
-  const f = escapeFilter(() => gone++)
-  assert.deepEqual(f(Buffer.from('a~b')), { data: Buffer.from('a~b'), disconnect: false })
-  assert.deepEqual(f(Buffer.from('\r~~x')), { data: Buffer.from('\r~x'), disconnect: false })
-  assert.deepEqual(f(Buffer.from('\r~')), { data: Buffer.from('\r'), disconnect: false })
-  assert.deepEqual(f(Buffer.from('q')), { data: Buffer.from('~q'), disconnect: false })
-  assert.equal(gone, 0)
-  assert.deepEqual(f(Buffer.from('\r~.')), { data: Buffer.from('\r'), disconnect: true })
-  assert.equal(gone, 1)
-  const g = escapeFilter(() => gone++)
-  assert.equal(g(Buffer.from('~.')).disconnect, true, 'the first byte is a line start')
-})
-
-test('back pastes BACK again once when the box CLI never took it, and only after a paste', async () => {
-  const { Offloader } = await import('../src/offload/offloader.js')
-  const { OffloadStore } = await import('../src/offload/store.js')
-  const home = tmpdir()
-  const store = new OffloadStore(home)
-  store.save({ id: 'id1', repo: 'k1', box: 'b', box_name: 'main', name: 'r', dir: '/w/r', kind: 'claude', base: null, top: null, started_at_ms: 0, seen: 0 })
-  const run = async (firstDelivery) => {
-    const sends = []
-    let posted = false
-    class Fake extends Offloader {
-      async verb(args) {
-        if (args[0] === 'status') return { sessions: [{ repo: 'k1', status: sends.length ? 'working' : 'idle', hook_at_ms: 5 }] }
-        if (args[0] === 'send') {
-          sends.push(args.slice(3).join(' '))
-          if (sends.length === 2) posted = true
-          return { delivery: sends.length === 1 ? firstDelivery : 'pasted' }
-        }
-        if (args[0] === 'read') {
-          await new Promise((r) => setTimeout(r, 20))
-          return { status: 'working', entries: posted ? [{ seq: 1, kind: 'back', offload_id: 'id1', body: '# Hand-over: x' }] : [] }
-        }
-        return { ok: true }
-      }
-    }
-    const f = new Fake({ connection: { endpoint: 'e', token: 't' }, box: { id: 'b' }, store, rsh: 'x', env: {} })
-    const out = await f.back('k1', { retryS: 0.05, waitS: 1, pollMs: 5 }).catch((e) => e)
-    store.save({ id: 'id1', repo: 'k1', box: 'b', box_name: 'main', name: 'r', dir: '/w/r', kind: 'claude', base: null, top: null, started_at_ms: 0, seen: 0 })
-    return { sends, out }
-  }
-  const pasted = await run('pasted')
-  assert.deepEqual(pasted.sends, ['--back', '--back --interrupt'])
-  assert.equal(pasted.out.handover, '# Hand-over: x')
-  const queued = await run('queued')
-  assert.deepEqual(queued.sends, ['--back'], 'a queued BACK is never re-sent')
-  assert.match(queued.out.message, /has not handed the work back/)
-})
-
-test('back waits for the box agent to be idle twice in a row before asking for its hand-over', async () => {
-  const { Offloader } = await import('../src/offload/offloader.js')
-  const { OffloadStore } = await import('../src/offload/store.js')
-  const home = tmpdir()
-  const store = new OffloadStore(home)
-  const record = { id: 'id1', repo: 'k1', box: 'b', box_name: 'main', name: 'r', dir: '/w/r', kind: 'claude', base: null, top: null, started_at_ms: 0, seen: 0 }
-  const run = async (statuses, opts) => {
-    store.save(record)
-    const log = []
-    let i = 0
-    let sent = false
-    class Fake extends Offloader {
-      async verb(args) {
-        if (args[0] === 'status') {
-          const status = statuses[Math.min(i++, statuses.length - 1)]
-          log.push(`status ${status}`)
-          return { sessions: status === null ? [] : [{ repo: 'k1', status, hook_at_ms: 1 }] }
-        }
-        if (args[0] === 'send') {
-          log.push(`send ${args.slice(3).join(' ')}`)
-          sent = true
-          return { delivery: 'accepted' }
-        }
-        if (args[0] === 'read') return { status: 'idle', entries: sent ? [{ seq: 1, kind: 'back', offload_id: 'id1', body: '# Hand-over: x' }] : [] }
-        return { ok: true }
-      }
-    }
-    const progress = []
-    const f = new Fake({ connection: { endpoint: 'e', token: 't' }, box: { id: 'b' }, store, rsh: 'x', env: {} })
-    f.progress = (m) => progress.push(m)
-    const out = await f.back('k1', { waitS: 0.3, pollMs: 5, ...opts }).catch((e) => e)
-    return { log, out, progress }
-  }
-  const busy = await run(['working', 'working', 'idle', 'working', 'idle', 'idle'])
-  assert.deepEqual(busy.log.filter((l) => l.startsWith('status')).slice(0, 6), ['status working', 'status working', 'status idle', 'status working', 'status idle', 'status idle'])
-  // one more status read after the wait records the hook time for the pasted-retry check
-  assert.equal(busy.log.indexOf('send --back'), 7, 'BACK goes out only after two idle polls in a row')
-  assert.equal(busy.out.handover, '# Hand-over: x')
-  assert.match(busy.progress[0], /waiting for it to go idle/)
-
-  const blocked = await run(['blocked', 'blocked'])
-  assert.equal(blocked.log.indexOf('send --back'), 3, 'a session blocked by an unconfirmed delivery takes BACK again')
-
-  const unknown = await run([null])
-  assert.equal(unknown.log.indexOf('send --back'), 2, 'a box that reports no session status is not waited on')
-
-  const never = await run(['working'])
-  assert.ok(!never.log.some((l) => l.startsWith('send')), 'nothing is sent when it never goes idle')
-  assert.match(never.out.message, /still working after .* nothing was sent.*back --interrupt/)
-
-  const stopped = await run(['stopped'])
-  assert.match(stopped.out.message, /stopped without handing the work back/)
-
-  const interrupt = await run(['working'], { interrupt: true })
-  assert.deepEqual(interrupt.log.filter((l) => l.startsWith('send')), ['send --back --interrupt'], '--interrupt skips the wait')
-})
-
-test('landing summaries say where HEAD went and what is left uncommitted', async () => {
-  const { landingSummary } = await import('../src/offload/git.js')
-  const head = 'ae472b8c0ffee00000000000000000000000000'
-  assert.equal(landingSummary({ kind: 'fastForward', head, uncommitted: [] }), "fast-forward: this branch now points at the box's commit ae472b8")
-  assert.equal(landingSummary({ kind: 'fastForward', head, uncommitted: ['b.txt'] }), "fast-forward: this branch now points at the box's commit ae472b8; uncommitted: b.txt")
-  assert.equal(landingSummary({ kind: 'fastForward', head: null, uncommitted: ['a.txt'] }), "fast-forward: the box made no commit; its changes are applied uncommitted (a.txt)")
-  assert.equal(
-    landingSummary({ kind: 'merged', files: ['calc.py'], head, uncommitted: ['__pycache__/calc.pyc'] }),
-    "merged: this branch now points at the box's commit ae472b8; the changes you made meanwhile are kept; uncommitted: __pycache__/calc.pyc",
-  )
-  assert.equal(landingSummary({ kind: 'merged', files: ['a.txt'], head: null, uncommitted: ['a.txt'] }), "merged: the box's changes are applied uncommitted (a.txt)")
-})
diff --git a/e2e/cli.mjs b/e2e/cli.mjs
new file mode 100644
index 0000000..f2edbf0
--- /dev/null
+++ b/e2e/cli.mjs
@@ -0,0 +1,39 @@
+// The box CLI these tests run: the Rust `simular-box` from simular-ai/box-cli, at the exact
+// version the Claude plugin pins (claude/skills/box-offload/SKILL.md; CI keeps every pin under
+// claude/ on one version that is on npm). Set BOX_CLI to a binary to test another build, for
+// example a local `target/release/simular-box` from a box-cli checkout.
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+export const REPO = path.join(path.dirname(fileURLToPath(import.meta.url)), '..')
+
+export function pinnedVersion() {
+  const skill = fs.readFileSync(path.join(REPO, 'claude', 'skills', 'box-offload', 'SKILL.md'), 'utf8')
+  const m = skill.match(/@simular-ai\/box@(\d+\.\d+\.\d+)/)
+  if (!m) throw new Error('no exact @simular-ai/box@X.Y.Z pin in claude/skills/box-offload/SKILL.md')
+  return m[1]
+}
+
+/** [command, ...leading args] to spawn the CLI with. */
+export function boxCommand(env = process.env) {
+  if (env.BOX_CLI) return [env.BOX_CLI]
+  return ['npx', '-y', `@simular-ai/box@${pinnedVersion()}`]
+}
+
+export function which(bin, env = process.env, platform = process.platform) {
+  const dirs = (env.PATH || env.Path || '').split(path.delimiter).filter(Boolean)
+  const exts = platform === 'win32' ? (env.PATHEXT || '.EXE;.CMD;.BAT').split(';') : ['']
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      const candidate = path.join(dir, bin + ext)
+      try {
+        const st = fs.statSync(candidate)
+        if (st.isFile() && (platform === 'win32' || st.mode & 0o111)) return candidate
+      } catch {
+        // not here
+      }
+    }
+  }
+  return null
+}
diff --git a/cli/e2e/clients.json b/e2e/clients.json
similarity index 100%
rename from cli/e2e/clients.json
rename to e2e/clients.json
diff --git a/cli/e2e/install-matrix.mjs b/e2e/install-matrix.mjs
similarity index 77%
rename from cli/e2e/install-matrix.mjs
rename to e2e/install-matrix.mjs
index fbd4be9..8736203 100644
--- a/cli/e2e/install-matrix.mjs
+++ b/e2e/install-matrix.mjs
@@ -1,45 +1,59 @@
-// Layer 1: run the real CLI against a real, installed client in an isolated HOME.
+// Layer 1: run the real box CLI against a real, installed client in an isolated HOME.
 //   node e2e/install-matrix.mjs <client>
-// Seeds an unrelated server and a box set up at box's old address (relay.simular.cloud), runs
-// `connect --client <client> --yes`, checks that it moved box to the current URL and said so, checks
-// with the client's own listing command that box is there, re-runs connect (must change nothing),
-// runs `doctor`, then `remove`, and checks that the unrelated server survived. No secrets, no sign-in.
+// The CLI is the Rust simular-box at the version the Claude plugin pins (see cli.mjs; BOX_CLI
+// overrides it). Seeds an unrelated server and a box set up at box's old address
+// (relay.simular.cloud), runs `connect --client <client> --yes`, checks that it moved box to the
+// current URL and said so, checks with the client's own listing command that box is there,
+// re-runs connect (must change nothing), runs `doctor`, then `remove`, and checks that the
+// unrelated server survived. No secrets, no sign-in.
 import assert from 'node:assert/strict'
 import fs from 'node:fs'
 import path from 'node:path'
-import { fileURLToPath, pathToFileURL } from 'node:url'
+import { pathToFileURL } from 'node:url'
 import spawn from 'cross-spawn'
 import { isolatedEnv } from './isolated-env.mjs'
-import { createContext } from '../src/context.js'
-import { findClient } from '../src/clients/index.js'
+import { REPO, boxCommand, which } from './cli.mjs'
 
-const CLI = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'simular-box.js')
 const URL_RE = /mcp\.box\.simular\.ai\/mcp/
 const OLD_URL = 'https://relay.simular.cloud/mcp'
-const REPO = path.join(path.dirname(CLI), '..', '..')
 const id = process.argv[2]
-const client = findClient(id)
-if (!client) throw new Error(`unknown client ${id}`)
 
 const { home, env } = isolatedEnv()
-if (client.id === 'codex' && process.platform === 'win32') {
+if (id === 'codex' && process.platform === 'win32') {
   // On Windows, Codex finds the home folder through the OS profile API, not USERPROFILE, so a
   // temp HOME alone would point it at the runner's real profile. CODEX_HOME is its own override,
   // which the CLI honours too.
   env.CODEX_HOME = path.join(home, '.codex')
   fs.mkdirSync(env.CODEX_HOME, { recursive: true })
 }
-const ctx = createContext({ env })
 console.log(`isolated HOME: ${home}`)
 
-function sh(bin, args, { allowFail = false, timeout = 180000 } = {}) {
+// Where each client keeps its MCP servers, as the CLI reads them (only the ones seeded by hand).
+const CLIENTS = {
+  'claude-code': { name: 'Claude Code' },
+  codex: { name: 'Codex', config: () => path.join(env.CODEX_HOME || path.join(home, '.codex'), 'config.toml') },
+  opencode: { name: 'OpenCode', config: () => path.join(env.XDG_CONFIG_HOME, 'opencode', 'opencode.json') },
+  openclaw: { name: 'OpenClaw' },
+  hermes: {
+    name: 'Hermes Agent',
+    config: () => path.join(process.platform === 'win32' ? path.join(env.LOCALAPPDATA, 'hermes') : path.join(home, '.hermes'), 'config.yaml'),
+  },
+  'gemini-cli': { name: 'Gemini CLI', config: () => path.join(home, '.gemini', 'settings.json') },
+  cursor: { name: 'Cursor', config: () => path.join(home, '.cursor', 'mcp.json') },
+}
+const client = CLIENTS[id] && { id, ...CLIENTS[id] }
+if (!client) throw new Error(`unknown client ${id}`)
+
+function sh(bin, args, { allowFail = false, timeout = 180000, stdoutOnly = false } = {}) {
   const res = spawn.sync(bin, args, { env, cwd: home, encoding: 'utf8', timeout })
   const out = `${res.stdout || ''}${res.stderr || ''}`
   console.log(`$ ${bin} ${args.join(' ')}  (exit ${res.status})\n${out.trim().split('\n').map((l) => `  ${l}`).join('\n')}`)
   if (!allowFail && res.status !== 0) throw new Error(`${bin} ${args.join(' ')} failed with exit ${res.status}`)
-  return out
+  return stdoutOnly ? res.stdout || '' : out
 }
-const box = (...args) => sh(process.execPath, [CLI, ...args])
+const [boxBin, ...boxArgs] = boxCommand(env)
+const box = (...args) => sh(boxBin, [...boxArgs, ...args])
+const boxJson = (...args) => JSON.parse(sh(boxBin, [...boxArgs, ...args], { stdoutOnly: true }))
 const writeJson = (file, value) => {
   fs.mkdirSync(path.dirname(file), { recursive: true })
   fs.writeFileSync(file, JSON.stringify(value, null, 2))
@@ -112,7 +126,7 @@ const ADAPTERS = {
     seed: () => {
       sh('codex', ['mcp', 'add', 'other', '--', 'npx', '-y', 'other-mcp'])
       // `codex mcp add --url` would start the sign-in, so the old entry is written by hand.
-      fs.appendFileSync(client.configLocation(ctx), `\n[mcp_servers.box]\nurl = "${OLD_URL}"\n`)
+      fs.appendFileSync(client.config(), `\n[mcp_servers.box]\nurl = "${OLD_URL}"\n`)
     },
     list: () => sh('codex', ['mcp', 'list']),
     present: (out) => /^box\s+https:\/\/mcp\.box\.simular\.ai\/mcp/m.test(out),
@@ -122,7 +136,7 @@ const ADAPTERS = {
   opencode: {
     bin: 'opencode',
     seed: () =>
-      writeJson(client.configLocation(ctx), {
+      writeJson(client.config(), {
         $schema: 'https://opencode.ai/config.json',
         mcp: { other: { type: 'remote', url: 'https://example.com/mcp', enabled: false }, box: { type: 'remote', url: OLD_URL, enabled: true } },
       }),
@@ -144,7 +158,7 @@ const ADAPTERS = {
   hermes: {
     bin: 'hermes',
     seed: () => {
-      const file = client.configLocation(ctx)
+      const file = client.config()
       fs.mkdirSync(path.dirname(file), { recursive: true })
       fs.writeFileSync(file, `# seeded by the e2e test\nmcp_servers:\n  other:\n    command: npx\n    args: [-y, other-mcp]\n    enabled: false\n  box:\n    url: ${OLD_URL}\n    auth: oauth\n`)
     },
@@ -154,7 +168,7 @@ const ADAPTERS = {
   },
   'gemini-cli': {
     bin: 'gemini',
-    seed: () => writeJson(client.configLocation(ctx), { mcpServers: { other: { httpUrl: 'https://example.com/mcp' }, box: { type: 'http', url: OLD_URL } } }),
+    seed: () => writeJson(client.config(), { mcpServers: { other: { httpUrl: 'https://example.com/mcp' }, box: { type: 'http', url: OLD_URL } } }),
     // The isolated HOME is not a trusted folder, so Gemini lists the servers as Disabled and
     // never connects; the listing still proves it reads our entry as an http server.
     list: () => sh('gemini', ['mcp', 'list']),
@@ -163,7 +177,7 @@ const ADAPTERS = {
   },
   cursor: {
     bin: 'cursor-agent',
-    seed: () => writeJson(client.configLocation(ctx), { mcpServers: { other: { url: 'https://example.com/mcp' }, box: { url: OLD_URL } } }),
+    seed: () => writeJson(client.config(), { mcpServers: { other: { url: 'https://example.com/mcp' }, box: { url: OLD_URL } } }),
     list: () => sh('cursor-agent', ['mcp', 'list']),
     present: (out) => /^box:/m.test(out),
     otherKept: (out) => /^other:/m.test(out),
@@ -172,7 +186,7 @@ const ADAPTERS = {
 
 const a = ADAPTERS[client.id]
 if (!a) throw new Error(`no install-matrix adapter for ${client.id}`)
-if (!ctx.which(a.bin)) throw new Error(`${a.bin} is not on PATH; install the client first`)
+if (!which(a.bin, env)) throw new Error(`${a.bin} is not on PATH; install the client first`)
 
 a.seed()
 let out = box('connect', '--client', client.id, '--yes')
@@ -189,7 +203,7 @@ out = box('connect', '--client', client.id, '--yes')
 assert.match(out, new RegExp(`${client.name}: already set up`), 're-run is a no-op')
 assert.deepEqual(backups(), before, 're-run writes no new backup')
 
-const report = JSON.parse(box('doctor', '--client', client.id, '--json'))
+const report = boxJson('doctor', '--client', client.id, '--json')
 const row = report.clients[0]
 assert.equal(report.endpoint.ok, true, 'prod endpoint answers 401 + metadata')
 assert.equal(row.configured, true)
diff --git a/cli/e2e/isolated-env.mjs b/e2e/isolated-env.mjs
similarity index 92%
rename from cli/e2e/isolated-env.mjs
rename to e2e/isolated-env.mjs
index 31dcd70..756abb1 100644
--- a/cli/e2e/isolated-env.mjs
+++ b/e2e/isolated-env.mjs
@@ -20,6 +20,8 @@ export function isolatedEnv(base = process.env, { keep = [] } = {}) {
     XDG_STATE_HOME: path.join(home, '.local', 'state'),
     XDG_CACHE_HOME: path.join(home, '.cache'),
     NO_COLOR: '1',
+    // npx runs the CLI; keep npm's own notices out of its output.
+    NPM_CONFIG_UPDATE_NOTIFIER: 'false',
     CI: base.CI || '1',
   })
   for (const d of [env.APPDATA, env.LOCALAPPDATA, env.XDG_CONFIG_HOME, env.XDG_DATA_HOME, env.XDG_STATE_HOME, env.XDG_CACHE_HOME]) fs.mkdirSync(d, { recursive: true })
diff --git a/cli/e2e/live.mjs b/e2e/live.mjs
similarity index 85%
rename from cli/e2e/live.mjs
rename to e2e/live.mjs
index 440df6d..ea5ee76 100644
--- a/cli/e2e/live.mjs
+++ b/e2e/live.mjs
@@ -1,5 +1,6 @@
 // Layer 2: with a real staging key, prove each headless client can reach box and list its tools.
 //   BOX_MCP_URL=<staging> BOX_TOKEN=cb_... node e2e/live.mjs [clients...]
+// The CLI is the Rust simular-box at the version the Claude plugin pins (see cli.mjs).
 // Uses an isolated HOME. Never prints the key; tool calls are never made.
 import assert from 'node:assert/strict'
 import dns from 'node:dns/promises'
@@ -8,9 +9,9 @@ import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import spawn from 'cross-spawn'
 import { isolatedEnv } from './isolated-env.mjs'
+import { boxCommand } from './cli.mjs'
 
 const HERE = path.dirname(fileURLToPath(import.meta.url))
-const CLI = path.join(HERE, '..', 'bin', 'simular-box.js')
 const url = process.env.BOX_MCP_URL
 const key = process.env.BOX_TOKEN
 if (!url || !key) throw new Error('set BOX_MCP_URL and BOX_TOKEN')
@@ -39,18 +40,19 @@ try {
 }
 
 const { env } = isolatedEnv(process.env, { keep: ['BOX_MCP_URL', 'BOX_TOKEN'] })
+const [boxBin, ...boxArgs] = boxCommand(env)
 const scrub = (s) => s.split(key).join('***')
-function sh(bin, args, { allowFail = false } = {}) {
+function sh(bin, args, { allowFail = false, stdoutOnly = false } = {}) {
   const res = spawn.sync(bin, args, { env, encoding: 'utf8', timeout: 180000 })
   const out = scrub(`${res.stdout || ''}${res.stderr || ''}`)
   console.log(`$ ${bin} ${args.join(' ')}  (exit ${res.status})\n${out.trim().split('\n').map((l) => `  ${l}`).join('\n')}`)
   if (!allowFail && res.status !== 0) throw new Error(`${bin} ${args.join(' ')} failed`)
-  return out
+  return stdoutOnly ? scrub(res.stdout || '') : out
 }
 
 sh(process.execPath, [path.join(HERE, 'mcp-tools.mjs')])
-sh(process.execPath, [CLI, 'connect', '--client', clients.join(','), '--auth', 'key', '--yes'])
-const report = JSON.parse(sh(process.execPath, [CLI, 'doctor', '--client', clients.join(','), '--json'], { allowFail: true }))
+sh(boxBin, [...boxArgs, 'connect', '--client', clients.join(','), '--auth', 'key', '--yes'])
+const report = JSON.parse(sh(boxBin, [...boxArgs, 'doctor', '--client', clients.join(','), '--json'], { allowFail: true, stdoutOnly: true }))
 assert.equal(report.endpoint.ok, true, 'endpoint answers 401 + metadata')
 for (const row of report.clients) {
   assert.equal(row.key?.valid, true, `${row.name}: the key is valid`)
diff --git a/cli/e2e/mcp-tools.mjs b/e2e/mcp-tools.mjs
similarity index 100%
rename from cli/e2e/mcp-tools.mjs
rename to e2e/mcp-tools.mjs
diff --git a/e2e/package-lock.json b/e2e/package-lock.json
new file mode 100644
index 0000000..4c67b73
--- /dev/null
+++ b/e2e/package-lock.json
@@ -0,0 +1,82 @@
+{
+  "name": "box-plugin-e2e",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "box-plugin-e2e",
+      "license": "MIT",
+      "dependencies": {
+        "cross-spawn": "7.0.6"
+      },
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "license": "ISC"
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    }
+  }
+}
diff --git a/e2e/package.json b/e2e/package.json
new file mode 100644
index 0000000..f8ef3b5
--- /dev/null
+++ b/e2e/package.json
@@ -0,0 +1,13 @@
+{
+  "name": "box-plugin-e2e",
+  "private": true,
+  "description": "End-to-end checks of the box CLI (simular-ai/box-cli) and this repo's plugins against real, installed clients.",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=18.17"
+  },
+  "dependencies": {
+    "cross-spawn": "7.0.6"
+  }
+}