From bd289f33502a49121166ebbba2bbd3b349f5fe17 Mon Sep 17 00:00:00 2001
From: chenchen <chenchen@simular.ai>
Date: Wed, 4 Nov 2026 12:33:09 +0800
Subject: [PATCH 1/2] Move box to https://mcp.box.simular.ai/mcp and migrate
 old relay entries

The box MCP server moved from relay.simular.cloud to mcp.box.simular.ai. The old
address now returns protected-resource metadata naming the new URL, so MCP
clients refuse to sign in through it.

- CLI default URL, Claude Code / Hermes / dsh plugin configs and docs point at
  the new URL; plugin versions bumped (claude 0.1.1, hermes 0.1.1, dsh 0.2.1).
- connect rewrites a box entry at the old address (it stays "ours"), and says
  the app may ask to sign in again. For Claude Code it runs
  `claude plugin marketplace update` + `claude plugin update` when the
  installed plugin still points at the old URL.
- doctor flags an entry at the old address, and an endpoint whose metadata
  names a different resource.
- Install matrix seeds a box at the old address for every client and, for
  Claude Code, installs the old plugin from a local git marketplace built
  from this checkout, so it tests this branch's plugin and the update path.

Refs #18

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                          |  8 +--
 claude/.claude-plugin/plugin.json  |  2 +-
 claude/.mcp.json                   |  2 +-
 cli/README.md                      | 10 ++--
 cli/e2e/install-matrix.mjs         | 81 ++++++++++++++++++++++++------
 cli/src/cli.js                     | 17 ++++++-
 cli/src/clients/claude-code.js     | 23 +++++++--
 cli/src/constants.js               | 25 +++++++--
 cli/src/probe.js                   | 11 ++++
 cli/test/cli.test.js               | 52 +++++++++++++++++--
 cli/test/clients.test.js           | 27 +++++++++-
 cli/test/fixtures/codex.after.toml |  2 +-
 cli/test/helpers.js                |  8 ++-
 dsh/README.md                      |  4 +-
 dsh/cordis.patch.yml               |  2 +-
 dsh/package.json                   |  2 +-
 hermes/README.md                   |  4 +-
 hermes/mcp.json                    |  2 +-
 hermes/plugin.json                 |  2 +-
 19 files changed, 232 insertions(+), 52 deletions(-)

diff --git a/README.md b/README.md
index ee75146..5a5df3e 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 [box](https://box.simular.ai) gives your AI agent a computer of its own: a cloud Linux desktop with Chrome and a shell that it drives over MCP, while your own computer stays free. You can watch it live and take over at https://box.simular.ai/box.
 
-Most agents need no plugin: add the MCP server `https://relay.simular.cloud/mcp` and sign in once (see https://box.simular.ai/install). This repository holds a package for each agent that installs box its own way. Each folder stands alone and is released through that agent's channel.
+Most agents need no plugin: add the MCP server `https://mcp.box.simular.ai/mcp` and sign in once (see https://box.simular.ai/install). This repository holds a package for each agent that installs box its own way. Each folder stands alone and is released through that agent's channel.
 
 | Agent | Folder | Sign-in | Install |
 | --- | --- | --- | --- |
@@ -13,11 +13,11 @@ Most agents need no plugin: add the MCP server `https://relay.simular.cloud/mcp`
 
 ## Adding an agent
 
-Add a folder named after the agent with its own manifest, MCP config and, where the agent supports skills, a copy of `claude/skills/box/SKILL.md`. Point it at `https://relay.simular.cloud/mcp`. Use OAuth sign-in where the agent supports it; otherwise read a personal key from an environment variable or the agent's own credentials store, never from a file in the package. Add a row above.
+Add a folder named after the agent with its own manifest, MCP config and, where the agent supports skills, a copy of `claude/skills/box/SKILL.md`. Point it at `https://mcp.box.simular.ai/mcp`. Use OAuth sign-in where the agent supports it; otherwise read a personal key from an environment variable or the agent's own credentials store, never from a file in the package. Add a row above.
 
 ## Releasing
 
-- `claude/`: bump `version` in `claude/.claude-plugin/plugin.json`; Claude Code picks it up from the marketplace.
+- `claude/`: bump `version` in `claude/.claude-plugin/plugin.json`. Claude Code doesn't auto-update third-party marketplaces: users get it with `/plugin marketplace update simular-box` and `/plugin update box@simular-box`, or with `npx @simular-ai/box connect`.
 - `dsh/`: bump `version` in `dsh/package.json`, then push a tag `dsh-vX.Y.Z`. The release workflow attaches `dsh-box.tgz`.
 - `hermes/`: bump `version` in `hermes/plugin.json`. Users copy the folder by hand until box is in the Hermes plugin catalog.
-- `cli/`: bump `version` in `cli/package.json`, then push a tag `cli-vX.Y.Z`. The `publish-cli.yml` workflow tests it and publishes `@simular-ai/box` to npm through trusted publishing (OIDC), with provenance; the one-time npm setup is in [cli/README.md](cli/README.md#releasing). When the box endpoint moves, change `DEFAULT_MCP_URL` in `cli/src/constants.js` and release.
+- `cli/`: bump `version` in `cli/package.json`, then push a tag `cli-vX.Y.Z`. The `publish-cli.yml` workflow tests it and publishes `@simular-ai/box` to npm through trusted publishing (OIDC), with provenance; the one-time npm setup is in [cli/README.md](cli/README.md#releasing). When the box endpoint moves, change `DEFAULT_MCP_URL` in `cli/src/constants.js`, add the old host to `OLD_HOSTS` there, change the URL in every plugin folder, and release each one.
diff --git a/claude/.claude-plugin/plugin.json b/claude/.claude-plugin/plugin.json
index 1f6ac39..b512aab 100644
--- a/claude/.claude-plugin/plugin.json
+++ b/claude/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "box",
   "displayName": "box by Simular",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Give Claude a computer of its own: a cloud Linux desktop with Chrome and a shell that it drives over MCP, while your own computer stays free. You sign in once in the browser; no key to paste.",
   "author": {
     "name": "Simular",
diff --git a/claude/.mcp.json b/claude/.mcp.json
index 4453c09..25bd95c 100644
--- a/claude/.mcp.json
+++ b/claude/.mcp.json
@@ -2,7 +2,7 @@
   "mcpServers": {
     "box": {
       "type": "http",
-      "url": "https://relay.simular.cloud/mcp"
+      "url": "https://mcp.box.simular.ai/mcp"
     }
   }
 }
diff --git a/cli/README.md b/cli/README.md
index bc67cbd..7604d7e 100644
--- a/cli/README.md
+++ b/cli/README.md
@@ -6,7 +6,7 @@ Connect [box](https://box.simular.ai) to your AI apps in one command. box gives
 npx @simular-ai/box connect
 ```
 
-The CLI finds the AI apps on this computer, asks which ones should use box, and adds the box MCP server (`https://relay.simular.cloud/mcp`) to each one in its own format. Other servers and settings in those files are left alone, each changed file gets a backup next to it (`*.box-backup-<time>`), and running it again changes nothing.
+The CLI finds the AI apps on this computer, asks which ones should use box, and adds the box MCP server (`https://mcp.box.simular.ai/mcp`) to each one in its own format. Other servers and settings in those files are left alone, each changed file gets a backup next to it (`*.box-backup-<time>`), and running it again changes nothing.
 
 ```bash
 npx @simular-ai/box doctor     # is box set up right in each app? is the endpoint up? is the key valid?
@@ -31,7 +31,7 @@ The command is `simular-box` (`box` belongs to box.com's CLI), so after `npm i -
 
 Pick apps without prompts with `--client cursor,codex --yes`; `--yes` alone picks every app found. `--dry-run` shows what would change.
 
-The CLI only changes or removes a server that points at box by Simular (`relay.simular.cloud`, its staging host, `mcp.box.simular.ai`, or your `BOX_MCP_URL`). If an app already has a different server named `box`, such as box.com's MCP server, `connect` stops without changing anything, and `remove` leaves it alone. To add box next to it, use `--name simular-box`. A symlinked config stays a symlink: the file it points to is updated. If a config can't be written (owned by another user, or locked by the app), connect says so; for Codex it prints the steps to add box in the Codex app's Settings instead.
+The CLI only changes or removes a server that points at box by Simular (`mcp.box.simular.ai`, the old `relay.simular.cloud`, its staging host, or your `BOX_MCP_URL`). If an app already has a different server named `box`, such as box.com's MCP server, `connect` stops without changing anything, and `remove` leaves it alone. To add box next to it, use `--name simular-box`. A symlinked config stays a symlink: the file it points to is updated. If a config can't be written (owned by another user, or locked by the app), connect says so; for Codex it prints the steps to add box in the Codex app's Settings instead.
 
 ## Sign-in
 
@@ -50,15 +50,15 @@ Without `BOX_TOKEN`, an interactive run asks for the key with hidden input. The
 
 `doctor` checks, for each app it finds:
 
-- box is configured, points at the current URL, and no old `box-control` server is left
-- the endpoint answers an unauthenticated request with `401` and a `WWW-Authenticate` link to its sign-in metadata
+- box is configured, points at the current URL (not the old `relay.simular.cloud`), and no old `box-control` server is left
+- the endpoint answers an unauthenticated request with `401` and a `WWW-Authenticate` link to its sign-in metadata, and that metadata names the same URL
 - a configured personal key is accepted (the key is sent to the box endpoint only, never printed)
 
 It prints a fix for each problem. `--json` prints a machine-readable report; the exit code is 1 when something needs fixing. OAuth sign-ins are stored by each app, so doctor can't see whether you've signed in.
 
 ## Other endpoints
 
-`BOX_MCP_URL` points everything at another endpoint (for example staging): `BOX_MCP_URL=https://… npx @simular-ai/box connect`. When box's endpoint moves, a new CLI version changes the default and `connect` updates each app.
+`BOX_MCP_URL` points everything at another endpoint (for example staging): `BOX_MCP_URL=https://… npx @simular-ai/box connect`. When box's endpoint moves, a new CLI version changes the default and `connect` updates each app: it rewrites a `box` entry that points at the old address and, for Claude Code, updates the `box@simular-box` plugin. Apps may then ask you to sign in to box again. box moved from `relay.simular.cloud` to `mcp.box.simular.ai` on 2026-11-04; `doctor` flags an app still on the old address.
 
 ## Development
 
diff --git a/cli/e2e/install-matrix.mjs b/cli/e2e/install-matrix.mjs
index 243eff0..5ad0a07 100644
--- a/cli/e2e/install-matrix.mjs
+++ b/cli/e2e/install-matrix.mjs
@@ -1,19 +1,22 @@
 // Layer 1: run the real CLI against a real, installed client in an isolated HOME.
 //   node e2e/install-matrix.mjs <client>
-// Seeds an unrelated server, runs `connect --client <client> --yes`, checks with the client's own
-// listing command that box is there, re-runs connect (must change nothing), runs `doctor`, then
-// `remove`, and checks that the unrelated server survived. No secrets, no sign-in.
+// Seeds an unrelated server and a box set up at box's old address (relay.simular.cloud), runs
+// `connect --client <client> --yes`, checks that it moved box to the current URL and said so, checks
+// with the client's own listing command that box is there, re-runs connect (must change nothing),
+// runs `doctor`, then `remove`, and checks that the unrelated server survived. No secrets, no sign-in.
 import assert from 'node:assert/strict'
 import fs from 'node:fs'
 import path from 'node:path'
-import { fileURLToPath } from 'node:url'
+import { fileURLToPath, pathToFileURL } from 'node:url'
 import spawn from 'cross-spawn'
 import { isolatedEnv } from './isolated-env.mjs'
 import { createContext } from '../src/context.js'
 import { findClient } from '../src/clients/index.js'
 
 const CLI = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'simular-box.js')
-const URL_RE = /relay\.simular\.cloud\/mcp/
+const URL_RE = /mcp\.box\.simular\.ai\/mcp/
+const OLD_URL = 'https://relay.simular.cloud/mcp'
+const REPO = path.join(path.dirname(CLI), '..', '..')
 const id = process.argv[2]
 const client = findClient(id)
 if (!client) throw new Error(`unknown client ${id}`)
@@ -41,6 +44,39 @@ const writeJson = (file, value) => {
   fs.mkdirSync(path.dirname(file), { recursive: true })
   fs.writeFileSync(file, JSON.stringify(value, null, 2))
 }
+
+// Claude Code: install the plugin as it was before the move from a git marketplace built from this
+// checkout (so the job tests this branch's plugin, not main's), then push this branch's plugin to
+// it, as a merge to main would. connect must then update the marketplace and the plugin. A fake
+// https URL is mapped to the local repo with git's url.<base>.insteadOf, because Claude Code adds
+// git marketplaces only from https URLs.
+const FAKE_MARKETPLACE = 'https://box-plugin.invalid/box-plugin.git'
+function seedOldClaudePlugin() {
+  const work = path.join(home, 'box-plugin-market')
+  const bare = path.join(home, 'box-plugin-market.git')
+  const git = (...args) => sh('git', ['-C', work, '-c', 'user.name=box e2e', '-c', 'user.email=e2e@box.invalid', '-c', 'commit.gpgsign=false', ...args])
+  const copy = () => {
+    for (const d of ['.claude-plugin', 'claude']) fs.cpSync(path.join(REPO, d), path.join(work, d), { recursive: true })
+  }
+  copy()
+  const mcp = path.join(work, 'claude', '.mcp.json')
+  fs.writeFileSync(mcp, fs.readFileSync(mcp, 'utf8').replace(URL_RE, 'relay.simular.cloud/mcp'))
+  const manifest = path.join(work, 'claude', '.claude-plugin', 'plugin.json')
+  fs.writeFileSync(manifest, JSON.stringify({ ...JSON.parse(fs.readFileSync(manifest, 'utf8')), version: '0.0.1' }, null, 2))
+  sh('git', ['init', '--quiet', '--initial-branch', 'main', work])
+  git('add', '-A')
+  git('commit', '--quiet', '-m', 'before the move')
+  sh('git', ['clone', '--quiet', '--bare', work, bare])
+  Object.assign(env, { GIT_CONFIG_COUNT: '1', GIT_CONFIG_KEY_0: `url.${pathToFileURL(bare).href}.insteadOf`, GIT_CONFIG_VALUE_0: FAKE_MARKETPLACE })
+  sh('claude', ['plugin', 'marketplace', 'add', FAKE_MARKETPLACE])
+  sh('claude', ['plugin', 'install', 'box@simular-box', '--scope', 'user'])
+  assert.match(sh('claude', ['plugin', 'list', '--json']), /relay\.simular\.cloud\/mcp/, 'the old plugin is installed')
+  copy()
+  git('add', '-A')
+  git('commit', '--quiet', '-m', 'this branch')
+  git('push', '--quiet', bare, 'HEAD:main')
+}
+
 function backups() {
   const found = []
   const walk = (dir) => {
@@ -57,7 +93,10 @@ function backups() {
 const ADAPTERS = {
   'claude-code': {
     bin: 'claude',
-    seed: () => sh('claude', ['mcp', 'add', '--scope', 'user', '--transport', 'http', 'other', 'https://example.com/mcp']),
+    seed: () => {
+      sh('claude', ['mcp', 'add', '--scope', 'user', '--transport', 'http', 'other', 'https://example.com/mcp'])
+      seedOldClaudePlugin()
+    },
     list: () => sh('claude', ['mcp', 'list']),
     present: (out) => /plugin:box:box/.test(out) && URL_RE.test(out),
     needsAuth: /needs authentication/i,
@@ -65,15 +104,23 @@ const ADAPTERS = {
   },
   codex: {
     bin: 'codex',
-    seed: () => sh('codex', ['mcp', 'add', 'other', '--', 'npx', '-y', 'other-mcp']),
+    seed: () => {
+      sh('codex', ['mcp', 'add', 'other', '--', 'npx', '-y', 'other-mcp'])
+      // `codex mcp add --url` would start the sign-in, so the old entry is written by hand.
+      fs.appendFileSync(client.configLocation(ctx), `\n[mcp_servers.box]\nurl = "${OLD_URL}"\n`)
+    },
     list: () => sh('codex', ['mcp', 'list']),
-    present: (out) => /^box\s+https:\/\/relay\.simular\.cloud\/mcp/m.test(out),
+    present: (out) => /^box\s+https:\/\/mcp\.box\.simular\.ai\/mcp/m.test(out),
     needsAuth: /not logged in/i,
     otherKept: (out) => /^other\s/m.test(out),
   },
   opencode: {
     bin: 'opencode',
-    seed: () => writeJson(client.configLocation(ctx), { $schema: 'https://opencode.ai/config.json', mcp: { other: { type: 'remote', url: 'https://example.com/mcp', enabled: false } } }),
+    seed: () =>
+      writeJson(client.configLocation(ctx), {
+        $schema: 'https://opencode.ai/config.json',
+        mcp: { other: { type: 'remote', url: 'https://example.com/mcp', enabled: false }, box: { type: 'remote', url: OLD_URL, enabled: true } },
+      }),
     list: () => sh('opencode', ['mcp', 'list']),
     present: (out) => /\bbox\b/.test(out) && URL_RE.test(out),
     needsAuth: /needs authentication/i,
@@ -81,7 +128,10 @@ const ADAPTERS = {
   },
   openclaw: {
     bin: 'openclaw',
-    seed: () => sh('openclaw', ['mcp', 'set', 'other', JSON.stringify({ command: 'npx', args: ['-y', 'other-mcp'] })]),
+    seed: () => {
+      sh('openclaw', ['mcp', 'set', 'other', JSON.stringify({ command: 'npx', args: ['-y', 'other-mcp'] })])
+      sh('openclaw', ['mcp', 'set', 'box', JSON.stringify({ url: OLD_URL, transport: 'streamable-http', auth: 'oauth' })])
+    },
     list: () => sh('openclaw', ['mcp', 'list']) + sh('openclaw', ['mcp', 'show', 'box', '--json'], { allowFail: true }),
     present: (out) => /-\s+box\b/.test(out) && /streamable-http/.test(out) && URL_RE.test(out),
     otherKept: (out) => /-\s+other\b/.test(out),
@@ -91,24 +141,24 @@ const ADAPTERS = {
     seed: () => {
       const file = client.configLocation(ctx)
       fs.mkdirSync(path.dirname(file), { recursive: true })
-      fs.writeFileSync(file, '# seeded by the e2e test\nmcp_servers:\n  other:\n    command: npx\n    args: [-y, other-mcp]\n    enabled: false\n')
+      fs.writeFileSync(file, `# seeded by the e2e test\nmcp_servers:\n  other:\n    command: npx\n    args: [-y, other-mcp]\n    enabled: false\n  box:\n    url: ${OLD_URL}\n    auth: oauth\n`)
     },
     list: () => sh('hermes', ['mcp', 'list']),
-    present: (out) => /\bbox\s+https:\/\/relay\.simular/.test(out),
+    present: (out) => /\bbox\s+https:\/\/mcp\.box\.simular/.test(out),
     otherKept: (out) => /\bother\b/.test(out),
   },
   'gemini-cli': {
     bin: 'gemini',
-    seed: () => writeJson(client.configLocation(ctx), { mcpServers: { other: { httpUrl: 'https://example.com/mcp' } } }),
+    seed: () => writeJson(client.configLocation(ctx), { mcpServers: { other: { httpUrl: 'https://example.com/mcp' }, box: { type: 'http', url: OLD_URL } } }),
     // The isolated HOME is not a trusted folder, so Gemini lists the servers as Disabled and
     // never connects; the listing still proves it reads our entry as an http server.
     list: () => sh('gemini', ['mcp', 'list']),
-    present: (out) => /\bbox: https:\/\/relay\.simular\.cloud\/mcp \(http\)/.test(out),
+    present: (out) => /\bbox: https:\/\/mcp\.box\.simular\.ai\/mcp \(http\)/.test(out),
     otherKept: (out) => /\bother: https:\/\/example\.com\/mcp/.test(out),
   },
   cursor: {
     bin: 'cursor-agent',
-    seed: () => writeJson(client.configLocation(ctx), { mcpServers: { other: { url: 'https://example.com/mcp' } } }),
+    seed: () => writeJson(client.configLocation(ctx), { mcpServers: { other: { url: 'https://example.com/mcp' }, box: { url: OLD_URL } } }),
     list: () => sh('cursor-agent', ['mcp', 'list']),
     present: (out) => /^box:/m.test(out),
     otherKept: (out) => /^other:/m.test(out),
@@ -122,6 +172,7 @@ if (!ctx.which(a.bin)) throw new Error(`${a.bin} is not on PATH; install the cli
 a.seed()
 let out = box('connect', '--client', client.id, '--yes')
 assert.match(out, new RegExp(`${client.name}: `), 'connect reports the client')
+assert.match(out, new RegExp(`box moved from ${OLD_URL.replace(/[.]/g, '\\.')} to https://mcp\\.box\\.simular\\.ai/mcp\\. ${client.name} may ask you to sign in to box again`), 'connect moved box off the old address and said so')
 
 out = a.list()
 assert.ok(a.present(out), `${a.bin}'s own listing shows box at the box URL`)
diff --git a/cli/src/cli.js b/cli/src/cli.js
index cb8f3c4..017a14f 100644
--- a/cli/src/cli.js
+++ b/cli/src/cli.js
@@ -3,7 +3,7 @@ import * as p from '@clack/prompts'
 import { parseArgs } from './args.js'
 import { createContext } from './context.js'
 import { CLIENTS, findClient } from './clients/index.js'
-import { DEFAULT_MCP_URL, KEY_ENV, KEYS_URL, WATCH_URL, INSTALL_URL, SUPPORT_EMAIL, EXAMPLE_PROMPTS, looksLikeKey, validServerName } from './constants.js'
+import { DEFAULT_MCP_URL, KEY_ENV, KEYS_URL, WATCH_URL, INSTALL_URL, SUPPORT_EMAIL, EXAMPLE_PROMPTS, isOldUrl, looksLikeKey, validServerName } from './constants.js'
 import { probeEndpoint, checkKey } from './probe.js'
 
 const VERSION = createRequire(import.meta.url)('../package.json').version
@@ -182,10 +182,14 @@ async function connect(ctx, flags, { interactive, env, isTTY }) {
     const spin = isTTY ? p.spinner() : { start() {}, stop: (msg, code) => (code ? p.log.error(msg) : p.log.success(msg)) }
     spin.start(`${client.name}`)
     try {
+      const moved = movedFrom(ctx, client)
       const res = await client.connect(ctx, { key, mode: modes[client.id] })
       spin.stop(`${client.name}: ${res.actions.length ? res.actions.join('; ') : 'already set up'}`)
       for (const b of res.backups || []) p.log.message(`  backup: ${b}`)
       for (const w of res.warnings || []) p.log.warn(`  ${w}`)
+      if (moved.length && res.actions.length && !ctx.dryRun) {
+        p.log.warn(`  box moved from ${moved.join(', ')} to ${ctx.url}. ${client.name} may ask you to sign in to box again.`)
+      }
       for (const n of res.next || []) next.push(`${client.name}: ${n}`)
       connected++
     } catch (err) {
@@ -207,6 +211,12 @@ async function connect(ctx, flags, { interactive, env, isTTY }) {
   return failed ? 1 : 0
 }
 
+/** The old box addresses a client points at before connect rewrites them. */
+function movedFrom(ctx, client) {
+  const st = safe(() => client.status(ctx), null)
+  return [...new Set((st?.entries || []).map((e) => e.url).filter((u) => u && isOldUrl(u, ctx.url)))]
+}
+
 /** EACCES/EPERM, or EBUSY (Windows: the app holds the file open), including as text ("Access is denied"). */
 export function isPermissionError(err) {
   return ['EACCES', 'EPERM', 'EBUSY'].includes(err?.code) || /\bEACCES\b|\bEPERM\b|\bEBUSY\b|permission denied|access is denied|operation not permitted/i.test(err?.message || '')
@@ -294,7 +304,10 @@ export async function runDoctor(ctx, flags, { probe = probeEndpoint, check = che
       row.fixes.push(fix)
     }
     for (const e of st.entries) {
-      if (e.url && e.url !== ctx.url) {
+      if (e.url && isOldUrl(e.url, ctx.url)) {
+        row.problems.push(`${e.where} points at ${e.url}, box's old address, which no longer signs in; box is now at ${ctx.url}`)
+        row.fixes.push(fix)
+      } else if (e.url && e.url !== ctx.url) {
         row.problems.push(`${e.where} points at ${e.url}, not ${ctx.url}`)
         row.fixes.push(fix)
       }
diff --git a/cli/src/clients/claude-code.js b/cli/src/clients/claude-code.js
index a2023cf..2a42199 100644
--- a/cli/src/clients/claude-code.js
+++ b/cli/src/clients/claude-code.js
@@ -75,6 +75,7 @@ export default {
   connect(ctx) {
     if (!ctx.which('claude')) throw new Error('the `claude` command is not on PATH; install Claude Code first (https://code.claude.com)')
     const actions = []
+    let updated = false
     const user = readUserServers(ctx)
     const mine = (n) => user[n] && ctx.ours(user[n].url)
     if (ctx.url !== DEFAULT_MCP_URL && user[ctx.name] && !mine(ctx.name)) {
@@ -98,9 +99,23 @@ export default {
           must(ctx.run('claude', ['plugin', 'install', PLUGIN, '--scope', 'user'], { timeoutMs: 180000 }), 'claude plugin install')
         }
         actions.push(`installed plugin ${PLUGIN} (box server + box skill)`)
-      } else if (!plugin.enabled) {
-        if (!ctx.dryRun) must(ctx.run('claude', ['plugin', 'enable', PLUGIN]), 'claude plugin enable')
-        actions.push(`enabled plugin ${PLUGIN}`)
+      } else {
+        // Claude Code doesn't auto-update third-party marketplaces, so a plugin installed before
+        // box moved keeps the old URL until the marketplace and the plugin are updated.
+        const pinned = plugin.mcpServers?.box?.url
+        if (pinned && pinned !== DEFAULT_MCP_URL) {
+          if (!ctx.dryRun) {
+            must(ctx.run('claude', ['plugin', 'marketplace', 'update', MARKETPLACE], { timeoutMs: 180000 }), 'claude plugin marketplace update')
+            const scope = ['user', 'project', 'local'].includes(plugin.scope) ? ['--scope', plugin.scope] : []
+            must(ctx.run('claude', ['plugin', 'update', PLUGIN, ...scope], { timeoutMs: 180000 }), 'claude plugin update')
+          }
+          actions.push(`${ctx.dryRun ? 'would update' : 'updated'} plugin ${PLUGIN} (box server now at ${DEFAULT_MCP_URL})`)
+          updated = true
+        }
+        if (!plugin.enabled) {
+          if (!ctx.dryRun) must(ctx.run('claude', ['plugin', 'enable', PLUGIN]), 'claude plugin enable')
+          actions.push(`enabled plugin ${PLUGIN}`)
+        }
       }
       // Our own user-scope box next to the plugin would show box twice. Someone else's stays.
       if (mine(SERVER_NAME)) {
@@ -125,7 +140,7 @@ export default {
     const label = ctx.url === DEFAULT_MCP_URL ? 'plugin:box:box' : ctx.name
     return {
       actions,
-      next: [`Start Claude Code, run /mcp, pick ${label} and choose Authenticate; sign in and click Approve in the browser.`],
+      next: [`${updated ? 'Restart Claude Code (a plugin update applies on restart), then run' : 'Start Claude Code, run'} /mcp, pick ${label} and choose Authenticate; sign in and click Approve in the browser.`],
     }
   },
 
diff --git a/cli/src/constants.js b/cli/src/constants.js
index 012221c..013561e 100644
--- a/cli/src/constants.js
+++ b/cli/src/constants.js
@@ -1,6 +1,13 @@
-// The one place the box MCP endpoint lives. When the endpoint moves (planned: mcp.box.simular.ai),
-// change DEFAULT_MCP_URL and release a new CLI version. BOX_MCP_URL overrides it (e.g. staging).
-export const DEFAULT_MCP_URL = 'https://relay.simular.cloud/mcp'
+// The one place the box MCP endpoint lives. When the endpoint moves, change DEFAULT_MCP_URL, add
+// the old host to OLD_HOSTS and release a new CLI version. BOX_MCP_URL overrides it (e.g. staging).
+export const DEFAULT_MCP_URL = 'https://mcp.box.simular.ai/mcp'
+
+/**
+ * Hosts box was served from before. Entries there are still ours (connect rewrites them, remove
+ * removes them), but they no longer work: the old host's sign-in metadata names the new URL, and
+ * MCP clients refuse a resource that doesn't match the URL they were given.
+ */
+export const OLD_HOSTS = ['relay.simular.cloud']
 
 /** Servers named here are removed on connect: older box setups added them next to `box`. */
 export const LEGACY_SERVER_NAMES = ['box-control']
@@ -8,7 +15,7 @@ export const LEGACY_SERVER_NAMES = ['box-control']
 export const SERVER_NAME = 'box'
 
 /** Hosts that serve box by Simular. An existing server named `box` elsewhere is not ours. */
-export const OUR_HOSTS = ['relay.simular.cloud', 'staging.relay.simular.cloud', 'mcp.box.simular.ai']
+export const OUR_HOSTS = ['mcp.box.simular.ai', 'staging.relay.simular.cloud', ...OLD_HOSTS]
 
 /** Whether `url` points at box by Simular (a known host, or the host of the current endpoint). */
 export function isOurUrl(url, currentUrl) {
@@ -27,6 +34,16 @@ export function isOurUrl(url, currentUrl) {
   }
 }
 
+/** Whether `url` is box's old address (and not what this run connects to). */
+export function isOldUrl(url, currentUrl) {
+  try {
+    const host = new URL(url).host
+    return OLD_HOSTS.includes(host) && host !== new URL(currentUrl).host
+  } catch {
+    return false
+  }
+}
+
 /** Thrown when a server with our name already exists but points somewhere else. */
 export class ForeignServerError extends Error {
   constructor(where, name, url) {
diff --git a/cli/src/probe.js b/cli/src/probe.js
index 73b0f70..8c1c834 100644
--- a/cli/src/probe.js
+++ b/cli/src/probe.js
@@ -68,14 +68,25 @@ export async function probeEndpoint(url, opts = {}) {
     const doc = await meta.json()
     result.authorizationServer = doc.authorization_servers?.[0] || null
     if (!result.authorizationServer) throw new Error('no authorization_servers')
+    result.resource = doc.resource || null
   } catch (err) {
     result.error = `protected-resource metadata at ${auth.resource_metadata} is unusable: ${err.message}`
     return result
   }
+  // MCP clients refuse to sign in when the metadata names another resource (RFC 9728 section 3.3),
+  // which is what an old address that now points at a new one looks like.
+  if (result.resource && trimSlash(result.resource) !== trimSlash(url)) {
+    result.error = `the sign-in metadata names ${result.resource}, not ${url}, so apps will refuse to sign in (box may have moved there)`
+    return result
+  }
   result.ok = true
   return result
 }
 
+function trimSlash(u) {
+  return String(u).replace(/\/+$/, '')
+}
+
 /**
  * Check a personal key without printing it. 200 = valid; 401 with error="invalid_token" = rejected.
  */
diff --git a/cli/test/cli.test.js b/cli/test/cli.test.js
index c63b0e3..ee4214e 100644
--- a/cli/test/cli.test.js
+++ b/cli/test/cli.test.js
@@ -4,7 +4,7 @@ import { spawnSync } from 'node:child_process'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { parseArgs } from '../src/args.js'
-import { mcpUrl, maskKey, DEFAULT_MCP_URL, EXAMPLE_PROMPTS } from '../src/constants.js'
+import { mcpUrl, maskKey, isOldUrl, isOurUrl, DEFAULT_MCP_URL, EXAMPLE_PROMPTS } from '../src/constants.js'
 import { parseWwwAuthenticate, probeEndpoint, checkKey } from '../src/probe.js'
 import { runDoctor } from '../src/cli.js'
 import { sandbox } from './helpers.js'
@@ -50,6 +50,29 @@ test('probe: parses WWW-Authenticate and follows resource metadata', async () =>
   assert.match(down.error, /expected 401/)
 })
 
+test('probe: metadata naming another resource fails (what the old relay address now returns)', async () => {
+  const fetchImpl = async (url) => {
+    if (url.includes('.well-known')) return new Response(JSON.stringify({ resource: 'https://mcp.box.simular.ai/mcp', authorization_servers: ['https://mcp.box.simular.ai'] }), { status: 200 })
+    return new Response(null, { status: 401, headers: { 'www-authenticate': 'Bearer resource_metadata="https://mcp.box.simular.ai/.well-known/oauth-protected-resource/mcp"' } })
+  }
+  const old = await probeEndpoint('https://relay.simular.cloud/mcp', { fetchImpl })
+  assert.equal(old.ok, false)
+  assert.match(old.error, /names https:\/\/mcp\.box\.simular\.ai\/mcp, not https:\/\/relay\.simular\.cloud\/mcp/)
+  assert.equal((await probeEndpoint('https://mcp.box.simular.ai/mcp', { fetchImpl })).ok, true)
+  assert.equal((await probeEndpoint('https://mcp.box.simular.ai/mcp/', { fetchImpl })).ok, true, 'a trailing slash is the same resource')
+})
+
+test('url: the old relay address is ours but outdated; staging is not', () => {
+  assert.equal(DEFAULT_MCP_URL, 'https://mcp.box.simular.ai/mcp')
+  for (const u of ['https://relay.simular.cloud/mcp', 'https://staging.relay.simular.cloud/mcp', DEFAULT_MCP_URL]) assert.ok(isOurUrl(u, DEFAULT_MCP_URL), u)
+  assert.equal(isOurUrl('https://mcp.box.com', DEFAULT_MCP_URL), false)
+  assert.equal(isOldUrl('https://relay.simular.cloud/mcp', DEFAULT_MCP_URL), true)
+  assert.equal(isOldUrl('https://staging.relay.simular.cloud/mcp', DEFAULT_MCP_URL), false)
+  assert.equal(isOldUrl(DEFAULT_MCP_URL, DEFAULT_MCP_URL), false)
+  assert.equal(isOldUrl('https://relay.simular.cloud/mcp', 'https://relay.simular.cloud/mcp'), false, 'not outdated when BOX_MCP_URL points there')
+  assert.equal(isOldUrl('not a url', DEFAULT_MCP_URL), false)
+})
+
 test('doctor: flags a stale URL, a legacy server and a rejected key, with fixes', async () => {
   const sb = sandbox()
   sb.write('.cursor/mcp.json', JSON.stringify({ mcpServers: { box: { url: 'https://relay.simular.cloud/old' }, 'box-control': { url: 'https://relay.simular.cloud/control' } } }))
@@ -61,10 +84,11 @@ test('doctor: flags a stale URL, a legacy server and a rejected key, with fixes'
   })
   const cursor = report.clients.find((c) => c.id === 'cursor')
   assert.equal(cursor.ok, false)
-  assert.match(cursor.problems.join('\n'), /points at https:\/\/relay.simular.cloud\/old/)
+  assert.match(cursor.problems.join('\n'), /points at https:\/\/relay.simular.cloud\/old, box's old address/)
   assert.match(cursor.problems.join('\n'), /box-control/)
   assert.deepEqual(cursor.fixes, ['npx @simular-ai/box connect --client cursor'])
   const hermes = report.clients.find((c) => c.id === 'hermes')
+  assert.match(hermes.problems.join('\n'), /relay\.simular\.cloud\/mcp, box's old address, which no longer signs in; box is now at https:\/\/mcp\.box\.simular\.ai\/mcp/)
   assert.deepEqual(hermes.key, { configured: true, valid: false, status: 401 })
   assert.ok(hermes.fixes.some((f) => f.includes('--auth key')))
   assert.ok(!JSON.stringify(report).includes(KEY), 'the report never contains the key')
@@ -85,13 +109,33 @@ test('real CLI: connect --client cursor,codex --yes in a temp HOME, then remove'
   assert.match(res.stdout, /start a new chat \(or restart the app\)/)
   for (const e of EXAMPLE_PROMPTS) assert.ok(res.stdout.includes(e), `shows the example prompt: ${e}`)
   assert.deepEqual(JSON.parse(sb.read('.cursor/mcp.json')), { mcpServers: { box: { url: DEFAULT_MCP_URL } } })
-  assert.match(sb.read('.codex/config.toml'), /\[mcp_servers\.box\]\nurl = "https:\/\/relay\.simular\.cloud\/mcp"/)
+  assert.match(sb.read('.codex/config.toml'), /\[mcp_servers\.box\]\nurl = "https:\/\/mcp\.box\.simular\.ai\/mcp"/)
   const rm = run(['remove', '--client', 'cursor,codex', '--yes'], sb)
   assert.equal(rm.status, 0, rm.stderr)
   assert.ok(!rm.stdout.includes(EXAMPLE_PROMPTS[0]), 'remove shows no example prompts')
   assert.deepEqual(JSON.parse(sb.read('.cursor/mcp.json')), { mcpServers: {} })
 })
 
+test('real CLI: connect moves old relay entries to the new URL and says to sign in again; remove takes either', () => {
+  const sb = sandbox()
+  sb.write('.cursor/mcp.json', JSON.stringify({ mcpServers: { box: { url: 'https://relay.simular.cloud/mcp' }, 'box-control': { url: 'https://relay.simular.cloud/control' }, other: { url: 'https://example.com/mcp' } } }))
+  sb.write('.codex/config.toml', '[mcp_servers.box]\nurl = "https://relay.simular.cloud/mcp"\n')
+  const res = run(['connect', '--client', 'cursor,codex', '--yes'], sb)
+  assert.equal(res.status, 0, res.stderr + res.stdout)
+  assert.match(res.stdout, /Cursor: wrote box/)
+  assert.match(res.stdout, /box moved from https:\/\/relay\.simular\.cloud\/mcp to https:\/\/mcp\.box\.simular\.ai\/mcp\. Cursor may ask you to sign in to box again/)
+  assert.match(res.stdout, /Codex may ask you to sign in to box again/)
+  assert.deepEqual(JSON.parse(sb.read('.cursor/mcp.json')).mcpServers, { other: { url: 'https://example.com/mcp' }, box: { url: DEFAULT_MCP_URL } })
+  assert.match(sb.read('.codex/config.toml'), /url = "https:\/\/mcp\.box\.simular\.ai\/mcp"/)
+  const again = run(['connect', '--client', 'cursor,codex', '--yes'], sb)
+  assert.ok(!again.stdout.includes('sign in to box again'), 'a re-run says nothing about moving')
+
+  // remove takes an entry at the old address too.
+  sb.write('.cursor/mcp.json', JSON.stringify({ mcpServers: { box: { url: 'https://relay.simular.cloud/mcp' } } }))
+  assert.equal(run(['remove', '--client', 'cursor', '--yes'], sb).status, 0)
+  assert.deepEqual(JSON.parse(sb.read('.cursor/mcp.json')), { mcpServers: {} })
+})
+
 test('real CLI: key mode without a key fails clearly; with BOX_TOKEN it never prints the key', () => {
   const sb = sandbox()
   sb.write('.hermes/config.yaml', '')
@@ -139,7 +183,7 @@ test('real CLI: a config it may not write gets a clear message (and the Codex ap
     assert.notEqual(res.status, 0)
     const out = res.stdout + res.stderr
     assert.match(out, /could not change .*config\.toml: the file or its folder/)
-    assert.match(out, /Settings -> MCP servers -> Add server, name it box, choose Streamable HTTP, paste https:\/\/relay\.simular\.cloud\/mcp/)
+    assert.match(out, /Settings -> MCP servers -> Add server, name it box, choose Streamable HTTP, paste https:\/\/mcp\.box\.simular\.ai\/mcp/)
     assert.match(out, /click Authenticate next to box/)
   } finally {
     fs.chmodSync(path.join(sb.home, '.codex'), 0o700)
diff --git a/cli/test/clients.test.js b/cli/test/clients.test.js
index 6d376b3..7530ec0 100644
--- a/cli/test/clients.test.js
+++ b/cli/test/clients.test.js
@@ -71,7 +71,7 @@ test('codex: keeps CRLF line endings', () => {
   const sb = sandbox()
   sb.write('.codex/config.toml', 'model = "gpt-5"\r\n\r\n[mcp_servers.box]\r\nurl = "https://relay.simular.cloud/old"\r\n\r\n[profiles.x]\r\nmodel = "m"\r\n')
   client('codex').connect(sb.ctx)
-  assert.equal(sb.read('.codex/config.toml'), 'model = "gpt-5"\r\n\r\n[profiles.x]\r\nmodel = "m"\r\n\r\n[mcp_servers.box]\r\nurl = "https://relay.simular.cloud/mcp"\r\n')
+  assert.equal(sb.read('.codex/config.toml'), 'model = "gpt-5"\r\n\r\n[profiles.x]\r\nmodel = "m"\r\n\r\n[mcp_servers.box]\r\nurl = "https://mcp.box.simular.ai/mcp"\r\n')
   client('codex').remove(sb.ctx)
   assert.equal(sb.read('.codex/config.toml'), 'model = "gpt-5"\r\n\r\n[profiles.x]\r\nmodel = "m"\r\n')
 })
@@ -209,7 +209,7 @@ test('claude-code: default URL installs the plugin from the marketplace; overrid
   sb.write('.claude.json', JSON.stringify({ mcpServers: { 'box-control': { url: 'https://relay.simular.cloud/control' }, box: { type: 'http', url: DEFAULT_MCP_URL }, other: { command: 'y' } } }))
   client('claude').connect(sb.ctx)
   const state = () => JSON.parse(sb.read('fake-claude-state.json'))
-  assert.deepEqual(state().plugins, { 'box@simular-box': { enabled: true } })
+  assert.deepEqual(state().plugins, { 'box@simular-box': { enabled: true, url: DEFAULT_MCP_URL } })
   assert.deepEqual(Object.keys(JSON.parse(sb.read('.claude.json')).mcpServers), ['other'])
   assert.ok(state().calls.includes('plugin marketplace add simular-ai/box-plugin'))
   assert.deepEqual(client('claude').connect(sb.ctx).actions, [])
@@ -226,6 +226,29 @@ test('claude-code: default URL installs the plugin from the marketplace; overrid
   assert.equal(JSON.parse(sb.read('.claude.json')).mcpServers.box, undefined)
 })
 
+test('claude-code: a plugin installed before the move is updated to the new URL', { skip: NO_FAKE_BINS }, () => {
+  const sb = sandbox({ bins: { claude: FAKE_CLAUDE } })
+  const old = 'https://relay.simular.cloud/mcp'
+  sb.write('fake-claude-state.json', JSON.stringify({ marketplaces: ['simular-box'], plugins: { 'box@simular-box': { enabled: true, url: old } }, calls: [] }))
+  const state = () => JSON.parse(sb.read('fake-claude-state.json'))
+  assert.equal(client('claude').status(sb.ctx).entries[0].url, old)
+  const dry = client('claude').connect({ ...sb.ctx, dryRun: true })
+  assert.match(dry.actions.join(' '), /would update plugin box@simular-box/)
+  assert.equal(state().plugins['box@simular-box'].url, old, 'a dry run updates nothing')
+  const res = client('claude').connect(sb.ctx)
+  assert.match(res.actions.join(' '), /updated plugin box@simular-box/)
+  assert.match(res.next[0], /^Restart Claude Code/)
+  assert.ok(state().calls.includes('plugin marketplace update simular-box'))
+  assert.ok(state().calls.includes('plugin update box@simular-box --scope user'))
+  assert.equal(state().plugins['box@simular-box'].url, DEFAULT_MCP_URL)
+  assert.deepEqual(client('claude').connect(sb.ctx).actions, [], 'idempotent once updated')
+  // Our own old user-scope box next to the plugin is removed; remove takes the plugin either way.
+  sb.write('.claude.json', JSON.stringify({ mcpServers: { box: { type: 'http', url: old } } }))
+  assert.match(client('claude').connect(sb.ctx).actions.join(' '), /removed the user-scope box server/)
+  client('claude').remove(sb.ctx)
+  assert.deepEqual(state().plugins, {})
+})
+
 test('claude-desktop: writes nothing, prints connector steps', () => {
   const sb = sandbox()
   const res = client('claude-desktop').connect(sb.ctx)
diff --git a/cli/test/fixtures/codex.after.toml b/cli/test/fixtures/codex.after.toml
index ab02a4a..31019ec 100644
--- a/cli/test/fixtures/codex.after.toml
+++ b/cli/test/fixtures/codex.after.toml
@@ -13,5 +13,5 @@ approval_mode = "approve"
 model = "gpt-5-mini"
 
 [mcp_servers.box]
-url = "https://relay.simular.cloud/mcp"
+url = "https://mcp.box.simular.ai/mcp"
 startup_timeout_sec = 30
diff --git a/cli/test/helpers.js b/cli/test/helpers.js
index ccffbd6..a247e86 100644
--- a/cli/test/helpers.js
+++ b/cli/test/helpers.js
@@ -55,10 +55,14 @@ const a = process.argv.slice(2)
 state.calls.push(a.join(' '))
 const save = () => { fs.writeFileSync(stateFile, JSON.stringify(state)); fs.writeFileSync(cfgFile, JSON.stringify(cfg)) }
 const is = (...w) => w.every((x, i) => a[i] === x)
-if (is('plugin', 'list')) console.log(JSON.stringify(Object.entries(state.plugins).map(([id, p]) => ({ id, enabled: p.enabled, mcpServers: { box: { type: 'http', url: 'https://relay.simular.cloud/mcp' } } }))))
+// The marketplace's plugin points at state.latestUrl (default: the current URL); an installed plugin keeps the URL it was installed with until updated.
+const latest = () => state.latestUrl || 'https://mcp.box.simular.ai/mcp'
+if (is('plugin', 'list')) console.log(JSON.stringify(Object.entries(state.plugins).map(([id, p]) => ({ id, scope: 'user', enabled: p.enabled, mcpServers: { box: { type: 'http', url: p.url } } }))))
 else if (is('plugin', 'marketplace', 'list')) console.log(JSON.stringify(state.marketplaces.map((name) => ({ name }))))
 else if (is('plugin', 'marketplace', 'add')) state.marketplaces.push('simular-box')
-else if (is('plugin', 'install')) { if (!state.marketplaces.includes('simular-box')) { console.error('marketplace not found'); process.exit(1) } state.plugins[a[2]] = { enabled: true } }
+else if (is('plugin', 'install')) { if (!state.marketplaces.includes('simular-box')) { console.error('marketplace not found'); process.exit(1) } state.plugins[a[2]] = { enabled: true, url: latest() } }
+else if (is('plugin', 'marketplace', 'update')) {}
+else if (is('plugin', 'update')) state.plugins[a[2]].url = latest()
 else if (is('plugin', 'enable')) state.plugins[a[2]].enabled = true
 else if (is('plugin', 'disable')) state.plugins[a[2]].enabled = false
 else if (is('plugin', 'uninstall')) delete state.plugins[a[2]]
diff --git a/dsh/README.md b/dsh/README.md
index c56f88f..172b8ac 100644
--- a/dsh/README.md
+++ b/dsh/README.md
@@ -6,10 +6,10 @@ dsh's MCP client sends fixed headers and has no sign-in, so it reaches box with
 2. Install the plugin. In dsh Desktop (or dsh web), open **Plugins → Add plugin**, paste this link and turn the plugin on:
 
    ```
-   https://github.com/simular-ai/box-plugin/releases/download/dsh-v0.2.0/dsh-box.tgz
+   https://github.com/simular-ai/box-plugin/releases/download/dsh-v0.2.1/dsh-box.tgz
    ```
 
-   From a terminal: `dsh plugin add https://github.com/simular-ai/box-plugin/releases/download/dsh-v0.2.0/dsh-box.tgz`
+   From a terminal: `dsh plugin add https://github.com/simular-ai/box-plugin/releases/download/dsh-v0.2.1/dsh-box.tgz`
 3. Open **box** on the Plugins page, paste your key and click **Save**. box connects within a second; changing the key later needs no restart.
 
 box's tools show up as `mcp__box__*`.
diff --git a/dsh/cordis.patch.yml b/dsh/cordis.patch.yml
index 9c2ccbb..eff97d2 100644
--- a/dsh/cordis.patch.yml
+++ b/dsh/cordis.patch.yml
@@ -16,7 +16,7 @@
       config:
         serverName: box
         transport: streamable-http
-        url: !!js process.env.BOX_MCP_URL || 'https://relay.simular.cloud/mcp'
+        url: !!js process.env.BOX_MCP_URL || 'https://mcp.box.simular.ai/mcp'
         headers:
           Authorization: !!js ctx.boxAuth.authorization
         # Waking a box or taking a screenshot can outlast the 60 s default.
diff --git a/dsh/package.json b/dsh/package.json
index a74545f..3b00fe3 100644
--- a/dsh/package.json
+++ b/dsh/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@simular/dsh-box",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "box by Simular: a cloud desktop your agent drives over MCP",
   "license": "MIT",
   "type": "module",
diff --git a/hermes/README.md b/hermes/README.md
index a6f8595..7130868 100644
--- a/hermes/README.md
+++ b/hermes/README.md
@@ -26,6 +26,8 @@ This folder is a portable Agent Plugins v1 package (`plugin.json`, `mcp.json`, `
 
    If you change the key later, run `hermes gateway restart`: a running gateway keeps the old value and parks the server.
 
-**On a desktop with a browser**, you can sign in instead of using a key: `hermes mcp add box --url https://relay.simular.cloud/mcp --auth oauth`, then `hermes mcp login box`. A server you add this way overrides the plugin's entry of the same name. On a server, prefer the key: when an OAuth refresh token expires, Hermes parks the server until someone signs in again by hand.
+   To update, copy the folder again the same way (version 0.1.1 moved box to `https://mcp.box.simular.ai/mcp`) and restart the gateway.
+
+**On a desktop with a browser**, you can sign in instead of using a key: `hermes mcp add box --url https://mcp.box.simular.ai/mcp --auth oauth`, then `hermes mcp login box`. A server you add this way overrides the plugin's entry of the same name. On a server, prefer the key: when an OAuth refresh token expires, Hermes parks the server until someone signs in again by hand.
 
 Watch the box live, and take over when needed, at https://box.simular.ai/box.
diff --git a/hermes/mcp.json b/hermes/mcp.json
index 0eaf9cc..9646407 100644
--- a/hermes/mcp.json
+++ b/hermes/mcp.json
@@ -3,7 +3,7 @@
   "mcpServers": {
     "box": {
       "type": "streamable-http",
-      "url": "https://relay.simular.cloud/mcp",
+      "url": "https://mcp.box.simular.ai/mcp",
       "headers": {
         "Authorization": "Bearer ${MCP_BOX_API_KEY}"
       }
diff --git a/hermes/plugin.json b/hermes/plugin.json
index c9776d3..bbbf479 100644
--- a/hermes/plugin.json
+++ b/hermes/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "box",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Give your agent a computer of its own: a cloud Linux desktop with Chrome and a shell that it drives over MCP, around the clock, while your own machine stays free.",
   "author": {
     "name": "Simular",

From 9b872d5f3198e4566c8e4e33a9553acdc97b593f Mon Sep 17 00:00:00 2001
From: chenchen <chenchen@simular.ai>
Date: Wed, 4 Nov 2026 12:41:18 +0800
Subject: [PATCH 2/2] cli: check the Claude Code plugin's URL after updating it

Review follow-up: if the marketplace still serves the old .mcp.json (a fork
or pinned ref), connect now fails with the fix instead of reporting success
and re-running the update on every connect.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 cli/src/clients/claude-code.js | 7 +++++++
 cli/test/clients.test.js       | 6 ++++++
 cli/test/helpers.js            | 2 +-
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/cli/src/clients/claude-code.js b/cli/src/clients/claude-code.js
index 2a42199..30a9a6a 100644
--- a/cli/src/clients/claude-code.js
+++ b/cli/src/clients/claude-code.js
@@ -108,6 +108,13 @@ export default {
             must(ctx.run('claude', ['plugin', 'marketplace', 'update', MARKETPLACE], { timeoutMs: 180000 }), 'claude plugin marketplace update')
             const scope = ['user', 'project', 'local'].includes(plugin.scope) ? ['--scope', plugin.scope] : []
             must(ctx.run('claude', ['plugin', 'update', PLUGIN, ...scope], { timeoutMs: 180000 }), 'claude plugin update')
+            const now = pluginState(ctx)?.mcpServers?.box?.url
+            if (now !== DEFAULT_MCP_URL) {
+              throw new Error(
+                `the ${PLUGIN} plugin still points at ${now || 'an unknown URL'} after an update; its marketplace "${MARKETPLACE}" may not come from ${MARKETPLACE_SOURCE}. ` +
+                  `Run \`claude plugin uninstall ${PLUGIN}\` and \`claude plugin marketplace remove ${MARKETPLACE}\`, then connect again`,
+              )
+            }
           }
           actions.push(`${ctx.dryRun ? 'would update' : 'updated'} plugin ${PLUGIN} (box server now at ${DEFAULT_MCP_URL})`)
           updated = true
diff --git a/cli/test/clients.test.js b/cli/test/clients.test.js
index 7530ec0..e1c6451 100644
--- a/cli/test/clients.test.js
+++ b/cli/test/clients.test.js
@@ -249,6 +249,12 @@ test('claude-code: a plugin installed before the move is updated to the new URL'
   assert.deepEqual(state().plugins, {})
 })
 
+test('claude-code: an update that leaves the old URL fails instead of claiming success', { skip: NO_FAKE_BINS }, () => {
+  const sb = sandbox({ bins: { claude: FAKE_CLAUDE } })
+  sb.write('fake-claude-state.json', JSON.stringify({ marketplaces: ['simular-box'], plugins: { 'box@simular-box': { enabled: true, url: 'https://relay.simular.cloud/mcp' } }, staleMarketplace: true, calls: [] }))
+  assert.throws(() => client('claude').connect(sb.ctx), /still points at https:\/\/relay\.simular\.cloud\/mcp after an update/)
+})
+
 test('claude-desktop: writes nothing, prints connector steps', () => {
   const sb = sandbox()
   const res = client('claude-desktop').connect(sb.ctx)
diff --git a/cli/test/helpers.js b/cli/test/helpers.js
index a247e86..1edc2fe 100644
--- a/cli/test/helpers.js
+++ b/cli/test/helpers.js
@@ -62,7 +62,7 @@ else if (is('plugin', 'marketplace', 'list')) console.log(JSON.stringify(state.m
 else if (is('plugin', 'marketplace', 'add')) state.marketplaces.push('simular-box')
 else if (is('plugin', 'install')) { if (!state.marketplaces.includes('simular-box')) { console.error('marketplace not found'); process.exit(1) } state.plugins[a[2]] = { enabled: true, url: latest() } }
 else if (is('plugin', 'marketplace', 'update')) {}
-else if (is('plugin', 'update')) state.plugins[a[2]].url = latest()
+else if (is('plugin', 'update')) { if (!state.staleMarketplace) state.plugins[a[2]].url = latest() }
 else if (is('plugin', 'enable')) state.plugins[a[2]].enabled = true
 else if (is('plugin', 'disable')) state.plugins[a[2]].enabled = false
 else if (is('plugin', 'uninstall')) delete state.plugins[a[2]]