{"_id":"@bekirdag/cvbox","_rev":"7-5fc7d71c2d3e9b25a6e1d7d03103321c","name":"@bekirdag/cvbox","dist-tags":{"latest":"0.1.16"},"versions":{"0.1.0":{"name":"@bekirdag/cvbox","version":"0.1.0","license":"MIT","_id":"@bekirdag/cvbox@0.1.0","maintainers":[{"name":"bekirdag","email":"bekir@piyote.com"}],"homepage":"https://cloneversion.com","bugs":{"url":"https://github.com/bekirdag/bekirs_mind_clone/issues"},"bin":{"cvbox":"dist/cvbox.js"},"dist":{"shasum":"a64c404dc35d19b27a0984b3a39aae88c2cd9106","tarball":"https://registry.npmjs.org/@bekirdag/cvbox/-/cvbox-0.1.0.tgz","fileCount":20,"integrity":"sha512-3B/53jYvvOGcT+CmcRRCd6ybiotJDZb+rPJ6ynM6gOHyvyfpLAMQVIlM7Irf67g2DuZfdRv281EjTaU/JJBprA==","signatures":[{"sig":"MEUCICG4t/BgUWksgZ2VmrgHfWjCAHgeSpqPIgAXBY2Mc6ZyAiEA3xXNzQxCkFnj941AO4mMp1uy8h6gztNudC/Rm/cqDfk=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":75989},"main":"./dist/index.js","type":"module","_from":"file:.artifacts/cvbox/bekirdag-cvbox-0.1.0.tgz","types":"./dist/index.d.ts","engines":{"node":">=22.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"test":"vitest run src","build":"node --eval=\"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && esbuild src/cli.ts --bundle --platform=node --format=esm --target=node22 --banner:js='#!/usr/bin/env node' --outfile=dist/cvbox.js && chmod +x dist/cvbox.js","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"bekirdag","email":"bekir@piyote.com"},"_resolved":"/Users/bekirdag/Documents/apps/bekirs_mind_clone/.artifacts/cvbox/bekirdag-cvbox-0.1.0.tgz","_integrity":"sha512-3B/53jYvvOGcT+CmcRRCd6ybiotJDZb+rPJ6ynM6gOHyvyfpLAMQVIlM7Irf67g2DuZfdRv281EjTaU/JJBprA==","repository":{"url":"git+https://github.com/bekirdag/bekirs_mind_clone.git","type":"git","directory":"packages/cvbox"},"_npmVersion":"11.16.0","description":"Secure outbound-only machine agent for Clone Version","directories":{},"sideEffects":false,"_nodeVersion":"26.3.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"esbuild":"^0.25.0"},"_npmOperationalInternal":{"tmp":"tmp/cvbox_0.1.0_1784198631595_0.48126465322190026","host":"s3://npm-registry-packages-npm-production"}},"0.1.3":{"name":"@bekirdag/cvbox","version":"0.1.3","license":"MIT","_id":"@bekirdag/cvbox@0.1.3","maintainers":[{"name":"bekirdag","email":"bekir@piyote.com"}],"homepage":"https://cloneversion.com","bugs":{"url":"https://github.com/bekirdag/bekirs_mind_clone/issues"},"bin":{"cvbox":"dist/cvbox.js"},"dist":{"shasum":"1bc592b502e4f9f71568adae862ba985ece37579","tarball":"https://registry.npmjs.org/@bekirdag/cvbox/-/cvbox-0.1.3.tgz","fileCount":20,"integrity":"sha512-5i1LXixTYQ3tgJErzQlCyXX4CZ5dXyBLknjcbsh0yQ9ePefFwZH0CEJkx6z/GD8eQFc0aM2P+GrUl99zEl5d7A==","signatures":[{"sig":"MEUCICk8o03GDEeKD62Qs59e4iBl0uPOs03IJzSvp2vJS+YjAiEAolihmfvepWtMPgmn1jmDWFefRcTquu6oD7RRcpvJIcY=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":80740},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","engines":{"node":">=22.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"gitHead":"2bd79d8507899bc0930027d9c3349acb045e6a0c","scripts":{"test":"vitest run src","build":"node --eval=\"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && esbuild src/cli.ts --bundle --platform=node --format=esm --target=node22 --banner:js='#!/usr/bin/env node' --outfile=dist/cvbox.js && chmod +x dist/cvbox.js","prepack":"npm run build && npm test","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79eb6e9d-3f5a-43d0-8f25-0e3e2d4fca2c"}},"repository":{"url":"git+https://github.com/bekirdag/bekirs_mind_clone.git","type":"git","directory":"packages/cvbox"},"_npmVersion":"11.16.0","description":"Secure outbound-only machine agent for Clone Version","directories":{},"sideEffects":false,"_nodeVersion":"24.18.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"3.2.7","esbuild":"0.25.12","typescript":"5.9.3","@types/node":"22.20.0"},"_npmOperationalInternal":{"tmp":"tmp/cvbox_0.1.3_1784203222979_0.013291034511129896","host":"s3://npm-registry-packages-npm-production"}},"0.1.4":{"name":"@bekirdag/cvbox","version":"0.1.4","license":"MIT","_id":"@bekirdag/cvbox@0.1.4","maintainers":[{"name":"bekirdag","email":"bekir@piyote.com"}],"homepage":"https://cloneversion.com","bugs":{"url":"https://github.com/bekirdag/bekirs_mind_clone/issues"},"bin":{"cvbox":"dist/cvbox.js"},"dist":{"shasum":"11957394a51680a7083481a4aa73a5c83c853488","tarball":"https://registry.npmjs.org/@bekirdag/cvbox/-/cvbox-0.1.4.tgz","fileCount":20,"integrity":"sha512-k+rTUjkhqWZ0/xSuKn9aLDc2pgRU2j8YDyoq1RP0Dg5zPhb8LxFbytmhD32YSueN0aZgpb/yfd5zWkz4/keIgg==","signatures":[{"sig":"MEUCIQDhElaIbUl4dZVmT5DKHM7QRf22903emOrsAjm76kv9iQIgJlWNJEtZc6ipmUCG1DcaBaFfhG1GE7u4gQkX1ogFScA=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":80919},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","engines":{"node":">=22.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"gitHead":"646b4b92fe91cd348d1f8e343d16395652c07478","scripts":{"test":"vitest run src","build":"node --eval=\"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && esbuild src/cli.ts --bundle --platform=node --format=esm --target=node22 --banner:js='#!/usr/bin/env node' --outfile=dist/cvbox.js && chmod +x dist/cvbox.js","prepack":"npm run build && npm test","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79eb6e9d-3f5a-43d0-8f25-0e3e2d4fca2c"}},"repository":{"url":"git+https://github.com/bekirdag/bekirs_mind_clone.git","type":"git","directory":"packages/cvbox"},"_npmVersion":"11.16.0","description":"Secure outbound-only machine agent for Clone Version","directories":{},"sideEffects":false,"_nodeVersion":"24.18.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"3.2.7","esbuild":"0.25.12","typescript":"5.9.3","@types/node":"22.20.0"},"_npmOperationalInternal":{"tmp":"tmp/cvbox_0.1.4_1784203494842_0.0426324904880353","host":"s3://npm-registry-packages-npm-production"}},"0.1.5":{"name":"@bekirdag/cvbox","version":"0.1.5","license":"MIT","_id":"@bekirdag/cvbox@0.1.5","maintainers":[{"name":"bekirdag","email":"bekir@piyote.com"}],"homepage":"https://cloneversion.com","bugs":{"url":"https://github.com/bekirdag/bekirs_mind_clone/issues"},"bin":{"cvbox":"dist/cvbox.js"},"dist":{"shasum":"413bfb733e9ddb39516378521b12e4e200ff2008","tarball":"https://registry.npmjs.org/@bekirdag/cvbox/-/cvbox-0.1.5.tgz","fileCount":20,"integrity":"sha512-2lKJoaHPjOgG16adl6KaPwfzE5yaIAv28peAm3ZiiCGsKKfhmDefuC+2RyXiIiBwc4LveixHiEQFr/u+ZJqBCg==","signatures":[{"sig":"MEQCIFMsxuLcfY4WMRSip3ZvFyWqZLzIGzc0Hm0Irt+Dm9KgAiBBmj07XC2BKBo0wjuHa8PSBo+A3GO00qaKwcSkLuf3qw==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":83353},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","engines":{"node":">=22.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"gitHead":"b87bda1e89f462aadfc30a272f97a921344dc160","scripts":{"test":"vitest run src","build":"node --eval=\"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && esbuild src/cli.ts --bundle --platform=node --format=esm --target=node22 --banner:js='#!/usr/bin/env node' --outfile=dist/cvbox.js && chmod +x dist/cvbox.js","prepack":"npm run build && npm test","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79eb6e9d-3f5a-43d0-8f25-0e3e2d4fca2c"}},"repository":{"url":"git+https://github.com/bekirdag/bekirs_mind_clone.git","type":"git","directory":"packages/cvbox"},"_npmVersion":"11.16.0","description":"Secure outbound-only machine agent for Clone Version","directories":{},"sideEffects":false,"_nodeVersion":"24.18.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"3.2.7","esbuild":"0.25.12","typescript":"5.9.3","@types/node":"22.20.0"},"_npmOperationalInternal":{"tmp":"tmp/cvbox_0.1.5_1784628315731_0.4265472848492511","host":"s3://npm-registry-packages-npm-production"}},"0.1.8":{"name":"@bekirdag/cvbox","version":"0.1.8","license":"MIT","_id":"@bekirdag/cvbox@0.1.8","maintainers":[{"name":"bekirdag","email":"bekir@piyote.com"}],"homepage":"https://cloneversion.com","bugs":{"url":"https://github.com/bekirdag/bekirs_mind_clone/issues"},"bin":{"cvbox":"dist/cvbox.js"},"dist":{"shasum":"ef429ef21a84f80925919557462cf2766fa7ba64","tarball":"https://registry.npmjs.org/@bekirdag/cvbox/-/cvbox-0.1.8.tgz","fileCount":20,"integrity":"sha512-SfkcA78FQdfrVtTXv6aBAfB8ckhHXW5maq3/dTzHVm6uPGbmFvkCkVbwRGo1nnsiMeJPdaj/Yx0xwtj0muIDFw==","signatures":[{"sig":"MEUCIQDL6CtOp+grdsLZREodud8sP8Md8eDAR8qOdjwEyrRn6wIgSJvSJIJ7qalXy+Uk2cSzw+BO0tPlhIz+rCgspOnIHh4=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":98493},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","engines":{"node":">=22.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"gitHead":"9b1c27b0ff58d3506e1e720001a4da4dc849eef6","scripts":{"test":"vitest run src","build":"node --eval=\"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && esbuild src/cli.ts --bundle --platform=node --format=esm --target=node22 --banner:js='#!/usr/bin/env node' --outfile=dist/cvbox.js && chmod +x dist/cvbox.js","prepack":"npm run build && npm test","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79eb6e9d-3f5a-43d0-8f25-0e3e2d4fca2c"}},"repository":{"url":"git+https://github.com/bekirdag/bekirs_mind_clone.git","type":"git","directory":"packages/cvbox"},"_npmVersion":"11.16.0","description":"Secure outbound-only machine agent for Clone Version","directories":{},"sideEffects":false,"_nodeVersion":"24.18.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"3.2.7","esbuild":"0.25.12","typescript":"5.9.3","@types/node":"22.20.0"},"_npmOperationalInternal":{"tmp":"tmp/cvbox_0.1.8_1784641953012_0.40129990678059735","host":"s3://npm-registry-packages-npm-production"}},"0.1.15":{"name":"@bekirdag/cvbox","version":"0.1.15","license":"MIT","_id":"@bekirdag/cvbox@0.1.15","maintainers":[{"name":"bekirdag","email":"bekir@piyote.com"}],"homepage":"https://cloneversion.com","bugs":{"url":"https://github.com/bekirdag/bekirs_mind_clone/issues"},"bin":{"cvbox":"dist/cvbox.js"},"dist":{"shasum":"76669d0b4f455cd8722a9a914f6e893876e986cc","tarball":"https://registry.npmjs.org/@bekirdag/cvbox/-/cvbox-0.1.15.tgz","fileCount":24,"integrity":"sha512-HvJnu1C/flmeF8jWM5TVIK6A66RDqf7Q6NsuIM++yJ7+2dSj0kDvS/6DC2Q+3zbCFzX+lnheuQjstT/2TCWdKw==","signatures":[{"sig":"MEUCIQCCEZuW9gPiVvhRu0eS0XIXTm5CLZjx3LhhbqOoyUgG0gIgAmgHA4s886EgEnUG2R+S2E7IxurIy1L+Px1UnB3Xa5o=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":204535},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","engines":{"node":">=22.0.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"gitHead":"15c8f4b5a1f1aea9e6157246827a3be43522ee3c","scripts":{"test":"vitest run src","build":"node --eval=\"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && esbuild src/cli.ts --bundle --platform=node --format=esm --target=node22 --external:node-pty --external:ws --banner:js='#!/usr/bin/env node' --outfile=dist/cvbox.js && chmod +x dist/cvbox.js && node dist/cvbox.js --version","prepack":"npm run build && npm test","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79eb6e9d-3f5a-43d0-8f25-0e3e2d4fca2c"}},"repository":{"url":"git+https://github.com/bekirdag/bekirs_mind_clone.git","type":"git","directory":"packages/cvbox"},"_npmVersion":"11.16.0","description":"Secure outbound-only machine agent for Clone Version","directories":{},"sideEffects":false,"_nodeVersion":"24.18.0","dependencies":{"ws":"8.21.1","node-pty":"1.2.0-beta.14","screenshot-desktop":"1.15.3"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"3.2.7","esbuild":"0.25.12","@types/ws":"8.18.1","typescript":"5.9.3","@types/node":"22.20.0"},"_npmOperationalInternal":{"tmp":"tmp/cvbox_0.1.15_1784728711307_0.5167629767824229","host":"s3://npm-registry-packages-npm-production"}},"0.1.16":{"name":"@bekirdag/cvbox","version":"0.1.16","description":"Secure outbound-only machine agent for Clone Version","type":"module","main":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"bin":{"cvbox":"dist/cvbox.js"},"engines":{"node":">=22.0.0"},"repository":{"type":"git","url":"git+https://github.com/bekirdag/bekirs_mind_clone.git","directory":"packages/cvbox"},"bugs":{"url":"https://github.com/bekirdag/bekirs_mind_clone/issues"},"homepage":"https://cloneversion.com","license":"MIT","sideEffects":false,"publishConfig":{"access":"public"},"scripts":{"build":"node --eval=\"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && esbuild src/cli.ts --bundle --platform=node --format=esm --target=node22 --external:node-pty --external:ws --banner:js='#!/usr/bin/env node' --outfile=dist/cvbox.js && chmod +x dist/cvbox.js && node dist/cvbox.js --version","typecheck":"tsc -p tsconfig.json --noEmit","test":"vitest run src","prepack":"npm run build && npm test"},"devDependencies":{"@types/node":"22.20.0","@types/ws":"8.18.1","esbuild":"0.25.12","typescript":"5.9.3","vitest":"3.2.7"},"dependencies":{"node-pty":"1.2.0-beta.14","screenshot-desktop":"1.15.3","ws":"8.21.1"},"gitHead":"732aff6cf65d1a9c085dd66d1a191e58df8eacbc","_id":"@bekirdag/cvbox@0.1.16","_nodeVersion":"24.18.0","_npmVersion":"11.16.0","dist":{"integrity":"sha512-FWXlGSehE4373ZdAIrikBO+Wzn1he3zWX9eAlAlcgUtQDYzwatfOrsGxKON6M8uvIyah3RfO8qV7oOl+Y5oipw==","shasum":"b101ddf7c2ce3137f39b8f2356467f1df87edeed","tarball":"https://registry.npmjs.org/@bekirdag/cvbox/-/cvbox-0.1.16.tgz","fileCount":24,"unpackedSize":208410,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCdqULPAZgNpuB1xcHlKz89WNUNx6qKnkkn+Yc73ZOhSwIgZceM/QtTAB3cuc8hYf7WE5v3+I5czT5YCpfRVXnONys="}]},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79eb6e9d-3f5a-43d0-8f25-0e3e2d4fca2c"}},"directories":{},"maintainers":[{"name":"bekirdag","email":"bekir@piyote.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/cvbox_0.1.16_1784732897126_0.3831224542386329"},"_hasShrinkwrap":false}},"time":{"created":"2026-07-16T10:43:51.459Z","modified":"2026-07-22T15:08:17.380Z","0.1.0":"2026-07-16T10:43:51.746Z","0.1.3":"2026-07-16T12:00:23.109Z","0.1.4":"2026-07-16T12:04:54.960Z","0.1.5":"2026-07-21T10:05:15.915Z","0.1.8":"2026-07-21T13:52:33.164Z","0.1.15":"2026-07-22T13:58:31.435Z","0.1.16":"2026-07-22T15:08:17.265Z"},"bugs":{"url":"https://github.com/bekirdag/bekirs_mind_clone/issues"},"license":"MIT","homepage":"https://cloneversion.com","repository":{"type":"git","url":"git+https://github.com/bekirdag/bekirs_mind_clone.git","directory":"packages/cvbox"},"description":"Secure outbound-only machine agent for Clone Version","maintainers":[{"name":"bekirdag","email":"bekir@piyote.com"}],"readme":"# CVBox\n\n`@bekirdag/cvbox` is the secure, outbound-only machine agent for Clone Version.\nIt lets an invited Clone Version owner inspect the full filesystem visible to\nthe unprivileged CVBox service account, safely edit existing files after an\nexplicit interactive unlock, view repository status and machine health,\ninspect a redacted process inventory, and run explicitly unlocked terminal\nsessions without exposing an inbound port or SSH credentials. When the server\nqualification flag is enabled, CVBox can also open a bounded outbound-only\nRemote Desktop session that starts view-only and requires a separate approval\nbefore keyboard or pointer input. Sensitive paths\nremain denied by file APIs; a terminal has the normal authority of the CVBox\nservice account and must be treated as full user-level machine access.\n\n## Requirements\n\n- Node.js 22 or newer\n- macOS or Linux for automatic background-service installation\n- HTTPS Clone Version endpoint, except for loopback development\n- A one-time pairing code created in **More → Machines**\n\n## Install and enroll\n\n```sh\nnpm install --global @bekirdag/cvbox\ncvbox enroll --server https://app.cloneversion.com\n```\n\nCopy the pairing code from the Machines page, paste it into the hidden prompt,\nthen press Enter. Bullets confirm that input was received without echoing the\nsecret. Never put the code in a shell argument. CVBox creates an Ed25519 device\nkey in `~/.cvbox/state.json`, locks the\ndirectory to mode `0700` and the state file to `0600`, then waits for fingerprint\nconfirmation in Clone Version.\n\nFresh enrollment defaults to full-computer scope (`/` on macOS/Linux and every\navailable drive root on Windows). Use one or more `--root /absolute/path` options\nonly when intentionally restricting the machine to selected folders. Existing\nmachines can migrate with `cvbox roots full`; Clone Version will show the\nexpanded scope for owner approval after the next signed heartbeat.\n\nAfter enrollment, the terminal prints the local fingerprint and the pending\nmachine appears automatically in Clone Version. Confirm only when the two\nfingerprints match, then install the persistent outbound agent:\n\n```sh\ncvbox service install\ncvbox status\ncvbox doctor\n```\n\n`cvbox service install` installs an unprivileged LaunchAgent on macOS or a user\nsystemd service on Linux. It starts Node with a clean environment so unrelated\nterminal or login-session secrets are not inherited by CVBox. Run `cvbox start`\ndirectly when a service manager is not available.\n\nCVBox refuses `start`, `service install`, and `service start` until enrollment\nhas created local machine state. A missing enrollment exits with the exact\nMachines-page recovery flow instead of retrying as a network failure.\n\n## Commands\n\n```text\ncvbox enroll --server URL [--name NAME] [--root PATH]\ncvbox start\ncvbox run --once\ncvbox status\ncvbox doctor\ncvbox roots full|list|add|remove [PATH]\ncvbox service install|uninstall|start|stop\n```\n\nUse `http://127.0.0.1:3030` only when CVBox runs on the same computer as the\nlocal Clone Version API. Remote machines require the deployed HTTPS origin;\nthey cannot use another computer's loopback address.\n\nFor non-interactive provisioning, pipe the short-lived code to\n`cvbox enroll --code-stdin`. Treat the pipe input as a secret and avoid command\nlogging.\n\n## Security model\n\n- Every network request is initiated by CVBox over HTTPS.\n- Pairing codes expire after ten minutes, are single-use, and are stored by the\n  server only as a keyed digest.\n- The device and control plane sign separate protocol messages with Ed25519.\n- Timestamp and nonce checks reject stale or replayed machine requests.\n- Commands are typed, short-lived, machine-bound, and signed.\n- File operations resolve real paths and stay inside the owner-approved scope;\n  full-computer scope still follows OS permissions and sensitive-path denials.\n- Existing files can be changed only by signed `fs.write` commands carrying\n  an interactive-confirmation marker and the SHA-256 of the previewed version.\n  Writes are bounded and reject conflicts; create, delete, rename, upload, and\n  chmod are not supported by the file API.\n- Terminal sessions require the same explicit remembered machine unlock plus\n  an interactive-confirmation marker. CVBox chooses the native shell, limits\n  session count, input, output replay, and dimensions, and keeps the transport\n  outbound-only. Closing a browser tab does not terminate the PTY; explicit\n  deletion does.\n- Remote Desktop uses a single outbound WebSocket media session, a one-use\n  relay token, a 15-minute absolute limit, bounded JPEG frames, and one active\n  monitor at a time. It never enables clipboard, audio, recording, printing,\n  file transfer, or unattended access. Control requires a fresh desktop-only\n  confirmation and is not inherited from the file/terminal unlock.\n- macOS requires Screen Recording for viewing and Accessibility for control.\n  Windows is limited to the current interactive user desktop. Linux capability\n  detection fails closed when the current X11/Wayland session has no supported\n  capture or input tool; CVBox does not weaken compositor protections.\n- Process inspection excludes arguments and environment variables.\n- Credentials and internal IDs are never intended for normal UI display.\n- There is no inbound listener, SSH key exchange, public RDP/VNC server, or\n  browser-selected executable.\n\nSee [SECURITY.md](SECURITY.md) before enabling additional machine capabilities.\n\n## Development\n\n```sh\npnpm --filter @bekirdag/cvbox typecheck\npnpm --filter @bekirdag/cvbox test\npnpm --filter @bekirdag/cvbox build\npnpm --filter @bekirdag/cvbox pack\n```\n\nMatching `cvbox-vX.Y.Z` tags are qualified and published by the repository's\nOIDC-backed npm release workflow after the tag version matches this package.\n","readmeFilename":"README.md"}