don't overwrite root box.json and normalize slashes