[nonreagent]

Part of #28

Problem

Bringing up an exe.dev VM as an @nonreagent host was a clone, ./install.sh, and two prose steps, one of them an interactive gh auth login, all typed by hand into the new box.

Motivation

This replaces the exe-box half of #74. The goal: provision a new @nonreagent box with one command from the Mac. #74's wrapper ran a downstream setup.sh that nonreagent/dotfiles never got; this version runs that repo's existing install.sh, so it ships on its own with no change downstream.

Proposed Solution

• scripts/new-exe-box.sh <name> (make exe-box NAME=<name>), run from the Mac:
  1. Reads @nonreagent's GitHub token from 1Password (EXE_BOX_GH_TOKEN_REF) before creating anything.
  2. Probes <name>.exe.xyz; reuses the box if it answers, otherwise runs ssh exe.dev new --name <name> --json and waits for ssh (EXE_BOX_WAIT, default 300s). A failed new prints exe.dev's output.
  3. Pipes the token into gh auth login --with-token && gh auth setup-git over ssh stdin. It never appears in an argument, --env, or a setup-script.
  4. Pulls ~/.dotfiles or clones nonreagent/dotfiles there, then runs install.sh and ~/.claude/sync-plugins.sh.
  5. Prints the box URL and the optional ~/bin/setup-review-watcher step.
• A re-run against the same name converges: no second VM, token re-injected, checkout pulled, install re-run.
• test/test_exe_box.sh covers the flow, reuse, a failed new, a bad token reference, the stdin-only token, and the wait timeout, all with stubs.

Design: docs/superpowers/specs/2026-10-29-exe-box-design.md. Plan: docs/superpowers/plans/2026-10-29-setup-script-split.md (in #97). The Mac setup command ships separately in #97.

Feedback

• Not yet run against a real box. It needs your terminal (exe.dev key, unlocked op). Before merge: confirm op://Private/nonreagent-github/token is the right reference, run ssh exe.dev help new to confirm --name and --json, then make exe-box NAME=nr-probe-<mmdd> twice (the second should say using existing), check ssh <box> 'gh auth status && ~/.dotfiles/deploy.sh audit && command -v claude', and ssh exe.dev rm the box.
• The wrapper assumes the exeuntu image ships git, gh and claude; the probe confirms it.
• Whichever of this and One setup command for a new Mac #97 merges second has a one-line conflict in the Makefile test: recipe. Keep both ./test/test_setup.sh and ./test/test_exe_box.sh.