diff --git a/data/sbx_cli/sbx.yaml b/data/sbx_cli/sbx.yaml index 0348f491b8..41fcf44a8a 100644 --- a/data/sbx_cli/sbx.yaml +++ b/data/sbx_cli/sbx.yaml @@ -18,6 +18,13 @@ options: shorthand: h default_value: "false" usage: help for sbx + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead + - name: version + default_value: "false" + usage: Show version information see_also: - sbx attach - Attach to a cloud sandbox, starting it first if it is stopped - sbx completion - Generate the autocompletion script for the specified shell diff --git a/data/sbx_cli/sbx_attach.yaml b/data/sbx_cli/sbx_attach.yaml index 40cd65f848..f0330f8f41 100644 --- a/data/sbx_cli/sbx_attach.yaml +++ b/data/sbx_cli/sbx_attach.yaml @@ -29,6 +29,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Attach to a sandbox by ID or name sbx --cloud attach sbx_abc123 diff --git a/data/sbx_cli/sbx_completion.yaml b/data/sbx_cli/sbx_completion.yaml index dfcfa4ef55..b2cb37e683 100644 --- a/data/sbx_cli/sbx_completion.yaml +++ b/data/sbx_cli/sbx_completion.yaml @@ -18,6 +18,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx - Manage AI coding agent sandboxes. - sbx completion bash - Generate the autocompletion script for bash diff --git a/data/sbx_cli/sbx_completion_bash.yaml b/data/sbx_cli/sbx_completion_bash.yaml index c12d6b9231..2ea1d8b9a5 100644 --- a/data/sbx_cli/sbx_completion_bash.yaml +++ b/data/sbx_cli/sbx_completion_bash.yaml @@ -39,6 +39,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Load completions in the current shell source <(sbx completion bash) diff --git a/data/sbx_cli/sbx_completion_fish.yaml b/data/sbx_cli/sbx_completion_fish.yaml index d0b62d64d6..4487f92cea 100644 --- a/data/sbx_cli/sbx_completion_fish.yaml +++ b/data/sbx_cli/sbx_completion_fish.yaml @@ -30,6 +30,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Load completions in the current shell sbx completion fish | source diff --git a/data/sbx_cli/sbx_completion_powershell.yaml b/data/sbx_cli/sbx_completion_powershell.yaml index 3afc10fbb1..c304099a37 100644 --- a/data/sbx_cli/sbx_completion_powershell.yaml +++ b/data/sbx_cli/sbx_completion_powershell.yaml @@ -27,6 +27,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Load completions in the current session sbx completion powershell | Out-String | Invoke-Expression diff --git a/data/sbx_cli/sbx_completion_zsh.yaml b/data/sbx_cli/sbx_completion_zsh.yaml index dca27cf0ea..c603db24e8 100644 --- a/data/sbx_cli/sbx_completion_zsh.yaml +++ b/data/sbx_cli/sbx_completion_zsh.yaml @@ -41,6 +41,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Load completions in the current shell source <(sbx completion zsh) diff --git a/data/sbx_cli/sbx_cp.yaml b/data/sbx_cli/sbx_cp.yaml index 0571e6aacd..21da727a8d 100644 --- a/data/sbx_cli/sbx_cp.yaml +++ b/data/sbx_cli/sbx_cp.yaml @@ -6,19 +6,27 @@ description: |- ID (sbx_*) or name from "sbx --cloud ls". Cloud transfers go through the Docker Sandboxes Cloud file API instead of the local sandboxd. + Cloud copies transfer files, not symbolic links or empty directories. A symbolic + link passed as SRC is always followed on upload. Links inside an uploaded + directory are skipped unless --follow-link is set. On download, --follow-link + follows SRC only when it names a symbolic link to a file. Downloads of directories + skip symbolic links even with --follow-link. + When copying a directory, the directory itself is placed at the destination. If the destination path does not exist it is created; if it already exists as a directory, the source is placed inside it. - When a local path is inside a sandbox workspace, sbx cp refuses symbolic - links that lead out of the workspace, even with --follow-link, including - when the workspace is reached through a symbolic link or junction to it. + For local paths inside workspace directories or other host directories mounted + into the sandbox, sbx cp refuses symbolic links that escape those directories, + even with --follow-link, including when a directory is reached through a + symbolic link, junction or substituted drive. usage: sbx cp SRC DST [flags] options: - name: follow-link shorthand: L default_value: "false" - usage: Follow symbolic links in the source path + usage: | + Follow symbolic links in the source path (cloud: does not follow links inside downloaded directories) - name: help shorthand: h default_value: "false" @@ -32,6 +40,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Copy a file from host to sandbox sbx cp ./config.json my-sandbox:/home/user/ diff --git a/data/sbx_cli/sbx_create.yaml b/data/sbx_cli/sbx_create.yaml index a98b3659dd..f273183d11 100644 --- a/data/sbx_cli/sbx_create.yaml +++ b/data/sbx_cli/sbx_create.yaml @@ -7,7 +7,7 @@ description: |- reference. Sandbox kit references may be local directories, ZIP files, git repositories, or OCI references. Relative local references must be explicit paths such as ./my-kit or ../my-kit.zip. A kit.shortcuts. setting - (sbx settings set kit.shortcuts.claude sbx/claude:latest) makes that agent name + (sbx settings set kit.shortcuts.claude myorg/claude:latest) makes that agent name resolve to the configured kit reference instead for local sandboxes; cloud sandboxes ignore it. @@ -82,7 +82,7 @@ options: - name: memory shorthand: m usage: | - Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) + Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: host memory. Warns above 75% of host memory - name: mount default_value: '[]' usage: | @@ -113,7 +113,7 @@ options: - name: static-mcp default_value: '[]' usage: | - MCP server names that form the sandbox's fixed (static) MCP set. Accepts a comma-separated list (--static-mcp notion,atlassian), repeated flags (--static-mcp notion --static-mcp atlassian), or a mix; all forms accumulate into the same set. The set is chosen once at creation time. Local sandboxes take names registered with 'sbx mcp add'. Cloud sandboxes resolve names on the cloud MCP gateway. + MCP server names that form the sandbox's fixed (static) MCP set. Accepts a comma-separated list (--static-mcp notion,atlassian), repeated flags (--static-mcp notion --static-mcp atlassian), or a mix; all forms accumulate into the same set. Use none for a static set with no servers, local sandboxes only. The set is chosen once at creation time. Local sandboxes take names registered with 'sbx mcp add'. Cloud sandboxes resolve names on the cloud MCP gateway. - name: template shorthand: t usage: | @@ -136,6 +136,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Create a sandbox for Claude in the current directory sbx create claude . @@ -146,6 +150,9 @@ example: |4- # Create with additional read-only workspaces sbx create claude . /path/to/docs:ro + # Mount an additional workspace at a chosen path inside the sandbox + sbx create claude . /path/to/data:/workspace/data + # Create without a workspace bind mount sbx create claude @@ -168,11 +175,4 @@ example: |4- sbx --cloud create -t TEMPLATE see_also: - sbx - Manage AI coding agent sandboxes. - - sbx create claude - Create a sandbox for claude - - sbx create codex - Create a sandbox for codex - - sbx create cursor - Create a sandbox for cursor - - sbx create devin - Create a sandbox for devin - - sbx create docker-agent - Create a sandbox for docker-agent - sbx create gemini - Create a sandbox for gemini - - sbx create opencode - Create a sandbox for opencode - - sbx create shell - Create a sandbox for shell diff --git a/data/sbx_cli/sbx_create_claude.yaml b/data/sbx_cli/sbx_create_claude.yaml deleted file mode 100644 index fad4cb2fda..0000000000 --- a/data/sbx_cli/sbx_create_claude.yaml +++ /dev/null @@ -1,156 +0,0 @@ -name: sbx create claude -synopsis: Create a sandbox for claude -description: |- - Create a sandbox with access to a host workspace for claude. - - The workspace path is mounted inside the sandbox at the same path as on the - host. Additional workspaces can be provided as extra arguments. Append ":ro" to - mount them read-only; a read-only argument may name a single file, which holds - that one path out of reach inside a workspace the sandbox can otherwise write. - - Omit the path to create a sandbox without a workspace bind mount: the agent - then works in the container's own filesystem instead of on your files. - - Use "sbx run --name SANDBOX" to attach to the agent after creation. - - With --cloud: - Create a cloud sandbox for claude. - - Cloud sandboxes have no host workspace, so no path follows the agent. Sizing - comes from --cpus and --memory and must land on a billable shape; without them - a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template - must already exist in the cloud registry. - - Cloud sandboxes use cloud network policies. Host network and HTTP policies - do not apply. Set cloud account defaults with - "sbx --cloud policy init ". - - Use "sbx --cloud run --name SANDBOX" to attach to the agent after - creation: cloud needs the agent, since a name alone is not a unique handle. -usage: sbx create claude [PATH...] [flags] -options: - - name: help - shorthand: h - default_value: "false" - usage: help for claude -inherited_options: - - name: allow-network - usage: | - Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - - name: clone - default_value: "false" - usage: | - Run the agent on a private in-container clone of the host Git repository (mounted read-only) instead of bind-mounting the workspace; the agent's commits are accessible via the sandbox- git remote on the host - - name: cloud - default_value: "false" - usage: | - Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cpus - default_value: "0" - usage: | - Number of CPUs to allocate to the sandbox (0 = auto: all host CPUs, at most 16 on Linux arm64) - - name: debug - shorthand: D - default_value: "false" - usage: Enable debug logging - - name: deny-network - usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - - name: env - shorthand: e - default_value: '[]' - usage: | - Set an environment variable in the sandbox (can be repeated): KEY=VALUE, or a bare KEY to take the value from the current environment - - name: env-file - default_value: '[]' - usage: | - Read environment variables from a file (can be repeated). --env wins over any file; a later file wins over an earlier one - - name: image-ref - usage: | - OCI image reference for inline-mode cloud create (mutually exclusive with --template; requires --cpus and --memory) - - name: kit - default_value: '[]' - experimental: true - usage: | - Additional kit reference (must be a mixin; directory, ZIP, git, or OCI). Can be specified multiple times - - name: kit-arg - default_value: '[]' - experimental: true - usage: | - Value for an argument the kit declares, as name=value for every kit or kit.name=value for one (can be repeated) - - name: kit-args-file - default_value: '[]' - experimental: true - usage: | - File of name=value kit arguments, one per line (can be repeated); --kit-arg overrides - - name: memory - shorthand: m - usage: | - Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - - name: mount - default_value: '[]' - usage: | - Bind a host directory to a kit host-mount@1 path (can be repeated): HOST:SANDBOX_PATH. Can only be used when creating a new sandbox. - - name: name - usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - - name: no-progress - default_value: "false" - usage: Suppress progress output - - name: on-timeout - usage: | - What happens when --ttl lapses: 'stop' stops the sandbox in place so it can be started again later, 'restart' keeps it running by stopping and immediately starting it, or 'delete' removes it. Omit the flag and the server stops the sandbox when it can be started again later, and deletes it otherwise. With 'restart' a supplied --ttl must be at least 1h (cloud only). - - name: platform - usage: | - Target platform: linux/amd64 or linux/arm64 (cloud only). With --image-ref, omitting it lets the server resolve the platform from the image and the CLI sends the local CPU as a hint for multi-platform images. With --template, omitting it inherits the template platform. With a sandbox kit, the kit's template is built for this platform and cached apart from other platforms; omitting it keeps the server's choice. - - name: publish - shorthand: p - default_value: '[]' - usage: | - Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] - - name: pull - usage: | - Image pull policy (always|missing|never; default: never for saved local snapshots, missing for v3 kit compositions, otherwise always) - - name: skills - usage: | - Shared skills store mode for the agent's skills directory (e.g. ~/.claude/skills): off, readonly (store linked in read-only, directory stays writable), or readwrite (store mounted over it, writes are shared). Default: readonly, or the configured skills.defaultMode setting. - - name: static-mcp - default_value: '[]' - usage: | - MCP server names that form the sandbox's fixed (static) MCP set. Accepts a comma-separated list (--static-mcp notion,atlassian), repeated flags (--static-mcp notion --static-mcp atlassian), or a mix; all forms accumulate into the same set. The set is chosen once at creation time. Local sandboxes take names registered with 'sbx mcp add'. Cloud sandboxes resolve names on the cloud MCP gateway. - - name: template - shorthand: t - usage: | - Container image to use for the sandbox (default: agent-specific image) - - name: ttl - usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - - name: volume - shorthand: v - default_value: '[]' - experimental: true - usage: | - Attach an existing persistent volume, NAME:MOUNTPATH (cloud only, experimental; repeatable) -example: |4- - # Create in the current directory - sbx create claude . - - # Create with a specific path - sbx create claude /path/to/project - - # Create with additional read-only workspaces - sbx create claude . /path/to/docs:ro - - # Create without a workspace bind mount - sbx create claude - - # Create a cloud sandbox for claude - sbx --cloud create claude - - # Create a named cloud sandbox with a mixin baked in - sbx --cloud create --name my-project claude --kit ./my-mixin/ - - # Create from a template that already exists in the cloud registry - sbx --cloud create -t TEMPLATE -see_also: - - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_create_codex.yaml b/data/sbx_cli/sbx_create_codex.yaml deleted file mode 100644 index 18fe957198..0000000000 --- a/data/sbx_cli/sbx_create_codex.yaml +++ /dev/null @@ -1,156 +0,0 @@ -name: sbx create codex -synopsis: Create a sandbox for codex -description: |- - Create a sandbox with access to a host workspace for codex. - - The workspace path is mounted inside the sandbox at the same path as on the - host. Additional workspaces can be provided as extra arguments. Append ":ro" to - mount them read-only; a read-only argument may name a single file, which holds - that one path out of reach inside a workspace the sandbox can otherwise write. - - Omit the path to create a sandbox without a workspace bind mount: the agent - then works in the container's own filesystem instead of on your files. - - Use "sbx run --name SANDBOX" to attach to the agent after creation. - - With --cloud: - Create a cloud sandbox for codex. - - Cloud sandboxes have no host workspace, so no path follows the agent. Sizing - comes from --cpus and --memory and must land on a billable shape; without them - a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template - must already exist in the cloud registry. - - Cloud sandboxes use cloud network policies. Host network and HTTP policies - do not apply. Set cloud account defaults with - "sbx --cloud policy init ". - - Use "sbx --cloud run --name SANDBOX" to attach to the agent after - creation: cloud needs the agent, since a name alone is not a unique handle. -usage: sbx create codex [PATH...] [flags] -options: - - name: help - shorthand: h - default_value: "false" - usage: help for codex -inherited_options: - - name: allow-network - usage: | - Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - - name: clone - default_value: "false" - usage: | - Run the agent on a private in-container clone of the host Git repository (mounted read-only) instead of bind-mounting the workspace; the agent's commits are accessible via the sandbox- git remote on the host - - name: cloud - default_value: "false" - usage: | - Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cpus - default_value: "0" - usage: | - Number of CPUs to allocate to the sandbox (0 = auto: all host CPUs, at most 16 on Linux arm64) - - name: debug - shorthand: D - default_value: "false" - usage: Enable debug logging - - name: deny-network - usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - - name: env - shorthand: e - default_value: '[]' - usage: | - Set an environment variable in the sandbox (can be repeated): KEY=VALUE, or a bare KEY to take the value from the current environment - - name: env-file - default_value: '[]' - usage: | - Read environment variables from a file (can be repeated). --env wins over any file; a later file wins over an earlier one - - name: image-ref - usage: | - OCI image reference for inline-mode cloud create (mutually exclusive with --template; requires --cpus and --memory) - - name: kit - default_value: '[]' - experimental: true - usage: | - Additional kit reference (must be a mixin; directory, ZIP, git, or OCI). Can be specified multiple times - - name: kit-arg - default_value: '[]' - experimental: true - usage: | - Value for an argument the kit declares, as name=value for every kit or kit.name=value for one (can be repeated) - - name: kit-args-file - default_value: '[]' - experimental: true - usage: | - File of name=value kit arguments, one per line (can be repeated); --kit-arg overrides - - name: memory - shorthand: m - usage: | - Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - - name: mount - default_value: '[]' - usage: | - Bind a host directory to a kit host-mount@1 path (can be repeated): HOST:SANDBOX_PATH. Can only be used when creating a new sandbox. - - name: name - usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - - name: no-progress - default_value: "false" - usage: Suppress progress output - - name: on-timeout - usage: | - What happens when --ttl lapses: 'stop' stops the sandbox in place so it can be started again later, 'restart' keeps it running by stopping and immediately starting it, or 'delete' removes it. Omit the flag and the server stops the sandbox when it can be started again later, and deletes it otherwise. With 'restart' a supplied --ttl must be at least 1h (cloud only). - - name: platform - usage: | - Target platform: linux/amd64 or linux/arm64 (cloud only). With --image-ref, omitting it lets the server resolve the platform from the image and the CLI sends the local CPU as a hint for multi-platform images. With --template, omitting it inherits the template platform. With a sandbox kit, the kit's template is built for this platform and cached apart from other platforms; omitting it keeps the server's choice. - - name: publish - shorthand: p - default_value: '[]' - usage: | - Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] - - name: pull - usage: | - Image pull policy (always|missing|never; default: never for saved local snapshots, missing for v3 kit compositions, otherwise always) - - name: skills - usage: | - Shared skills store mode for the agent's skills directory (e.g. ~/.claude/skills): off, readonly (store linked in read-only, directory stays writable), or readwrite (store mounted over it, writes are shared). Default: readonly, or the configured skills.defaultMode setting. - - name: static-mcp - default_value: '[]' - usage: | - MCP server names that form the sandbox's fixed (static) MCP set. Accepts a comma-separated list (--static-mcp notion,atlassian), repeated flags (--static-mcp notion --static-mcp atlassian), or a mix; all forms accumulate into the same set. The set is chosen once at creation time. Local sandboxes take names registered with 'sbx mcp add'. Cloud sandboxes resolve names on the cloud MCP gateway. - - name: template - shorthand: t - usage: | - Container image to use for the sandbox (default: agent-specific image) - - name: ttl - usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - - name: volume - shorthand: v - default_value: '[]' - experimental: true - usage: | - Attach an existing persistent volume, NAME:MOUNTPATH (cloud only, experimental; repeatable) -example: |4- - # Create in the current directory - sbx create codex . - - # Create with a specific path - sbx create codex /path/to/project - - # Create with additional read-only workspaces - sbx create codex . /path/to/docs:ro - - # Create without a workspace bind mount - sbx create codex - - # Create a cloud sandbox for codex - sbx --cloud create codex - - # Create a named cloud sandbox with a mixin baked in - sbx --cloud create --name my-project codex --kit ./my-mixin/ - - # Create from a template that already exists in the cloud registry - sbx --cloud create -t TEMPLATE -see_also: - - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_create_cursor.yaml b/data/sbx_cli/sbx_create_cursor.yaml deleted file mode 100644 index d60eef56e8..0000000000 --- a/data/sbx_cli/sbx_create_cursor.yaml +++ /dev/null @@ -1,156 +0,0 @@ -name: sbx create cursor -synopsis: Create a sandbox for cursor -description: |- - Create a sandbox with access to a host workspace for cursor. - - The workspace path is mounted inside the sandbox at the same path as on the - host. Additional workspaces can be provided as extra arguments. Append ":ro" to - mount them read-only; a read-only argument may name a single file, which holds - that one path out of reach inside a workspace the sandbox can otherwise write. - - Omit the path to create a sandbox without a workspace bind mount: the agent - then works in the container's own filesystem instead of on your files. - - Use "sbx run --name SANDBOX" to attach to the agent after creation. - - With --cloud: - Create a cloud sandbox for cursor. - - Cloud sandboxes have no host workspace, so no path follows the agent. Sizing - comes from --cpus and --memory and must land on a billable shape; without them - a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template - must already exist in the cloud registry. - - Cloud sandboxes use cloud network policies. Host network and HTTP policies - do not apply. Set cloud account defaults with - "sbx --cloud policy init ". - - Use "sbx --cloud run --name SANDBOX" to attach to the agent after - creation: cloud needs the agent, since a name alone is not a unique handle. -usage: sbx create cursor [PATH...] [flags] -options: - - name: help - shorthand: h - default_value: "false" - usage: help for cursor -inherited_options: - - name: allow-network - usage: | - Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - - name: clone - default_value: "false" - usage: | - Run the agent on a private in-container clone of the host Git repository (mounted read-only) instead of bind-mounting the workspace; the agent's commits are accessible via the sandbox- git remote on the host - - name: cloud - default_value: "false" - usage: | - Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cpus - default_value: "0" - usage: | - Number of CPUs to allocate to the sandbox (0 = auto: all host CPUs, at most 16 on Linux arm64) - - name: debug - shorthand: D - default_value: "false" - usage: Enable debug logging - - name: deny-network - usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - - name: env - shorthand: e - default_value: '[]' - usage: | - Set an environment variable in the sandbox (can be repeated): KEY=VALUE, or a bare KEY to take the value from the current environment - - name: env-file - default_value: '[]' - usage: | - Read environment variables from a file (can be repeated). --env wins over any file; a later file wins over an earlier one - - name: image-ref - usage: | - OCI image reference for inline-mode cloud create (mutually exclusive with --template; requires --cpus and --memory) - - name: kit - default_value: '[]' - experimental: true - usage: | - Additional kit reference (must be a mixin; directory, ZIP, git, or OCI). Can be specified multiple times - - name: kit-arg - default_value: '[]' - experimental: true - usage: | - Value for an argument the kit declares, as name=value for every kit or kit.name=value for one (can be repeated) - - name: kit-args-file - default_value: '[]' - experimental: true - usage: | - File of name=value kit arguments, one per line (can be repeated); --kit-arg overrides - - name: memory - shorthand: m - usage: | - Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - - name: mount - default_value: '[]' - usage: | - Bind a host directory to a kit host-mount@1 path (can be repeated): HOST:SANDBOX_PATH. Can only be used when creating a new sandbox. - - name: name - usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - - name: no-progress - default_value: "false" - usage: Suppress progress output - - name: on-timeout - usage: | - What happens when --ttl lapses: 'stop' stops the sandbox in place so it can be started again later, 'restart' keeps it running by stopping and immediately starting it, or 'delete' removes it. Omit the flag and the server stops the sandbox when it can be started again later, and deletes it otherwise. With 'restart' a supplied --ttl must be at least 1h (cloud only). - - name: platform - usage: | - Target platform: linux/amd64 or linux/arm64 (cloud only). With --image-ref, omitting it lets the server resolve the platform from the image and the CLI sends the local CPU as a hint for multi-platform images. With --template, omitting it inherits the template platform. With a sandbox kit, the kit's template is built for this platform and cached apart from other platforms; omitting it keeps the server's choice. - - name: publish - shorthand: p - default_value: '[]' - usage: | - Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] - - name: pull - usage: | - Image pull policy (always|missing|never; default: never for saved local snapshots, missing for v3 kit compositions, otherwise always) - - name: skills - usage: | - Shared skills store mode for the agent's skills directory (e.g. ~/.claude/skills): off, readonly (store linked in read-only, directory stays writable), or readwrite (store mounted over it, writes are shared). Default: readonly, or the configured skills.defaultMode setting. - - name: static-mcp - default_value: '[]' - usage: | - MCP server names that form the sandbox's fixed (static) MCP set. Accepts a comma-separated list (--static-mcp notion,atlassian), repeated flags (--static-mcp notion --static-mcp atlassian), or a mix; all forms accumulate into the same set. The set is chosen once at creation time. Local sandboxes take names registered with 'sbx mcp add'. Cloud sandboxes resolve names on the cloud MCP gateway. - - name: template - shorthand: t - usage: | - Container image to use for the sandbox (default: agent-specific image) - - name: ttl - usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - - name: volume - shorthand: v - default_value: '[]' - experimental: true - usage: | - Attach an existing persistent volume, NAME:MOUNTPATH (cloud only, experimental; repeatable) -example: |4- - # Create in the current directory - sbx create cursor . - - # Create with a specific path - sbx create cursor /path/to/project - - # Create with additional read-only workspaces - sbx create cursor . /path/to/docs:ro - - # Create without a workspace bind mount - sbx create cursor - - # Create a cloud sandbox for cursor - sbx --cloud create cursor - - # Create a named cloud sandbox with a mixin baked in - sbx --cloud create --name my-project cursor --kit ./my-mixin/ - - # Create from a template that already exists in the cloud registry - sbx --cloud create -t TEMPLATE -see_also: - - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_create_devin.yaml b/data/sbx_cli/sbx_create_devin.yaml deleted file mode 100644 index 3676ffcbfc..0000000000 --- a/data/sbx_cli/sbx_create_devin.yaml +++ /dev/null @@ -1,156 +0,0 @@ -name: sbx create devin -synopsis: Create a sandbox for devin -description: |- - Create a sandbox with access to a host workspace for devin. - - The workspace path is mounted inside the sandbox at the same path as on the - host. Additional workspaces can be provided as extra arguments. Append ":ro" to - mount them read-only; a read-only argument may name a single file, which holds - that one path out of reach inside a workspace the sandbox can otherwise write. - - Omit the path to create a sandbox without a workspace bind mount: the agent - then works in the container's own filesystem instead of on your files. - - Use "sbx run --name SANDBOX" to attach to the agent after creation. - - With --cloud: - Create a cloud sandbox for devin. - - Cloud sandboxes have no host workspace, so no path follows the agent. Sizing - comes from --cpus and --memory and must land on a billable shape; without them - a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template - must already exist in the cloud registry. - - Cloud sandboxes use cloud network policies. Host network and HTTP policies - do not apply. Set cloud account defaults with - "sbx --cloud policy init ". - - Use "sbx --cloud run --name SANDBOX" to attach to the agent after - creation: cloud needs the agent, since a name alone is not a unique handle. -usage: sbx create devin [PATH...] [flags] -options: - - name: help - shorthand: h - default_value: "false" - usage: help for devin -inherited_options: - - name: allow-network - usage: | - Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - - name: clone - default_value: "false" - usage: | - Run the agent on a private in-container clone of the host Git repository (mounted read-only) instead of bind-mounting the workspace; the agent's commits are accessible via the sandbox- git remote on the host - - name: cloud - default_value: "false" - usage: | - Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cpus - default_value: "0" - usage: | - Number of CPUs to allocate to the sandbox (0 = auto: all host CPUs, at most 16 on Linux arm64) - - name: debug - shorthand: D - default_value: "false" - usage: Enable debug logging - - name: deny-network - usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - - name: env - shorthand: e - default_value: '[]' - usage: | - Set an environment variable in the sandbox (can be repeated): KEY=VALUE, or a bare KEY to take the value from the current environment - - name: env-file - default_value: '[]' - usage: | - Read environment variables from a file (can be repeated). --env wins over any file; a later file wins over an earlier one - - name: image-ref - usage: | - OCI image reference for inline-mode cloud create (mutually exclusive with --template; requires --cpus and --memory) - - name: kit - default_value: '[]' - experimental: true - usage: | - Additional kit reference (must be a mixin; directory, ZIP, git, or OCI). Can be specified multiple times - - name: kit-arg - default_value: '[]' - experimental: true - usage: | - Value for an argument the kit declares, as name=value for every kit or kit.name=value for one (can be repeated) - - name: kit-args-file - default_value: '[]' - experimental: true - usage: | - File of name=value kit arguments, one per line (can be repeated); --kit-arg overrides - - name: memory - shorthand: m - usage: | - Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - - name: mount - default_value: '[]' - usage: | - Bind a host directory to a kit host-mount@1 path (can be repeated): HOST:SANDBOX_PATH. Can only be used when creating a new sandbox. - - name: name - usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - - name: no-progress - default_value: "false" - usage: Suppress progress output - - name: on-timeout - usage: | - What happens when --ttl lapses: 'stop' stops the sandbox in place so it can be started again later, 'restart' keeps it running by stopping and immediately starting it, or 'delete' removes it. Omit the flag and the server stops the sandbox when it can be started again later, and deletes it otherwise. With 'restart' a supplied --ttl must be at least 1h (cloud only). - - name: platform - usage: | - Target platform: linux/amd64 or linux/arm64 (cloud only). With --image-ref, omitting it lets the server resolve the platform from the image and the CLI sends the local CPU as a hint for multi-platform images. With --template, omitting it inherits the template platform. With a sandbox kit, the kit's template is built for this platform and cached apart from other platforms; omitting it keeps the server's choice. - - name: publish - shorthand: p - default_value: '[]' - usage: | - Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] - - name: pull - usage: | - Image pull policy (always|missing|never; default: never for saved local snapshots, missing for v3 kit compositions, otherwise always) - - name: skills - usage: | - Shared skills store mode for the agent's skills directory (e.g. ~/.claude/skills): off, readonly (store linked in read-only, directory stays writable), or readwrite (store mounted over it, writes are shared). Default: readonly, or the configured skills.defaultMode setting. - - name: static-mcp - default_value: '[]' - usage: | - MCP server names that form the sandbox's fixed (static) MCP set. Accepts a comma-separated list (--static-mcp notion,atlassian), repeated flags (--static-mcp notion --static-mcp atlassian), or a mix; all forms accumulate into the same set. The set is chosen once at creation time. Local sandboxes take names registered with 'sbx mcp add'. Cloud sandboxes resolve names on the cloud MCP gateway. - - name: template - shorthand: t - usage: | - Container image to use for the sandbox (default: agent-specific image) - - name: ttl - usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - - name: volume - shorthand: v - default_value: '[]' - experimental: true - usage: | - Attach an existing persistent volume, NAME:MOUNTPATH (cloud only, experimental; repeatable) -example: |4- - # Create in the current directory - sbx create devin . - - # Create with a specific path - sbx create devin /path/to/project - - # Create with additional read-only workspaces - sbx create devin . /path/to/docs:ro - - # Create without a workspace bind mount - sbx create devin - - # Create a cloud sandbox for devin - sbx --cloud create devin - - # Create a named cloud sandbox with a mixin baked in - sbx --cloud create --name my-project devin --kit ./my-mixin/ - - # Create from a template that already exists in the cloud registry - sbx --cloud create -t TEMPLATE -see_also: - - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_create_docker-agent.yaml b/data/sbx_cli/sbx_create_docker-agent.yaml deleted file mode 100644 index 48e55de89f..0000000000 --- a/data/sbx_cli/sbx_create_docker-agent.yaml +++ /dev/null @@ -1,156 +0,0 @@ -name: sbx create docker-agent -synopsis: Create a sandbox for docker-agent -description: |- - Create a sandbox with access to a host workspace for docker-agent. - - The workspace path is mounted inside the sandbox at the same path as on the - host. Additional workspaces can be provided as extra arguments. Append ":ro" to - mount them read-only; a read-only argument may name a single file, which holds - that one path out of reach inside a workspace the sandbox can otherwise write. - - Omit the path to create a sandbox without a workspace bind mount: the agent - then works in the container's own filesystem instead of on your files. - - Use "sbx run --name SANDBOX" to attach to the agent after creation. - - With --cloud: - Create a cloud sandbox for docker-agent. - - Cloud sandboxes have no host workspace, so no path follows the agent. Sizing - comes from --cpus and --memory and must land on a billable shape; without them - a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template - must already exist in the cloud registry. - - Cloud sandboxes use cloud network policies. Host network and HTTP policies - do not apply. Set cloud account defaults with - "sbx --cloud policy init ". - - Use "sbx --cloud run --name SANDBOX" to attach to the agent after - creation: cloud needs the agent, since a name alone is not a unique handle. -usage: sbx create docker-agent [PATH...] [flags] -options: - - name: help - shorthand: h - default_value: "false" - usage: help for docker-agent -inherited_options: - - name: allow-network - usage: | - Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - - name: clone - default_value: "false" - usage: | - Run the agent on a private in-container clone of the host Git repository (mounted read-only) instead of bind-mounting the workspace; the agent's commits are accessible via the sandbox- git remote on the host - - name: cloud - default_value: "false" - usage: | - Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cpus - default_value: "0" - usage: | - Number of CPUs to allocate to the sandbox (0 = auto: all host CPUs, at most 16 on Linux arm64) - - name: debug - shorthand: D - default_value: "false" - usage: Enable debug logging - - name: deny-network - usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - - name: env - shorthand: e - default_value: '[]' - usage: | - Set an environment variable in the sandbox (can be repeated): KEY=VALUE, or a bare KEY to take the value from the current environment - - name: env-file - default_value: '[]' - usage: | - Read environment variables from a file (can be repeated). --env wins over any file; a later file wins over an earlier one - - name: image-ref - usage: | - OCI image reference for inline-mode cloud create (mutually exclusive with --template; requires --cpus and --memory) - - name: kit - default_value: '[]' - experimental: true - usage: | - Additional kit reference (must be a mixin; directory, ZIP, git, or OCI). Can be specified multiple times - - name: kit-arg - default_value: '[]' - experimental: true - usage: | - Value for an argument the kit declares, as name=value for every kit or kit.name=value for one (can be repeated) - - name: kit-args-file - default_value: '[]' - experimental: true - usage: | - File of name=value kit arguments, one per line (can be repeated); --kit-arg overrides - - name: memory - shorthand: m - usage: | - Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - - name: mount - default_value: '[]' - usage: | - Bind a host directory to a kit host-mount@1 path (can be repeated): HOST:SANDBOX_PATH. Can only be used when creating a new sandbox. - - name: name - usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - - name: no-progress - default_value: "false" - usage: Suppress progress output - - name: on-timeout - usage: | - What happens when --ttl lapses: 'stop' stops the sandbox in place so it can be started again later, 'restart' keeps it running by stopping and immediately starting it, or 'delete' removes it. Omit the flag and the server stops the sandbox when it can be started again later, and deletes it otherwise. With 'restart' a supplied --ttl must be at least 1h (cloud only). - - name: platform - usage: | - Target platform: linux/amd64 or linux/arm64 (cloud only). With --image-ref, omitting it lets the server resolve the platform from the image and the CLI sends the local CPU as a hint for multi-platform images. With --template, omitting it inherits the template platform. With a sandbox kit, the kit's template is built for this platform and cached apart from other platforms; omitting it keeps the server's choice. - - name: publish - shorthand: p - default_value: '[]' - usage: | - Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] - - name: pull - usage: | - Image pull policy (always|missing|never; default: never for saved local snapshots, missing for v3 kit compositions, otherwise always) - - name: skills - usage: | - Shared skills store mode for the agent's skills directory (e.g. ~/.claude/skills): off, readonly (store linked in read-only, directory stays writable), or readwrite (store mounted over it, writes are shared). Default: readonly, or the configured skills.defaultMode setting. - - name: static-mcp - default_value: '[]' - usage: | - MCP server names that form the sandbox's fixed (static) MCP set. Accepts a comma-separated list (--static-mcp notion,atlassian), repeated flags (--static-mcp notion --static-mcp atlassian), or a mix; all forms accumulate into the same set. The set is chosen once at creation time. Local sandboxes take names registered with 'sbx mcp add'. Cloud sandboxes resolve names on the cloud MCP gateway. - - name: template - shorthand: t - usage: | - Container image to use for the sandbox (default: agent-specific image) - - name: ttl - usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - - name: volume - shorthand: v - default_value: '[]' - experimental: true - usage: | - Attach an existing persistent volume, NAME:MOUNTPATH (cloud only, experimental; repeatable) -example: |4- - # Create in the current directory - sbx create docker-agent . - - # Create with a specific path - sbx create docker-agent /path/to/project - - # Create with additional read-only workspaces - sbx create docker-agent . /path/to/docs:ro - - # Create without a workspace bind mount - sbx create docker-agent - - # Create a cloud sandbox for docker-agent - sbx --cloud create docker-agent - - # Create a named cloud sandbox with a mixin baked in - sbx --cloud create --name my-project docker-agent --kit ./my-mixin/ - - # Create from a template that already exists in the cloud registry - sbx --cloud create -t TEMPLATE -see_also: - - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_create_gemini.yaml b/data/sbx_cli/sbx_create_gemini.yaml index 0697a2554e..701a317105 100644 --- a/data/sbx_cli/sbx_create_gemini.yaml +++ b/data/sbx_cli/sbx_create_gemini.yaml @@ -4,9 +4,11 @@ description: |- Create a sandbox with access to a host workspace for gemini. The workspace path is mounted inside the sandbox at the same path as on the - host. Additional workspaces can be provided as extra arguments. Append ":ro" to - mount them read-only; a read-only argument may name a single file, which holds - that one path out of reach inside a workspace the sandbox can otherwise write. + host. Additional workspaces can be provided as extra arguments of the form + PATH[:TARGET][:ro]. TARGET is an absolute path inside the sandbox; omit it to + mount PATH at the same path as on the host. Append ":ro" to mount a workspace + read-only; a read-only argument may name a single file, which holds that one + path out of reach inside a workspace the sandbox can otherwise write. Omit the path to create a sandbox without a workspace bind mount: the agent then works in the container's own filesystem instead of on your files. @@ -86,7 +88,7 @@ inherited_options: - name: memory shorthand: m usage: | - Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) + Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: host memory. Warns above 75% of host memory - name: mount default_value: '[]' usage: | @@ -94,6 +96,10 @@ inherited_options: - name: name usage: | Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead - name: no-progress default_value: "false" usage: Suppress progress output @@ -117,7 +123,7 @@ inherited_options: - name: static-mcp default_value: '[]' usage: | - MCP server names that form the sandbox's fixed (static) MCP set. Accepts a comma-separated list (--static-mcp notion,atlassian), repeated flags (--static-mcp notion --static-mcp atlassian), or a mix; all forms accumulate into the same set. The set is chosen once at creation time. Local sandboxes take names registered with 'sbx mcp add'. Cloud sandboxes resolve names on the cloud MCP gateway. + MCP server names that form the sandbox's fixed (static) MCP set. Accepts a comma-separated list (--static-mcp notion,atlassian), repeated flags (--static-mcp notion --static-mcp atlassian), or a mix; all forms accumulate into the same set. Use none for a static set with no servers, local sandboxes only. The set is chosen once at creation time. Local sandboxes take names registered with 'sbx mcp add'. Cloud sandboxes resolve names on the cloud MCP gateway. - name: template shorthand: t usage: | @@ -141,6 +147,9 @@ example: |4- # Create with additional read-only workspaces sbx create gemini . /path/to/docs:ro + # Mount an additional workspace at a chosen path inside the sandbox + sbx create gemini . /path/to/data:/workspace/data + # Create without a workspace bind mount sbx create gemini diff --git a/data/sbx_cli/sbx_create_opencode.yaml b/data/sbx_cli/sbx_create_opencode.yaml deleted file mode 100644 index dea8467b16..0000000000 --- a/data/sbx_cli/sbx_create_opencode.yaml +++ /dev/null @@ -1,156 +0,0 @@ -name: sbx create opencode -synopsis: Create a sandbox for opencode -description: |- - Create a sandbox with access to a host workspace for opencode. - - The workspace path is mounted inside the sandbox at the same path as on the - host. Additional workspaces can be provided as extra arguments. Append ":ro" to - mount them read-only; a read-only argument may name a single file, which holds - that one path out of reach inside a workspace the sandbox can otherwise write. - - Omit the path to create a sandbox without a workspace bind mount: the agent - then works in the container's own filesystem instead of on your files. - - Use "sbx run --name SANDBOX" to attach to the agent after creation. - - With --cloud: - Create a cloud sandbox for opencode. - - Cloud sandboxes have no host workspace, so no path follows the agent. Sizing - comes from --cpus and --memory and must land on a billable shape; without them - a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template - must already exist in the cloud registry. - - Cloud sandboxes use cloud network policies. Host network and HTTP policies - do not apply. Set cloud account defaults with - "sbx --cloud policy init ". - - Use "sbx --cloud run --name SANDBOX" to attach to the agent after - creation: cloud needs the agent, since a name alone is not a unique handle. -usage: sbx create opencode [PATH...] [flags] -options: - - name: help - shorthand: h - default_value: "false" - usage: help for opencode -inherited_options: - - name: allow-network - usage: | - Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - - name: clone - default_value: "false" - usage: | - Run the agent on a private in-container clone of the host Git repository (mounted read-only) instead of bind-mounting the workspace; the agent's commits are accessible via the sandbox- git remote on the host - - name: cloud - default_value: "false" - usage: | - Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cpus - default_value: "0" - usage: | - Number of CPUs to allocate to the sandbox (0 = auto: all host CPUs, at most 16 on Linux arm64) - - name: debug - shorthand: D - default_value: "false" - usage: Enable debug logging - - name: deny-network - usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - - name: env - shorthand: e - default_value: '[]' - usage: | - Set an environment variable in the sandbox (can be repeated): KEY=VALUE, or a bare KEY to take the value from the current environment - - name: env-file - default_value: '[]' - usage: | - Read environment variables from a file (can be repeated). --env wins over any file; a later file wins over an earlier one - - name: image-ref - usage: | - OCI image reference for inline-mode cloud create (mutually exclusive with --template; requires --cpus and --memory) - - name: kit - default_value: '[]' - experimental: true - usage: | - Additional kit reference (must be a mixin; directory, ZIP, git, or OCI). Can be specified multiple times - - name: kit-arg - default_value: '[]' - experimental: true - usage: | - Value for an argument the kit declares, as name=value for every kit or kit.name=value for one (can be repeated) - - name: kit-args-file - default_value: '[]' - experimental: true - usage: | - File of name=value kit arguments, one per line (can be repeated); --kit-arg overrides - - name: memory - shorthand: m - usage: | - Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - - name: mount - default_value: '[]' - usage: | - Bind a host directory to a kit host-mount@1 path (can be repeated): HOST:SANDBOX_PATH. Can only be used when creating a new sandbox. - - name: name - usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - - name: no-progress - default_value: "false" - usage: Suppress progress output - - name: on-timeout - usage: | - What happens when --ttl lapses: 'stop' stops the sandbox in place so it can be started again later, 'restart' keeps it running by stopping and immediately starting it, or 'delete' removes it. Omit the flag and the server stops the sandbox when it can be started again later, and deletes it otherwise. With 'restart' a supplied --ttl must be at least 1h (cloud only). - - name: platform - usage: | - Target platform: linux/amd64 or linux/arm64 (cloud only). With --image-ref, omitting it lets the server resolve the platform from the image and the CLI sends the local CPU as a hint for multi-platform images. With --template, omitting it inherits the template platform. With a sandbox kit, the kit's template is built for this platform and cached apart from other platforms; omitting it keeps the server's choice. - - name: publish - shorthand: p - default_value: '[]' - usage: | - Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] - - name: pull - usage: | - Image pull policy (always|missing|never; default: never for saved local snapshots, missing for v3 kit compositions, otherwise always) - - name: skills - usage: | - Shared skills store mode for the agent's skills directory (e.g. ~/.claude/skills): off, readonly (store linked in read-only, directory stays writable), or readwrite (store mounted over it, writes are shared). Default: readonly, or the configured skills.defaultMode setting. - - name: static-mcp - default_value: '[]' - usage: | - MCP server names that form the sandbox's fixed (static) MCP set. Accepts a comma-separated list (--static-mcp notion,atlassian), repeated flags (--static-mcp notion --static-mcp atlassian), or a mix; all forms accumulate into the same set. The set is chosen once at creation time. Local sandboxes take names registered with 'sbx mcp add'. Cloud sandboxes resolve names on the cloud MCP gateway. - - name: template - shorthand: t - usage: | - Container image to use for the sandbox (default: agent-specific image) - - name: ttl - usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - - name: volume - shorthand: v - default_value: '[]' - experimental: true - usage: | - Attach an existing persistent volume, NAME:MOUNTPATH (cloud only, experimental; repeatable) -example: |4- - # Create in the current directory - sbx create opencode . - - # Create with a specific path - sbx create opencode /path/to/project - - # Create with additional read-only workspaces - sbx create opencode . /path/to/docs:ro - - # Create without a workspace bind mount - sbx create opencode - - # Create a cloud sandbox for opencode - sbx --cloud create opencode - - # Create a named cloud sandbox with a mixin baked in - sbx --cloud create --name my-project opencode --kit ./my-mixin/ - - # Create from a template that already exists in the cloud registry - sbx --cloud create -t TEMPLATE -see_also: - - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_create_shell.yaml b/data/sbx_cli/sbx_create_shell.yaml deleted file mode 100644 index 66eb2ca7df..0000000000 --- a/data/sbx_cli/sbx_create_shell.yaml +++ /dev/null @@ -1,156 +0,0 @@ -name: sbx create shell -synopsis: Create a sandbox for shell -description: |- - Create a sandbox with access to a host workspace for shell. - - The workspace path is mounted inside the sandbox at the same path as on the - host. Additional workspaces can be provided as extra arguments. Append ":ro" to - mount them read-only; a read-only argument may name a single file, which holds - that one path out of reach inside a workspace the sandbox can otherwise write. - - Omit the path to create a sandbox without a workspace bind mount: the agent - then works in the container's own filesystem instead of on your files. - - Use "sbx run --name SANDBOX" to attach to the agent after creation. - - With --cloud: - Create a cloud sandbox for shell. - - Cloud sandboxes have no host workspace, so no path follows the agent. Sizing - comes from --cpus and --memory and must land on a billable shape; without them - a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template - must already exist in the cloud registry. - - Cloud sandboxes use cloud network policies. Host network and HTTP policies - do not apply. Set cloud account defaults with - "sbx --cloud policy init ". - - Use "sbx --cloud run --name SANDBOX" to attach to the agent after - creation: cloud needs the agent, since a name alone is not a unique handle. -usage: sbx create shell [PATH...] [flags] -options: - - name: help - shorthand: h - default_value: "false" - usage: help for shell -inherited_options: - - name: allow-network - usage: | - Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - - name: clone - default_value: "false" - usage: | - Run the agent on a private in-container clone of the host Git repository (mounted read-only) instead of bind-mounting the workspace; the agent's commits are accessible via the sandbox- git remote on the host - - name: cloud - default_value: "false" - usage: | - Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cpus - default_value: "0" - usage: | - Number of CPUs to allocate to the sandbox (0 = auto: all host CPUs, at most 16 on Linux arm64) - - name: debug - shorthand: D - default_value: "false" - usage: Enable debug logging - - name: deny-network - usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - - name: env - shorthand: e - default_value: '[]' - usage: | - Set an environment variable in the sandbox (can be repeated): KEY=VALUE, or a bare KEY to take the value from the current environment - - name: env-file - default_value: '[]' - usage: | - Read environment variables from a file (can be repeated). --env wins over any file; a later file wins over an earlier one - - name: image-ref - usage: | - OCI image reference for inline-mode cloud create (mutually exclusive with --template; requires --cpus and --memory) - - name: kit - default_value: '[]' - experimental: true - usage: | - Additional kit reference (must be a mixin; directory, ZIP, git, or OCI). Can be specified multiple times - - name: kit-arg - default_value: '[]' - experimental: true - usage: | - Value for an argument the kit declares, as name=value for every kit or kit.name=value for one (can be repeated) - - name: kit-args-file - default_value: '[]' - experimental: true - usage: | - File of name=value kit arguments, one per line (can be repeated); --kit-arg overrides - - name: memory - shorthand: m - usage: | - Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - - name: mount - default_value: '[]' - usage: | - Bind a host directory to a kit host-mount@1 path (can be repeated): HOST:SANDBOX_PATH. Can only be used when creating a new sandbox. - - name: name - usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - - name: no-progress - default_value: "false" - usage: Suppress progress output - - name: on-timeout - usage: | - What happens when --ttl lapses: 'stop' stops the sandbox in place so it can be started again later, 'restart' keeps it running by stopping and immediately starting it, or 'delete' removes it. Omit the flag and the server stops the sandbox when it can be started again later, and deletes it otherwise. With 'restart' a supplied --ttl must be at least 1h (cloud only). - - name: platform - usage: | - Target platform: linux/amd64 or linux/arm64 (cloud only). With --image-ref, omitting it lets the server resolve the platform from the image and the CLI sends the local CPU as a hint for multi-platform images. With --template, omitting it inherits the template platform. With a sandbox kit, the kit's template is built for this platform and cached apart from other platforms; omitting it keeps the server's choice. - - name: publish - shorthand: p - default_value: '[]' - usage: | - Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] - - name: pull - usage: | - Image pull policy (always|missing|never; default: never for saved local snapshots, missing for v3 kit compositions, otherwise always) - - name: skills - usage: | - Shared skills store mode for the agent's skills directory (e.g. ~/.claude/skills): off, readonly (store linked in read-only, directory stays writable), or readwrite (store mounted over it, writes are shared). Default: readonly, or the configured skills.defaultMode setting. - - name: static-mcp - default_value: '[]' - usage: | - MCP server names that form the sandbox's fixed (static) MCP set. Accepts a comma-separated list (--static-mcp notion,atlassian), repeated flags (--static-mcp notion --static-mcp atlassian), or a mix; all forms accumulate into the same set. The set is chosen once at creation time. Local sandboxes take names registered with 'sbx mcp add'. Cloud sandboxes resolve names on the cloud MCP gateway. - - name: template - shorthand: t - usage: | - Container image to use for the sandbox (default: agent-specific image) - - name: ttl - usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - - name: volume - shorthand: v - default_value: '[]' - experimental: true - usage: | - Attach an existing persistent volume, NAME:MOUNTPATH (cloud only, experimental; repeatable) -example: |4- - # Create in the current directory - sbx create shell . - - # Create with a specific path - sbx create shell /path/to/project - - # Create with additional read-only workspaces - sbx create shell . /path/to/docs:ro - - # Create without a workspace bind mount - sbx create shell - - # Create a cloud sandbox for shell - sbx --cloud create shell - - # Create a named cloud sandbox with a mixin baked in - sbx --cloud create --name my-project shell --kit ./my-mixin/ - - # Create from a template that already exists in the cloud registry - sbx --cloud create -t TEMPLATE -see_also: - - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_daemon.yaml b/data/sbx_cli/sbx_daemon.yaml index bad973f220..c914f1f951 100644 --- a/data/sbx_cli/sbx_daemon.yaml +++ b/data/sbx_cli/sbx_daemon.yaml @@ -15,6 +15,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx - Manage AI coding agent sandboxes. - sbx daemon log-level - Show or change sandboxd's per-category log levels diff --git a/data/sbx_cli/sbx_daemon_log-level.yaml b/data/sbx_cli/sbx_daemon_log-level.yaml index 5c5a769408..8995c9fd71 100644 --- a/data/sbx_cli/sbx_daemon_log-level.yaml +++ b/data/sbx_cli/sbx_daemon_log-level.yaml @@ -15,6 +15,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx daemon - Manage sandboxd daemon - 'sbx daemon log-level set - Set a category''s log level (target: proxy, general, or all)' diff --git a/data/sbx_cli/sbx_daemon_log-level_set.yaml b/data/sbx_cli/sbx_daemon_log-level_set.yaml index e6ea8e8735..ed94edc9a0 100644 --- a/data/sbx_cli/sbx_daemon_log-level_set.yaml +++ b/data/sbx_cli/sbx_daemon_log-level_set.yaml @@ -15,6 +15,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx daemon log-level set proxy debug diff --git a/data/sbx_cli/sbx_daemon_restart.yaml b/data/sbx_cli/sbx_daemon_restart.yaml index c94e79c7d9..9e1caacc6b 100644 --- a/data/sbx_cli/sbx_daemon_restart.yaml +++ b/data/sbx_cli/sbx_daemon_restart.yaml @@ -15,6 +15,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: ' sbx daemon restart' see_also: - sbx daemon - Manage sandboxd daemon diff --git a/data/sbx_cli/sbx_daemon_start.yaml b/data/sbx_cli/sbx_daemon_start.yaml index c7e2c4a059..2af4d81d62 100644 --- a/data/sbx_cli/sbx_daemon_start.yaml +++ b/data/sbx_cli/sbx_daemon_start.yaml @@ -22,6 +22,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx daemon start diff --git a/data/sbx_cli/sbx_daemon_status.yaml b/data/sbx_cli/sbx_daemon_status.yaml index 4053d7a34b..a2b4780302 100644 --- a/data/sbx_cli/sbx_daemon_status.yaml +++ b/data/sbx_cli/sbx_daemon_status.yaml @@ -20,6 +20,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx daemon status diff --git a/data/sbx_cli/sbx_daemon_stop.yaml b/data/sbx_cli/sbx_daemon_stop.yaml index b003af079f..58114cdc83 100644 --- a/data/sbx_cli/sbx_daemon_stop.yaml +++ b/data/sbx_cli/sbx_daemon_stop.yaml @@ -15,6 +15,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: ' sbx daemon stop' see_also: - sbx daemon - Manage sandboxd daemon diff --git a/data/sbx_cli/sbx_diagnose.yaml b/data/sbx_cli/sbx_diagnose.yaml index a9c8c16c5c..e909ffe6ea 100644 --- a/data/sbx_cli/sbx_diagnose.yaml +++ b/data/sbx_cli/sbx_diagnose.yaml @@ -23,6 +23,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx diagnose diff --git a/data/sbx_cli/sbx_env.yaml b/data/sbx_cli/sbx_env.yaml index 3be78a1ff8..fcfa4f9fb9 100644 --- a/data/sbx_cli/sbx_env.yaml +++ b/data/sbx_cli/sbx_env.yaml @@ -50,6 +50,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx - Manage AI coding agent sandboxes. - sbx env create - Create a sandbox environment from sbxenv.yaml diff --git a/data/sbx_cli/sbx_env_create.yaml b/data/sbx_cli/sbx_env_create.yaml index 360f15c53d..b941891fe3 100644 --- a/data/sbx_cli/sbx_env_create.yaml +++ b/data/sbx_cli/sbx_env_create.yaml @@ -73,6 +73,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Create the environment described in the current directory sbx env create diff --git a/data/sbx_cli/sbx_env_exec.yaml b/data/sbx_cli/sbx_env_exec.yaml index 21b3d2f086..9ef103a990 100644 --- a/data/sbx_cli/sbx_env_exec.yaml +++ b/data/sbx_cli/sbx_env_exec.yaml @@ -3,8 +3,9 @@ synopsis: Execute a command inside a sandbox environment experimental: true description: |- Run COMMAND in the sandbox declared in sbxenv.yaml. The sandbox - must already exist (see "sbx env create" and "sbx env run"); a stopped sandbox is - started first. + is started first if stopped. If it does not exist, an interactive terminal prompts + to create it and approve the environment plan before running COMMAND. Without an + interactive terminal, or with --no-input, create it first with "sbx env create". Arguments before `--` are environment-file paths, following the same rules as the other "sbx env" subcommands: each PATH may be a directory (the file is @@ -81,6 +82,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Run a command in the environment declared in the current directory sbx env exec go test ./... diff --git a/data/sbx_cli/sbx_env_plan.yaml b/data/sbx_cli/sbx_env_plan.yaml index 78e77fec02..890cd00b07 100644 --- a/data/sbx_cli/sbx_env_plan.yaml +++ b/data/sbx_cli/sbx_env_plan.yaml @@ -67,6 +67,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx env plan sbx env plan ./project diff --git a/data/sbx_cli/sbx_env_rm.yaml b/data/sbx_cli/sbx_env_rm.yaml index 5179dfabec..fde629f447 100644 --- a/data/sbx_cli/sbx_env_rm.yaml +++ b/data/sbx_cli/sbx_env_rm.yaml @@ -58,6 +58,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx env rm diff --git a/data/sbx_cli/sbx_env_run.yaml b/data/sbx_cli/sbx_env_run.yaml index ea860c14db..66e75ff31e 100644 --- a/data/sbx_cli/sbx_env_run.yaml +++ b/data/sbx_cli/sbx_env_run.yaml @@ -3,7 +3,7 @@ synopsis: Create (if needed) and attach to a sandbox environment experimental: true description: |- Read the environment file from PATH (default: current directory) - and drop into the sandbox shell. If the sandbox already exists it is started + and launch its agent. If the sandbox already exists it is started and re-attached without re-provisioning; otherwise it is created first (provisioning secrets and bindings) and then attached. @@ -14,11 +14,21 @@ description: |- supplied by --env-arg, plus ${{ env.projectDir }} and ${{ env.fileDir }}. Nothing else is expanded, so a "$" is literal text. + Optional entrypoint and cmd arrays override the agent launch for this environment + only. Omitted or null fields inherit defaults; empty arrays clear + them. Later files replace these arrays rather than concatenate them. Arguments + after -- replace cmd when an override is configured; otherwise they are forwarded + to the agent's saved launcher. No shell expansion is performed on array elements. + Overrides bypass the saved launcher, apply on each env run, and leave env exec, + plain sbx run, the published kit, and the sandbox's PID 1 unchanged. A detached + run starts only the sandbox, not the configured command. Inheriting launch + defaults may require resolving the environment's workload kit again. + A directory PATH selects sbxenv.yaml; a file PATH selects that file. With no PATH, ~/.sbxenv.yaml supplies shared defaults when present. Explicit PATHs skip those defaults. Later files override earlier values; lists such as ports and mcp.servers are concatenated. -usage: sbx env run [PATH...] [flags] +usage: sbx env run [PATH...] [-- ARG...] [flags] options: - name: clone default_value: "false" @@ -78,10 +88,17 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx env run # Start without attaching sbx env run --detach ./project + + # Replace cmd while keeping the configured entrypoint + sbx env run . -- --base HEAD see_also: - sbx env - (Experimental) Manage sandboxes declaratively from an sbxenv.yaml file diff --git a/data/sbx_cli/sbx_exec.yaml b/data/sbx_cli/sbx_exec.yaml index 0fe08e438b..313bf9a20a 100644 --- a/data/sbx_cli/sbx_exec.yaml +++ b/data/sbx_cli/sbx_exec.yaml @@ -57,6 +57,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Open a shell inside a sandbox sbx exec -it my-sandbox bash diff --git a/data/sbx_cli/sbx_kit.yaml b/data/sbx_cli/sbx_kit.yaml index 78a7466acc..d1dffdda97 100644 --- a/data/sbx_cli/sbx_kit.yaml +++ b/data/sbx_cli/sbx_kit.yaml @@ -22,6 +22,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx - Manage AI coding agent sandboxes. - sbx kit add - Add a mixin to a sandbox diff --git a/data/sbx_cli/sbx_kit_add.yaml b/data/sbx_cli/sbx_kit_add.yaml index 4a300e367a..09593d9643 100644 --- a/data/sbx_cli/sbx_kit_add.yaml +++ b/data/sbx_cli/sbx_kit_add.yaml @@ -41,6 +41,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Add a local mixin directory to a sandbox sbx kit add my-sandbox ./mcp-postgres/ diff --git a/data/sbx_cli/sbx_kit_builder.yaml b/data/sbx_cli/sbx_kit_builder.yaml index aa075f69a7..32c6ce058e 100644 --- a/data/sbx_cli/sbx_kit_builder.yaml +++ b/data/sbx_cli/sbx_kit_builder.yaml @@ -24,6 +24,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx kit - (Experimental) Manage kit artifacts - sbx kit builder history - Show kit build history in the builder sandbox diff --git a/data/sbx_cli/sbx_kit_builder_history.yaml b/data/sbx_cli/sbx_kit_builder_history.yaml index 50c15f1512..360ec9ca06 100644 --- a/data/sbx_cli/sbx_kit_builder_history.yaml +++ b/data/sbx_cli/sbx_kit_builder_history.yaml @@ -22,6 +22,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx kit builder - Manage the kit builder sandbox - sbx kit builder history export - Export a kit build record into a bundle diff --git a/data/sbx_cli/sbx_kit_builder_history_export.yaml b/data/sbx_cli/sbx_kit_builder_history_export.yaml index 2e42ae09db..11c5de2850 100644 --- a/data/sbx_cli/sbx_kit_builder_history_export.yaml +++ b/data/sbx_cli/sbx_kit_builder_history_export.yaml @@ -16,6 +16,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: ' sbx kit builder history export 3b6l9x --output build.dockerbuild' see_also: - sbx kit builder history - Show kit build history in the builder sandbox diff --git a/data/sbx_cli/sbx_kit_builder_history_inspect.yaml b/data/sbx_cli/sbx_kit_builder_history_inspect.yaml index f2b65ba659..95d1688bc8 100644 --- a/data/sbx_cli/sbx_kit_builder_history_inspect.yaml +++ b/data/sbx_cli/sbx_kit_builder_history_inspect.yaml @@ -16,6 +16,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # The most recent build sbx kit builder history inspect diff --git a/data/sbx_cli/sbx_kit_builder_history_logs.yaml b/data/sbx_cli/sbx_kit_builder_history_logs.yaml index 1ee5ac5579..8206d42b3e 100644 --- a/data/sbx_cli/sbx_kit_builder_history_logs.yaml +++ b/data/sbx_cli/sbx_kit_builder_history_logs.yaml @@ -16,6 +16,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx kit builder history logs sbx kit builder history logs 3b6l9x diff --git a/data/sbx_cli/sbx_kit_builder_history_ls.yaml b/data/sbx_cli/sbx_kit_builder_history_ls.yaml index d3b6e86d5d..84dda0be22 100644 --- a/data/sbx_cli/sbx_kit_builder_history_ls.yaml +++ b/data/sbx_cli/sbx_kit_builder_history_ls.yaml @@ -16,6 +16,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: ' sbx kit builder history ls' see_also: - sbx kit builder history - Show kit build history in the builder sandbox diff --git a/data/sbx_cli/sbx_kit_builder_history_rm.yaml b/data/sbx_cli/sbx_kit_builder_history_rm.yaml index 07f2d1b42b..0fe596386b 100644 --- a/data/sbx_cli/sbx_kit_builder_history_rm.yaml +++ b/data/sbx_cli/sbx_kit_builder_history_rm.yaml @@ -20,6 +20,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx kit builder history rm 3b6l9x diff --git a/data/sbx_cli/sbx_kit_builder_history_trace.yaml b/data/sbx_cli/sbx_kit_builder_history_trace.yaml index 0d07b30ab2..dda407e84b 100644 --- a/data/sbx_cli/sbx_kit_builder_history_trace.yaml +++ b/data/sbx_cli/sbx_kit_builder_history_trace.yaml @@ -16,6 +16,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx kit builder history trace sbx kit builder history trace 3b6l9x diff --git a/data/sbx_cli/sbx_kit_builder_rm.yaml b/data/sbx_cli/sbx_kit_builder_rm.yaml index 1045dc07f0..eb9a6c9bb3 100644 --- a/data/sbx_cli/sbx_kit_builder_rm.yaml +++ b/data/sbx_cli/sbx_kit_builder_rm.yaml @@ -20,6 +20,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx kit builder rm diff --git a/data/sbx_cli/sbx_kit_builder_status.yaml b/data/sbx_cli/sbx_kit_builder_status.yaml index f5d1d9b60e..8b6accd9d8 100644 --- a/data/sbx_cli/sbx_kit_builder_status.yaml +++ b/data/sbx_cli/sbx_kit_builder_status.yaml @@ -16,6 +16,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: ' sbx kit builder status' see_also: - sbx kit builder - Manage the kit builder sandbox diff --git a/data/sbx_cli/sbx_kit_inspect.yaml b/data/sbx_cli/sbx_kit_inspect.yaml index b5728d9081..0a2715c7d2 100644 --- a/data/sbx_cli/sbx_kit_inspect.yaml +++ b/data/sbx_cli/sbx_kit_inspect.yaml @@ -9,6 +9,9 @@ description: |- Pass --kit-arg to preview how the kit resolves with a given set of arguments; the output shows the substituted content. + --resolved merges the kit's extends: parent into it, so the output is what + sbx applies rather than only what the kit declares. + --offline skips the daemon-backed kit policy (kit.allowedSources, kit.allowLocalKits, kit.requireSignature) so the command needs neither sandboxd nor a signed-in session; it only accepts a local directory or @@ -38,6 +41,9 @@ options: default_value: "false" usage: | Skip the daemon-backed kit policy check; local directory or ZIP references only + - name: resolved + default_value: "false" + usage: 'Merge the kit''s extends: parent into the output' inherited_options: - name: cloud default_value: "false" @@ -47,6 +53,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx kit inspect ./my-kit sbx kit inspect ghcr.io/myorg/my-kit:1.0 @@ -54,6 +64,9 @@ example: |4- # Machine-readable output sbx kit inspect ghcr.io/myorg/my-kit:1.0 --format json + # Show the kit with its extends: parent merged in + sbx kit inspect ./my-kit --resolved --format yaml + # Inspect without sandboxd running or a Docker sign-in sbx kit inspect ./my-kit --offline see_also: diff --git a/data/sbx_cli/sbx_kit_pack.yaml b/data/sbx_cli/sbx_kit_pack.yaml index a24075cccf..fc2fb91e62 100644 --- a/data/sbx_cli/sbx_kit_pack.yaml +++ b/data/sbx_cli/sbx_kit_pack.yaml @@ -23,6 +23,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx kit pack ./my-kit diff --git a/data/sbx_cli/sbx_kit_provenance.yaml b/data/sbx_cli/sbx_kit_provenance.yaml index 8f3fbdbfbb..1bd92ca02e 100644 --- a/data/sbx_cli/sbx_kit_provenance.yaml +++ b/data/sbx_cli/sbx_kit_provenance.yaml @@ -49,6 +49,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Show provenance (unsigned attestations are printed as-is) sbx kit provenance ghcr.io/org/my-kit:1.0 diff --git a/data/sbx_cli/sbx_kit_pull.yaml b/data/sbx_cli/sbx_kit_pull.yaml index 59c29cf943..36357792be 100644 --- a/data/sbx_cli/sbx_kit_pull.yaml +++ b/data/sbx_cli/sbx_kit_pull.yaml @@ -29,6 +29,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx kit pull ghcr.io/myorg/my-kit:1.0 diff --git a/data/sbx_cli/sbx_kit_push.yaml b/data/sbx_cli/sbx_kit_push.yaml index 973600b4d7..87c735ed11 100644 --- a/data/sbx_cli/sbx_kit_push.yaml +++ b/data/sbx_cli/sbx_kit_push.yaml @@ -43,6 +43,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx kit push ./my-kit ghcr.io/myorg/my-kit:1.0 diff --git a/data/sbx_cli/sbx_kit_sign.yaml b/data/sbx_cli/sbx_kit_sign.yaml index 5a5c3f1569..c0ec383ed6 100644 --- a/data/sbx_cli/sbx_kit_sign.yaml +++ b/data/sbx_cli/sbx_kit_sign.yaml @@ -53,6 +53,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Keyless-sign a local kit directory sbx kit sign ./my-kit/ diff --git a/data/sbx_cli/sbx_kit_validate.yaml b/data/sbx_cli/sbx_kit_validate.yaml index 034fabe05a..48cce9637f 100644 --- a/data/sbx_cli/sbx_kit_validate.yaml +++ b/data/sbx_cli/sbx_kit_validate.yaml @@ -48,6 +48,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx kit validate ./my-kit sbx kit validate ./my-kit.zip diff --git a/data/sbx_cli/sbx_kit_verify.yaml b/data/sbx_cli/sbx_kit_verify.yaml index d1f1680a46..5830ae2bca 100644 --- a/data/sbx_cli/sbx_kit_verify.yaml +++ b/data/sbx_cli/sbx_kit_verify.yaml @@ -53,6 +53,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Verify a key-based signature sbx kit verify --key cosign.pub ghcr.io/org/my-kit:1.0 diff --git a/data/sbx_cli/sbx_login.yaml b/data/sbx_cli/sbx_login.yaml index 1269ad0d1e..f50af43b61 100644 --- a/data/sbx_cli/sbx_login.yaml +++ b/data/sbx_cli/sbx_login.yaml @@ -20,6 +20,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx login diff --git a/data/sbx_cli/sbx_logout.yaml b/data/sbx_cli/sbx_logout.yaml index 9af95f3148..d1c7022636 100644 --- a/data/sbx_cli/sbx_logout.yaml +++ b/data/sbx_cli/sbx_logout.yaml @@ -19,6 +19,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx logout diff --git a/data/sbx_cli/sbx_ls.yaml b/data/sbx_cli/sbx_ls.yaml index 1be4d5654e..b3f0024b89 100644 --- a/data/sbx_cli/sbx_ls.yaml +++ b/data/sbx_cli/sbx_ls.yaml @@ -26,6 +26,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx ls diff --git a/data/sbx_cli/sbx_mcp.yaml b/data/sbx_cli/sbx_mcp.yaml index ba01b1da79..98821586a3 100644 --- a/data/sbx_cli/sbx_mcp.yaml +++ b/data/sbx_cli/sbx_mcp.yaml @@ -17,6 +17,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx - Manage AI coding agent sandboxes. - sbx mcp add - Register an MCP server diff --git a/data/sbx_cli/sbx_mcp_add.yaml b/data/sbx_cli/sbx_mcp_add.yaml index 92b3d1352c..f193a6be3a 100644 --- a/data/sbx_cli/sbx_mcp_add.yaml +++ b/data/sbx_cli/sbx_mcp_add.yaml @@ -85,6 +85,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Remote MCP endpoint (OAuth auto-detected) sbx mcp add notion --url https://mcp.notion.com/mcp diff --git a/data/sbx_cli/sbx_mcp_auth.yaml b/data/sbx_cli/sbx_mcp_auth.yaml index 62a2d48f80..02cd1e0b02 100644 --- a/data/sbx_cli/sbx_mcp_auth.yaml +++ b/data/sbx_cli/sbx_mcp_auth.yaml @@ -1,19 +1,20 @@ name: sbx mcp auth synopsis: Authorize MCP servers description: |- - Authorize registered remote MCP servers through the hosted MCP control plane. + Authorize registered MCP servers with OAuth. - Commands use the Docker Hub account from 'sbx login' as the request principal. - User and tenant identity are derived by the control plane; they are not sent in - the request body. + With a local gateway or an OAuth override in the server registration, credentials + are stored locally. Otherwise, the hosted MCP control plane manages them. - Running 'sbx mcp auth ' authorizes or reauthorizes one server. If the - stored credential is expired, sbx asks the control plane to refresh it first and - only falls back to interactive OAuth when refresh needs user consent. + Hosted operations use the Docker Hub account from 'sbx login'. The control plane + derives user and tenant identity; they are not sent in the request body. - Use 'sbx mcp auth status' to inspect hosted credential status without starting - OAuth, and 'sbx mcp auth rm' to remove hosted credentials without removing - local MCP server registrations. + Running 'sbx mcp auth ' authorizes or reauthorizes one server, even if it + already has stored credentials. + + Use 'sbx mcp auth status' to inspect credential status without starting OAuth, + and 'sbx mcp auth rm' to remove credentials without removing local MCP server + registrations. Pass --scope (repeatable) to authorize a specific set of scopes for this run, overriding the default recorded at 'sbx mcp add' time. Precedence is --no-scope > @@ -83,6 +84,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx mcp auth status --all sbx mcp auth status notion diff --git a/data/sbx_cli/sbx_mcp_auth_rm.yaml b/data/sbx_cli/sbx_mcp_auth_rm.yaml index 6567a8d3a5..54d9b9eba0 100644 --- a/data/sbx_cli/sbx_mcp_auth_rm.yaml +++ b/data/sbx_cli/sbx_mcp_auth_rm.yaml @@ -1,7 +1,10 @@ name: sbx mcp auth rm synopsis: Remove MCP server OAuth credentials description: |- - Remove hosted OAuth credentials for registered MCP servers. + Remove OAuth credentials for registered MCP servers. + + With a local gateway or an OAuth override in the server registration, credentials + are stored locally. Otherwise, the hosted MCP control plane manages them. This command does not remove local MCP server registrations. Use 'sbx mcp rm' to remove a registration. @@ -33,6 +36,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx mcp auth rm --all sbx mcp auth rm notion diff --git a/data/sbx_cli/sbx_mcp_auth_status.yaml b/data/sbx_cli/sbx_mcp_auth_status.yaml index 7718e45e96..c979f76331 100644 --- a/data/sbx_cli/sbx_mcp_auth_status.yaml +++ b/data/sbx_cli/sbx_mcp_auth_status.yaml @@ -1,7 +1,10 @@ name: sbx mcp auth status synopsis: Show MCP server OAuth status description: |- - Show hosted OAuth credential status for registered MCP servers. + Show OAuth credential status for registered MCP servers. + + With a local gateway or an OAuth override in the server registration, credentials + are stored locally. Otherwise, the hosted MCP control plane manages them. This command does not start OAuth or refresh expired credentials. usage: sbx mcp auth status [SERVER] [flags] @@ -28,6 +31,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx mcp auth status --all sbx mcp auth status notion diff --git a/data/sbx_cli/sbx_mcp_inspect.yaml b/data/sbx_cli/sbx_mcp_inspect.yaml index b41c704a4d..268a09f0cb 100644 --- a/data/sbx_cli/sbx_mcp_inspect.yaml +++ b/data/sbx_cli/sbx_mcp_inspect.yaml @@ -20,6 +20,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx mcp inspect notion diff --git a/data/sbx_cli/sbx_mcp_load.yaml b/data/sbx_cli/sbx_mcp_load.yaml index cae021dcf2..01eb5471fc 100644 --- a/data/sbx_cli/sbx_mcp_load.yaml +++ b/data/sbx_cli/sbx_mcp_load.yaml @@ -32,6 +32,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Register, then load into the running sandbox 'my-sbx'. sbx mcp add notion --url https://mcp.notion.com/mcp diff --git a/data/sbx_cli/sbx_mcp_ls.yaml b/data/sbx_cli/sbx_mcp_ls.yaml index 73df4c3e8a..06215b073f 100644 --- a/data/sbx_cli/sbx_mcp_ls.yaml +++ b/data/sbx_cli/sbx_mcp_ls.yaml @@ -48,6 +48,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx mcp ls diff --git a/data/sbx_cli/sbx_mcp_rm.yaml b/data/sbx_cli/sbx_mcp_rm.yaml index 4d318ff070..10afe4877e 100644 --- a/data/sbx_cli/sbx_mcp_rm.yaml +++ b/data/sbx_cli/sbx_mcp_rm.yaml @@ -33,6 +33,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx mcp rm notion sbx mcp rm --registration-only notion diff --git a/data/sbx_cli/sbx_mcp_unload.yaml b/data/sbx_cli/sbx_mcp_unload.yaml index ea8c301796..23613bdb37 100644 --- a/data/sbx_cli/sbx_mcp_unload.yaml +++ b/data/sbx_cli/sbx_mcp_unload.yaml @@ -25,6 +25,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Unload the 'notion' server from the running sandbox 'my-sbx'. sbx mcp unload notion --sandbox my-sbx diff --git a/data/sbx_cli/sbx_move.yaml b/data/sbx_cli/sbx_move.yaml index 93e8578b81..d0881e166f 100644 --- a/data/sbx_cli/sbx_move.yaml +++ b/data/sbx_cli/sbx_move.yaml @@ -80,9 +80,8 @@ options: usage: | Destination of the move: 'local' (cloud to local) or 'cloud' (local to cloud) - name: ttl - default_value: 0s usage: | - Time-to-live for the destination cloud sandbox (15s to 24h, e.g. 30m, 2h; only with --to cloud; default: server-side) + Time-to-live for the destination cloud sandbox (15s to 24h, e.g. 30m, 2h; units are case-insensitive; only with --to cloud; default: server-side) inherited_options: - name: cloud default_value: "false" @@ -92,6 +91,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Move a cloud sandbox down to the local host sbx move sbx_abc123 --to local diff --git a/data/sbx_cli/sbx_policy.yaml b/data/sbx_cli/sbx_policy.yaml index a6a76d1a6f..8bf8058a5f 100644 --- a/data/sbx_cli/sbx_policy.yaml +++ b/data/sbx_cli/sbx_policy.yaml @@ -21,6 +21,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx - Manage AI coding agent sandboxes. - sbx policy allow - Add an allow rule for sandboxes diff --git a/data/sbx_cli/sbx_policy_allow.yaml b/data/sbx_cli/sbx_policy_allow.yaml index a28c0aa4cc..fb665b93c7 100644 --- a/data/sbx_cli/sbx_policy_allow.yaml +++ b/data/sbx_cli/sbx_policy_allow.yaml @@ -6,6 +6,16 @@ description: |- Allowed resources are accessible within the selected policy scope. If a resource matches both an allow and a deny rule, the deny rule takes precedence. + + Without --cloud, a rule is refused, and nothing is added, when the same scope + already holds the opposite decision for the same resource on any of the same + protocols (for HTTP rules, the same methods, path, and query constraints). + Remove the existing rule with "sbx policy rm network --id RULE_ID" first, adding + --sandbox SANDBOX if the rule is sandbox-scoped. Rules in different scopes, such + as a global allow and a sandbox-scoped deny, can coexist, and the deny rule + takes precedence. Rules from your organization's policy never cause this + refusal. With --cloud, the new rule replaces the opposite rule in the same scope + instead. usage: sbx policy allow COMMAND options: - name: help @@ -21,6 +31,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx policy - Manage sandbox policies - sbx policy allow network - Allow network access to specified hosts diff --git a/data/sbx_cli/sbx_policy_allow_network.yaml b/data/sbx_cli/sbx_policy_allow_network.yaml index 5129e9f1ad..cd7eb8f787 100644 --- a/data/sbx_cli/sbx_policy_allow_network.yaml +++ b/data/sbx_cli/sbx_policy_allow_network.yaml @@ -17,9 +17,31 @@ description: |- The rule applies globally to all sandboxes by default. Use --sandbox to add the rule to policy "local" scoped to a single sandbox instead. + Without --cloud, a rule is refused, and nothing is added, when the same scope + already holds the opposite decision for the same resource on any of the same + protocols (for HTTP rules, the same methods, path, and query constraints). + Remove the existing rule with "sbx policy rm network --id RULE_ID" first, adding + --sandbox SANDBOX if the rule is sandbox-scoped. Rules in different scopes, such + as a global allow and a sandbox-scoped deny, can coexist, and the deny rule + takes precedence. Rules from your organization's policy never cause this + refusal. With --cloud, the new rule replaces the opposite rule in the same scope + instead. + Use --method to add an HTTP rule. --method accepts comma-separated HTTP methods or ANY; --path defaults to /**. Repeat --query name=value to require query parameters. + + With --cloud: + Allow cloud sandbox network access to the specified hosts. + + A matching deny entry in the same scope is replaced by the allow entry. + + RESOURCES is a comma-separated list of network patterns, such as api.example.com, + *.example.com, 10.0.0.0/8, or api.example.com:443. HTTP method, path, query, and + transport protocol selectors are not supported. + + Rules apply to the account by default. Use --sandbox with a sandbox name or ID + to change one sandbox's policy. Use "sbx --cloud policy ls" to list the rules. usage: sbx policy allow network [--sandbox SANDBOX] RESOURCES [flags] options: - name: help @@ -52,6 +74,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Allow access to a single host (all sandboxes) sbx policy allow network api.example.com @@ -70,5 +96,11 @@ example: |4- # Allow GET and HEAD requests to a path sbx policy allow network api.example.com --method GET,HEAD --path '/v1/**' + + # Allow a host in the account policy + sbx --cloud policy allow network api.example.com + + # Allow a host for one sandbox + sbx --cloud policy allow network --sandbox my-sandbox api.example.com see_also: - sbx policy allow - Add an allow rule for sandboxes diff --git a/data/sbx_cli/sbx_policy_check.yaml b/data/sbx_cli/sbx_policy_check.yaml index 186da045c3..511e353c49 100644 --- a/data/sbx_cli/sbx_policy_check.yaml +++ b/data/sbx_cli/sbx_policy_check.yaml @@ -20,6 +20,11 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx policy - Manage sandbox policies + - sbx policy check http - Check HTTP access to a URL - sbx policy check network - Check network access to a host diff --git a/data/sbx_cli/sbx_policy_check_http.yaml b/data/sbx_cli/sbx_policy_check_http.yaml new file mode 100644 index 0000000000..302f5d91ed --- /dev/null +++ b/data/sbx_cli/sbx_policy_check_http.yaml @@ -0,0 +1,56 @@ +name: sbx policy check http +synopsis: Check HTTP access to a URL +description: |- + Evaluate current policy for an HTTP request to URL. + + URL must be an absolute HTTP or HTTPS URL. The check evaluates network access + first, then evaluates HTTP method, path, and query policy when it applies. It + does not resolve hostnames, make a network request, or account for runtime + transport behavior. Transparent connections that require HTTP authorization are + blocked at runtime, while daemon-managed aliases can be reachable regardless of + the policy result. Results for hostnames do not include policy applied to their + resolved IP addresses. The displayed URL retains the target's host spelling; + with --verbose, Resource shows the normalized host and port evaluated by policy. +usage: sbx policy check http [--sandbox SANDBOX] [--method METHOD] URL [flags] +options: + - name: format + usage: 'Output format: table, json or yaml' + - name: help + shorthand: h + default_value: "false" + usage: help for http + - name: json + default_value: "false" + usage: Output in JSON format + - name: method + default_value: GET + usage: HTTP method to evaluate + - name: sandbox + usage: Evaluate in a specific sandbox policy context + - name: verbose + default_value: "false" + usage: Show the policy action and resource +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead +example: |4- + # Check a GET request + sbx policy check http https://api.example.com/v1/items + + # Check a POST request in a sandbox context + sbx policy check http --sandbox my-sandbox --method POST https://api.example.com/v1/items + + # Check a query-qualified request and output JSON + sbx policy check http --json 'https://api.example.com/search?team=platform' +see_also: + - sbx policy check - Check whether policy allows an access request diff --git a/data/sbx_cli/sbx_policy_check_network.yaml b/data/sbx_cli/sbx_policy_check_network.yaml index f3fc7a3538..718eb76c87 100644 --- a/data/sbx_cli/sbx_policy_check_network.yaml +++ b/data/sbx_cli/sbx_policy_check_network.yaml @@ -24,7 +24,7 @@ options: usage: Evaluate in a specific sandbox policy context - name: verbose default_value: "false" - usage: Show the exact policy request fields + usage: Show the policy action and resource inherited_options: - name: cloud default_value: "false" @@ -34,6 +34,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Check global network policy sbx policy check network api.example.com diff --git a/data/sbx_cli/sbx_policy_deny.yaml b/data/sbx_cli/sbx_policy_deny.yaml index a9a72cd87b..074ffa617b 100644 --- a/data/sbx_cli/sbx_policy_deny.yaml +++ b/data/sbx_cli/sbx_policy_deny.yaml @@ -3,8 +3,21 @@ synopsis: Add a deny rule for sandboxes description: |- Add a rule that blocks sandboxes from accessing specified resources. - Deny rules take precedence over allow rules for the same hostname or CIDR. An - allowed hostname isn't checked against CIDR rules for its resolved IP address. + Deny rules take precedence over allow rules for the same hostname or CIDR. A + direct connection to an allowed hostname is also checked against CIDR rules for + its resolved IP address, and a deny on either takes precedence. Connections + through an upstream proxy that resolves the hostname are checked by hostname + only. + + Without --cloud, a rule is refused, and nothing is added, when the same scope + already holds the opposite decision for the same resource on any of the same + protocols (for HTTP rules, the same methods, path, and query constraints). + Remove the existing rule with "sbx policy rm network --id RULE_ID" first, adding + --sandbox SANDBOX if the rule is sandbox-scoped. Rules in different scopes, such + as a global allow and a sandbox-scoped deny, can coexist, and the deny rule + takes precedence. Rules from your organization's policy never cause this + refusal. With --cloud, the new rule replaces the opposite rule in the same scope + instead. usage: sbx policy deny COMMAND options: - name: help @@ -20,6 +33,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx policy - Manage sandbox policies - sbx policy deny network - Deny network access to specified hosts diff --git a/data/sbx_cli/sbx_policy_deny_network.yaml b/data/sbx_cli/sbx_policy_deny_network.yaml index 672ee4e551..76f98b8d20 100644 --- a/data/sbx_cli/sbx_policy_deny_network.yaml +++ b/data/sbx_cli/sbx_policy_deny_network.yaml @@ -6,16 +6,42 @@ description: |- RESOURCES takes the same forms as "sbx policy allow network": exact domains, wildcard subdomains, IP addresses, and CIDR prefixes, with optional port suffixes. Rules apply to TCP and UDP by default; use --protocol to restrict a - rule to one transport. Deny rules take precedence over allow rules for the - same hostname or CIDR. An allowed hostname isn't checked against CIDR rules - for its resolved IP address. + rule to one transport. + + Deny rules take precedence over allow rules for the same hostname or CIDR. A + direct connection to an allowed hostname is also checked against CIDR rules for + its resolved IP address, and a deny on either takes precedence. Connections + through an upstream proxy that resolves the hostname are checked by hostname + only. The rule applies globally to all sandboxes by default. Use --sandbox to add the rule to policy "local" scoped to a single sandbox instead. + Without --cloud, a rule is refused, and nothing is added, when the same scope + already holds the opposite decision for the same resource on any of the same + protocols (for HTTP rules, the same methods, path, and query constraints). + Remove the existing rule with "sbx policy rm network --id RULE_ID" first, adding + --sandbox SANDBOX if the rule is sandbox-scoped. Rules in different scopes, such + as a global allow and a sandbox-scoped deny, can coexist, and the deny rule + takes precedence. Rules from your organization's policy never cause this + refusal. With --cloud, the new rule replaces the opposite rule in the same scope + instead. + Use --method to add an HTTP rule. --method accepts comma-separated HTTP methods or ANY; --path defaults to /**. Repeat --query name=value to require query parameters. + + With --cloud: + Block cloud sandbox network access to the specified hosts. + + A matching allow entry in the same scope is replaced by the deny entry. + + RESOURCES is a comma-separated list of network patterns, such as api.example.com, + *.example.com, 10.0.0.0/8, or api.example.com:443. HTTP method, path, query, and + transport protocol selectors are not supported. + + Rules apply to the account by default. Use --sandbox with a sandbox name or ID + to change one sandbox's policy. Use "sbx --cloud policy ls" to list the rules. usage: sbx policy deny network [--sandbox SANDBOX] RESOURCES [flags] options: - name: help @@ -48,6 +74,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Block access to a host (all sandboxes) sbx policy deny network ads.example.com @@ -63,5 +93,11 @@ example: |4- # Block POST requests to a path sbx policy deny network api.example.com --method POST --path '/admin/**' + + # Block a host in the account policy + sbx --cloud policy deny network ads.example.com + + # Block a host for one sandbox + sbx --cloud policy deny network --sandbox my-sandbox ads.example.com see_also: - sbx policy deny - Add a deny rule for sandboxes diff --git a/data/sbx_cli/sbx_policy_init.yaml b/data/sbx_cli/sbx_policy_init.yaml index 16bddc6492..4a5e7971a9 100644 --- a/data/sbx_cli/sbx_policy_init.yaml +++ b/data/sbx_cli/sbx_policy_init.yaml @@ -38,6 +38,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Initialize with the balanced policy — recommended sbx policy init balanced diff --git a/data/sbx_cli/sbx_policy_inspect.yaml b/data/sbx_cli/sbx_policy_inspect.yaml index 5b2742d74e..157dd720c6 100644 --- a/data/sbx_cli/sbx_policy_inspect.yaml +++ b/data/sbx_cli/sbx_policy_inspect.yaml @@ -31,6 +31,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Inspect a policy by name sbx policy inspect "Developer access" diff --git a/data/sbx_cli/sbx_policy_log.yaml b/data/sbx_cli/sbx_policy_log.yaml index 9b3e549176..1fe698a697 100644 --- a/data/sbx_cli/sbx_policy_log.yaml +++ b/data/sbx_cli/sbx_policy_log.yaml @@ -33,6 +33,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Show all policy logs sbx policy log diff --git a/data/sbx_cli/sbx_policy_ls.yaml b/data/sbx_cli/sbx_policy_ls.yaml index 3fc5e36aa2..8caf234bca 100644 --- a/data/sbx_cli/sbx_policy_ls.yaml +++ b/data/sbx_cli/sbx_policy_ls.yaml @@ -16,6 +16,13 @@ description: |- Use --include-inactive to show inactive rules for troubleshooting. Use "sbx policy inspect " for full detail on a selected policy or rule. + + With --cloud: + List the cloud network policy's default mode and allow and deny patterns. + + Without SANDBOX, show the account policy. Specify a sandbox name or ID to show + its policy. Cloud rules have no rule IDs; use "sbx --cloud policy rm network" + with --resource to remove a pattern. usage: sbx policy ls [SANDBOX] [flags] options: - name: created-via @@ -59,6 +66,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # List all policies sbx policy ls @@ -86,5 +97,17 @@ example: |4- # Include inactive rules hidden by remote governance sbx policy ls --include-inactive + + # Show the account policy + sbx --cloud policy ls + + # Show one sandbox's policy + sbx --cloud policy ls my-sandbox + + # Output the policy as JSON + sbx --cloud policy ls --format json + + # List only network patterns + sbx --cloud policy ls -q see_also: - sbx policy - Manage sandbox policies diff --git a/data/sbx_cli/sbx_policy_refresh.yaml b/data/sbx_cli/sbx_policy_refresh.yaml index 601cf2e075..aca87c00d9 100644 --- a/data/sbx_cli/sbx_policy_refresh.yaml +++ b/data/sbx_cli/sbx_policy_refresh.yaml @@ -27,6 +27,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: ' sbx policy refresh' see_also: - sbx policy - Manage sandbox policies diff --git a/data/sbx_cli/sbx_policy_reset.yaml b/data/sbx_cli/sbx_policy_reset.yaml index 38352cbf5a..89e7ed12a5 100644 --- a/data/sbx_cli/sbx_policy_reset.yaml +++ b/data/sbx_cli/sbx_policy_reset.yaml @@ -32,6 +32,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Reset policies — prompts if sandboxes are running sbx policy reset diff --git a/data/sbx_cli/sbx_policy_rm.yaml b/data/sbx_cli/sbx_policy_rm.yaml index e0ac4d5cb1..7d2f781bbf 100644 --- a/data/sbx_cli/sbx_policy_rm.yaml +++ b/data/sbx_cli/sbx_policy_rm.yaml @@ -16,6 +16,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx policy - Manage sandbox policies - sbx policy rm network - Remove a network rule diff --git a/data/sbx_cli/sbx_policy_rm_network.yaml b/data/sbx_cli/sbx_policy_rm_network.yaml index 9091ad6c33..99335dd12c 100644 --- a/data/sbx_cli/sbx_policy_rm_network.yaml +++ b/data/sbx_cli/sbx_policy_rm_network.yaml @@ -63,6 +63,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # List rules to find the ID or resource to remove sbx policy ls --wide diff --git a/data/sbx_cli/sbx_ports.yaml b/data/sbx_cli/sbx_ports.yaml index 985cea42c7..fbe67e0514 100644 --- a/data/sbx_cli/sbx_ports.yaml +++ b/data/sbx_cli/sbx_ports.yaml @@ -45,6 +45,7 @@ options: default_value: "false" usage: Output in JSON format - name: publish + shorthand: p default_value: '[]' usage: | Publish a port (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] (local) or SANDBOX_PORT[/tcp] (cloud) @@ -61,6 +62,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # List published ports sbx ports my-sandbox diff --git a/data/sbx_cli/sbx_prune.yaml b/data/sbx_cli/sbx_prune.yaml index ce5df411bd..80ad5c32f1 100644 --- a/data/sbx_cli/sbx_prune.yaml +++ b/data/sbx_cli/sbx_prune.yaml @@ -57,6 +57,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Show what would be removed sbx prune --dry-run diff --git a/data/sbx_cli/sbx_reset.yaml b/data/sbx_cli/sbx_reset.yaml index 2137293367..d47e46f6de 100644 --- a/data/sbx_cli/sbx_reset.yaml +++ b/data/sbx_cli/sbx_reset.yaml @@ -8,7 +8,7 @@ description: |- - Clear image cache - Clear all internal registries - Delete all sandbox state - - Remove all policies + - Remove all local policy rules - Remove the managed SSH configuration - Clear the Gordon assistant's sessions and history - Delete all stored secrets @@ -46,6 +46,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx reset diff --git a/data/sbx_cli/sbx_rm.yaml b/data/sbx_cli/sbx_rm.yaml index 7a0759a307..91b52ca6d8 100644 --- a/data/sbx_cli/sbx_rm.yaml +++ b/data/sbx_cli/sbx_rm.yaml @@ -48,6 +48,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx rm my-sandbox diff --git a/data/sbx_cli/sbx_run.yaml b/data/sbx_cli/sbx_run.yaml index 621d60dbda..db6ed16689 100644 --- a/data/sbx_cli/sbx_run.yaml +++ b/data/sbx_cli/sbx_run.yaml @@ -8,16 +8,18 @@ description: |- directories, ZIP files, git repositories, or OCI references. Relative local references must be explicit paths such as ./my-kit or ../my-kit.zip; bare values retain their agent or sandbox-name meaning. A kit.shortcuts. setting (sbx - settings set kit.shortcuts.claude sbx/claude:latest) makes that agent name + settings set kit.shortcuts.claude myorg/claude:latest) makes that agent name resolve to the configured kit reference instead for local sandboxes; cloud sandboxes ignore it. To re-attach to an existing sandbox by name, use --name; the agent positional is optional when the named sandbox already exists and is read from its spec. Pass agent arguments after the "--" separator. Additional workspaces can be - provided as extra arguments. Append ":ro" to mount them read-only; a read-only - argument may name a single file, which holds that one path out of reach inside a - workspace the sandbox can otherwise write. + provided as extra arguments of the form PATH[:TARGET][:ro]. TARGET is an + absolute path inside the sandbox; omit it to mount PATH at the same path as on + the host. Append ":ro" to mount a workspace read-only; a read-only argument may + name a single file, which holds that one path out of reach inside a workspace + the sandbox can otherwise write. Omit the path to mount the current directory. Pass a path to mount a different workspace. @@ -47,6 +49,10 @@ description: |- --detach is refused, so scripts pass --detach (e.g. sbx --cloud run -d claude && sbx --cloud exec ...). + With --cloud, --env and --env-file only apply when creating a sandbox. + Existing sandboxes keep their original environment; drop these flags to + reattach, or pass --new to create a sandbox with the new values. + Sizing comes from --cpus and --memory and must land on a billable shape; without them a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template must already exist in the cloud registry; the CLI does not upload it. See @@ -109,7 +115,7 @@ options: - name: memory shorthand: m usage: | - Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) + Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: host memory. Warns above 75% of host memory - name: mount default_value: '[]' usage: | @@ -120,6 +126,9 @@ options: default_value: "false" usage: | Always create a new cloud sandbox instead of prompting to reuse an existing one (cloud only) + - name: no-progress + default_value: "false" + usage: Suppress progress output - name: on-timeout usage: | What happens when --ttl lapses: 'stop' stops the sandbox in place so it can be started again later, 'restart' keeps it running by stopping and immediately starting it, or 'delete' removes it. Omit the flag and the server stops the sandbox when it can be started again later, and deletes it otherwise. With 'restart' a supplied --ttl must be at least 1h (cloud only). @@ -143,7 +152,7 @@ options: - name: static-mcp default_value: '[]' usage: | - MCP server names that form the sandbox's fixed (static) MCP set. Accepts a comma-separated list (--static-mcp notion,atlassian), repeated flags (--static-mcp notion --static-mcp atlassian), or a mix; all forms accumulate into the same set. The set is chosen once at creation time and cannot be changed when re-attaching to an existing sandbox. Local sandboxes take names registered with 'sbx mcp add'. Cloud sandboxes resolve names on the cloud MCP gateway. + MCP server names that form the sandbox's fixed (static) MCP set. Accepts a comma-separated list (--static-mcp notion,atlassian), repeated flags (--static-mcp notion --static-mcp atlassian), or a mix; all forms accumulate into the same set. Use none for a static set with no servers, local sandboxes only. The set is chosen once at creation time and cannot be changed when re-attaching to an existing sandbox. Local sandboxes take names registered with 'sbx mcp add'. Cloud sandboxes resolve names on the cloud MCP gateway. - name: template shorthand: t usage: | @@ -157,6 +166,10 @@ options: experimental: true usage: | Attach an existing persistent volume, NAME:MOUNTPATH (cloud only, experimental; repeatable) + - name: workdir + shorthand: w + usage: | + Directory to start the agent session in: absolute, or relative to the sandbox workspace. Applies to this session only, so it works on a re-attach too inherited_options: - name: cloud default_value: "false" @@ -166,6 +179,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Create and run a sandbox with claude in the current directory sbx run claude @@ -182,6 +199,9 @@ example: |4- # Create and run with additional workspaces (read-only) sbx run claude . /path/to/docs:ro + # Mount an additional workspace at a chosen path inside the sandbox + sbx run claude . /path/to/data:/workspace/data + # Re-attach to an existing sandbox by name (agent read from its spec) sbx run --name existing-sandbox diff --git a/data/sbx_cli/sbx_secret.yaml b/data/sbx_cli/sbx_secret.yaml index d4d11e1b0e..dff35e131e 100644 --- a/data/sbx_cli/sbx_secret.yaml +++ b/data/sbx_cli/sbx_secret.yaml @@ -29,6 +29,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx - Manage AI coding agent sandboxes. - sbx secret import - Import secrets detected in host environment variables diff --git a/data/sbx_cli/sbx_secret_import.yaml b/data/sbx_cli/sbx_secret_import.yaml index 2da741a363..2b5eed0c06 100644 --- a/data/sbx_cli/sbx_secret_import.yaml +++ b/data/sbx_cli/sbx_secret_import.yaml @@ -47,6 +47,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Walk every detected env var, prompting before each import sbx secret import diff --git a/data/sbx_cli/sbx_secret_ls.yaml b/data/sbx_cli/sbx_secret_ls.yaml index 5edfbc9786..02e5a137c1 100644 --- a/data/sbx_cli/sbx_secret_ls.yaml +++ b/data/sbx_cli/sbx_secret_ls.yaml @@ -37,6 +37,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # List all secrets sbx secret ls diff --git a/data/sbx_cli/sbx_secret_rm.yaml b/data/sbx_cli/sbx_secret_rm.yaml index 75211af4fb..04a3c5a493 100644 --- a/data/sbx_cli/sbx_secret_rm.yaml +++ b/data/sbx_cli/sbx_secret_rm.yaml @@ -31,6 +31,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Choose an existing secret to remove with the arrow keys sbx secret rm diff --git a/data/sbx_cli/sbx_secret_set-custom.yaml b/data/sbx_cli/sbx_secret_set-custom.yaml index 0c1a7ebaaf..fe5096bf7c 100644 --- a/data/sbx_cli/sbx_secret_set-custom.yaml +++ b/data/sbx_cli/sbx_secret_set-custom.yaml @@ -25,7 +25,7 @@ description: |- dependencies, or confine their execution. Helpers and any code or configuration they load must remain outside writable sandbox mounts. Explicit paths into shared workspaces and broad mounts exposing host configuration or the host temporary - directory remain unsafe, including mounts added later with sbx mount. + directory remain unsafe, including mounts added to a running sandbox later. With --cloud, --host takes exact DNS names only (no IP addresses or wildcards) and the proxy sets --header on requests to those hosts instead of substituting @@ -76,6 +76,9 @@ options: usage: 'Secret value (less secure: visible in shell history)' - name: value usage: 'Secret value (less secure: visible in shell history)' + - name: value-stdin + default_value: "false" + usage: Read the secret value from stdin inherited_options: - name: cloud default_value: "false" @@ -85,6 +88,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Create a global custom secret. A unique placeholder is generated automatically. # The sandbox env var API_KEY is set to the placeholder value; outbound requests @@ -102,5 +109,8 @@ example: |4- # Custom placeholder with {rand} suffix; the CLI prints the generated value. sbx secret set-custom --host api.example.com --placeholder sk-{rand} --value secret123 + + # Read the value from stdin to keep it out of shell history and the process list. + printf '%s' "$API_KEY" | sbx secret set-custom --host api.example.com --env API_KEY --value-stdin see_also: - sbx secret - Manage stored secrets diff --git a/data/sbx_cli/sbx_secret_set.yaml b/data/sbx_cli/sbx_secret_set.yaml index 311b04c771..9d9fa41dea 100644 --- a/data/sbx_cli/sbx_secret_set.yaml +++ b/data/sbx_cli/sbx_secret_set.yaml @@ -28,7 +28,7 @@ description: |- dependencies, or confine their execution. Helpers and any code or configuration they load must remain outside writable sandbox mounts. Explicit paths into shared workspaces and broad mounts exposing host configuration or the host temporary - directory remain unsafe, including mounts added later with sbx mount. + directory remain unsafe, including mounts added to a running sandbox later. ### Registry credentials @@ -55,7 +55,8 @@ options: - name: force shorthand: f default_value: "false" - usage: Overwrite an existing secret when --token is used + usage: | + Overwrite existing API-key, OAuth, or registry credentials without confirmation - name: help shorthand: h default_value: "false" @@ -102,6 +103,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Store a GitHub token globally (available to all sandboxes) sbx secret set github diff --git a/data/sbx_cli/sbx_settings.yaml b/data/sbx_cli/sbx_settings.yaml index 8cd0d8d1df..66689d2d3d 100644 --- a/data/sbx_cli/sbx_settings.yaml +++ b/data/sbx_cli/sbx_settings.yaml @@ -24,6 +24,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx - Manage AI coding agent sandboxes. - sbx settings get - Get the value of a setting diff --git a/data/sbx_cli/sbx_settings_get.yaml b/data/sbx_cli/sbx_settings_get.yaml index 0f946ff78a..fd38443632 100644 --- a/data/sbx_cli/sbx_settings_get.yaml +++ b/data/sbx_cli/sbx_settings_get.yaml @@ -25,6 +25,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Get a setting value sbx settings get proxy.daemon diff --git a/data/sbx_cli/sbx_settings_ls.yaml b/data/sbx_cli/sbx_settings_ls.yaml index 35edf79352..d0cc609589 100644 --- a/data/sbx_cli/sbx_settings_ls.yaml +++ b/data/sbx_cli/sbx_settings_ls.yaml @@ -35,6 +35,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # List settings as a table sbx settings ls diff --git a/data/sbx_cli/sbx_settings_set.yaml b/data/sbx_cli/sbx_settings_set.yaml index 574d40a6cb..d8ebd1fd42 100644 --- a/data/sbx_cli/sbx_settings_set.yaml +++ b/data/sbx_cli/sbx_settings_set.yaml @@ -24,6 +24,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Route sandbox, daemon, and CLI egress through an upstream proxy sbx settings set proxy http://proxy.example.com:3128 diff --git a/data/sbx_cli/sbx_settings_unset.yaml b/data/sbx_cli/sbx_settings_unset.yaml index d7a1be65cb..3b54d6f12c 100644 --- a/data/sbx_cli/sbx_settings_unset.yaml +++ b/data/sbx_cli/sbx_settings_unset.yaml @@ -20,6 +20,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Remove the override for a setting sbx settings unset proxy.daemon diff --git a/data/sbx_cli/sbx_setup.yaml b/data/sbx_cli/sbx_setup.yaml index 8d3d5e857b..1efef9c29c 100644 --- a/data/sbx_cli/sbx_setup.yaml +++ b/data/sbx_cli/sbx_setup.yaml @@ -25,6 +25,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx - Manage AI coding agent sandboxes. - sbx setup ssh - Set up SSH client config for the sandbox endpoint diff --git a/data/sbx_cli/sbx_setup_ssh.yaml b/data/sbx_cli/sbx_setup_ssh.yaml index 31f621311f..4d7d8818d7 100644 --- a/data/sbx_cli/sbx_setup_ssh.yaml +++ b/data/sbx_cli/sbx_setup_ssh.yaml @@ -32,6 +32,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx setup ssh ssh my-sandbox.sbx -- echo hello diff --git a/data/sbx_cli/sbx_setup_ssh_remove.yaml b/data/sbx_cli/sbx_setup_ssh_remove.yaml index eba80dab2e..cf15d91f5d 100644 --- a/data/sbx_cli/sbx_setup_ssh_remove.yaml +++ b/data/sbx_cli/sbx_setup_ssh_remove.yaml @@ -16,6 +16,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: ' sbx setup ssh remove' see_also: - sbx setup ssh - Set up SSH client config for the sandbox endpoint diff --git a/data/sbx_cli/sbx_skills.yaml b/data/sbx_cli/sbx_skills.yaml index c0de7e4cd9..0dba42822b 100644 --- a/data/sbx_cli/sbx_skills.yaml +++ b/data/sbx_cli/sbx_skills.yaml @@ -28,6 +28,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx - Manage AI coding agent sandboxes. - sbx skills add - Add skills from a Git repository diff --git a/data/sbx_cli/sbx_skills_add.yaml b/data/sbx_cli/sbx_skills_add.yaml index f9eee5676e..e9e8ea9470 100644 --- a/data/sbx_cli/sbx_skills_add.yaml +++ b/data/sbx_cli/sbx_skills_add.yaml @@ -36,6 +36,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx skills add https://github.com/anthropics/skills --skill frontend-design sbx skills add anthropics/skills --skill frontend-design --skill pdf diff --git a/data/sbx_cli/sbx_skills_import.yaml b/data/sbx_cli/sbx_skills_import.yaml index cf266c5eac..7cbcda4775 100644 --- a/data/sbx_cli/sbx_skills_import.yaml +++ b/data/sbx_cli/sbx_skills_import.yaml @@ -38,6 +38,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx skills import diff --git a/data/sbx_cli/sbx_skills_ls.yaml b/data/sbx_cli/sbx_skills_ls.yaml index ef3ffe6c74..42f899b04d 100644 --- a/data/sbx_cli/sbx_skills_ls.yaml +++ b/data/sbx_cli/sbx_skills_ls.yaml @@ -26,6 +26,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx skills ls diff --git a/data/sbx_cli/sbx_skills_rm.yaml b/data/sbx_cli/sbx_skills_rm.yaml index 629ea47dc5..ec341131fe 100644 --- a/data/sbx_cli/sbx_skills_rm.yaml +++ b/data/sbx_cli/sbx_skills_rm.yaml @@ -25,6 +25,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx skills rm my-skill diff --git a/data/sbx_cli/sbx_skills_update.yaml b/data/sbx_cli/sbx_skills_update.yaml index 824c388eb7..73b28b9bee 100644 --- a/data/sbx_cli/sbx_skills_update.yaml +++ b/data/sbx_cli/sbx_skills_update.yaml @@ -22,6 +22,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Update every skill added from a repository sbx skills update diff --git a/data/sbx_cli/sbx_stop.yaml b/data/sbx_cli/sbx_stop.yaml index 2c0234ac03..2769ee6090 100644 --- a/data/sbx_cli/sbx_stop.yaml +++ b/data/sbx_cli/sbx_stop.yaml @@ -38,6 +38,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx stop my-sandbox diff --git a/data/sbx_cli/sbx_template.yaml b/data/sbx_cli/sbx_template.yaml index 04e508c64c..cf7313fc71 100644 --- a/data/sbx_cli/sbx_template.yaml +++ b/data/sbx_cli/sbx_template.yaml @@ -28,6 +28,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx - Manage AI coding agent sandboxes. - sbx template inspect - Show template details diff --git a/data/sbx_cli/sbx_template_inspect.yaml b/data/sbx_cli/sbx_template_inspect.yaml index a3fd49a634..a803bc2a38 100644 --- a/data/sbx_cli/sbx_template_inspect.yaml +++ b/data/sbx_cli/sbx_template_inspect.yaml @@ -27,6 +27,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx --cloud template inspect my-template sbx --cloud template inspect tmpl_abc123 diff --git a/data/sbx_cli/sbx_template_load.yaml b/data/sbx_cli/sbx_template_load.yaml index 2857b18814..6cb3a5a5f1 100644 --- a/data/sbx_cli/sbx_template_load.yaml +++ b/data/sbx_cli/sbx_template_load.yaml @@ -20,7 +20,7 @@ description: |- Use --capture-mode disk for a filesystem snapshot, or all to capture memory, disk, and the microVM checkpoint for faster resume. -usage: sbx template load FILE [NAME] [flags] +usage: sbx template load FILE [flags] options: - name: capture-mode default_value: disk @@ -49,6 +49,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Load an image from a tar file sbx template load /tmp/myimage.tar # Linux/macOS diff --git a/data/sbx_cli/sbx_template_ls.yaml b/data/sbx_cli/sbx_template_ls.yaml index 91e0f69030..095f6107d9 100644 --- a/data/sbx_cli/sbx_template_ls.yaml +++ b/data/sbx_cli/sbx_template_ls.yaml @@ -26,6 +26,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # List all template images sbx template ls diff --git a/data/sbx_cli/sbx_template_rm.yaml b/data/sbx_cli/sbx_template_rm.yaml index c9a890038c..df4ccb25d1 100644 --- a/data/sbx_cli/sbx_template_rm.yaml +++ b/data/sbx_cli/sbx_template_rm.yaml @@ -34,6 +34,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Remove by tag sbx template rm myimage:v1.0 diff --git a/data/sbx_cli/sbx_template_save.yaml b/data/sbx_cli/sbx_template_save.yaml index 20ad4a3a23..7a7ca0cc33 100644 --- a/data/sbx_cli/sbx_template_save.yaml +++ b/data/sbx_cli/sbx_template_save.yaml @@ -4,6 +4,9 @@ description: |- Save a sandbox snapshot as a template in the local image store. Use --pull never when creating a sandbox from the saved template. + The image the sandbox was created from must still be in the local image + store. If it was removed, restore it first, for example with sbx template load. + Use --output to export a tar file for loading on another host with sbx template load. @@ -43,6 +46,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Save as a template for new sandboxes on this host sbx template save my-sandbox myimage:v1.0 diff --git a/data/sbx_cli/sbx_ttl.yaml b/data/sbx_cli/sbx_ttl.yaml index 10b79eb665..b9b4041d25 100644 --- a/data/sbx_cli/sbx_ttl.yaml +++ b/data/sbx_cli/sbx_ttl.yaml @@ -35,6 +35,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- # Show the remaining TTL sbx --cloud ttl my-sandbox diff --git a/data/sbx_cli/sbx_tui.yaml b/data/sbx_cli/sbx_tui.yaml index da672af284..e30d6f6ad0 100644 --- a/data/sbx_cli/sbx_tui.yaml +++ b/data/sbx_cli/sbx_tui.yaml @@ -15,6 +15,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: ' sbx tui' see_also: - sbx - Manage AI coding agent sandboxes. diff --git a/data/sbx_cli/sbx_version.yaml b/data/sbx_cli/sbx_version.yaml index ac3f47eb5d..2be0c184cc 100644 --- a/data/sbx_cli/sbx_version.yaml +++ b/data/sbx_cli/sbx_version.yaml @@ -20,6 +20,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: |4- sbx version diff --git a/data/sbx_cli/sbx_volume.yaml b/data/sbx_cli/sbx_volume.yaml index dc37137738..514c91ed19 100644 --- a/data/sbx_cli/sbx_volume.yaml +++ b/data/sbx_cli/sbx_volume.yaml @@ -24,6 +24,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead see_also: - sbx - Manage AI coding agent sandboxes. - sbx volume create - Create a new persistent volume diff --git a/data/sbx_cli/sbx_volume_create.yaml b/data/sbx_cli/sbx_volume_create.yaml index fe3de350db..9ee44cf570 100644 --- a/data/sbx_cli/sbx_volume_create.yaml +++ b/data/sbx_cli/sbx_volume_create.yaml @@ -25,6 +25,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: ' sbx --cloud volume create my-cache' see_also: - sbx volume - Manage persistent volumes (cloud-only) diff --git a/data/sbx_cli/sbx_volume_inspect.yaml b/data/sbx_cli/sbx_volume_inspect.yaml index a699476126..1a54faa89d 100644 --- a/data/sbx_cli/sbx_volume_inspect.yaml +++ b/data/sbx_cli/sbx_volume_inspect.yaml @@ -20,6 +20,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: ' sbx --cloud volume inspect my-cache' see_also: - sbx volume - Manage persistent volumes (cloud-only) diff --git a/data/sbx_cli/sbx_volume_ls.yaml b/data/sbx_cli/sbx_volume_ls.yaml index 2e54111355..a94496fa07 100644 --- a/data/sbx_cli/sbx_volume_ls.yaml +++ b/data/sbx_cli/sbx_volume_ls.yaml @@ -24,6 +24,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: ' sbx --cloud volume ls' see_also: - sbx volume - Manage persistent volumes (cloud-only) diff --git a/data/sbx_cli/sbx_volume_rm.yaml b/data/sbx_cli/sbx_volume_rm.yaml index efa599f5b3..d014cc6ce8 100644 --- a/data/sbx_cli/sbx_volume_rm.yaml +++ b/data/sbx_cli/sbx_volume_rm.yaml @@ -29,6 +29,10 @@ inherited_options: shorthand: D default_value: "false" usage: Enable debug logging + - name: no-input + default_value: "false" + usage: | + Never prompt; commands that need an answer fail with the command to run instead example: ' sbx --cloud volume rm my-cache' see_also: - sbx volume - Manage persistent volumes (cloud-only)