mirage-ai — list /box/ in the browser via PKCE (no client_secret)