Reference
Operations reference
Look up every public management, runtime, and observability operation.
On this page+−
This page lists the public semantic catalog only. Run help OPERATION on the matching CLI for argument descriptions, defaults, and verified examples.
Management operations
Prefix: sandbox-manager-cli
| Operation | Arguments | Purpose | Manuals |
|---|---|---|---|
create_sandbox | --image IMAGE --workspace-bind-root PATH [--count N] | Create one or more host-side sandbox records and runtimes. | CLI · MCP |
list_docker_images | None | List local Docker image references. | CLI · MCP |
list_workspace_directories | [--path PATH] | List picker-visible roots or immediate subdirectories. | CLI · MCP |
destroy_sandbox | --sandbox-id ID | Stop the daemon, destroy the runtime, and remove the record. | CLI · MCP |
list_sandboxes | None | List manager-known sandbox records and lifecycle state. | CLI · MCP |
inspect_sandbox | --sandbox-id ID | Inspect one sandbox record and endpoint metadata. | CLI · MCP |
squash_layerstacks | --sandbox-id ID | Compact eligible layers and remount live sessions. | CLI · MCP |
export_changes | --sandbox-id ID --dest PATH [--format dir|tar|tar-zst] | Apply or archive every published layer above the base. | CLI · MCP |
Runtime command operations
Prefix: sandbox-runtime-cli --sandbox-id ID
| Operation | Arguments | Purpose | Manuals |
|---|---|---|---|
exec_command | [--workspace-session-id ID] [--timeout-ms N] [--yield-time-ms N] COMMAND | Start a shell command in an existing or automatic workspace session. | CLI · MCP |
write_command_stdin | --command-session-id ID [--yield-time-ms N] TEXT | Append text to a running command stdin. | CLI · MCP |
read_command_lines | --command-session-id ID [--start-offset N] [--limit N] | Read rendered transcript rows by stable line offset. | CLI · MCP |
Runtime file operations
Prefix: sandbox-runtime-cli --sandbox-id ID
| Operation | Arguments | Purpose | Manuals |
|---|---|---|---|
file_read | --path FILE [--offset N] [--limit N] [--workspace-session-id ID] | Read UTF-8 lines from the snapshot or a live session. | CLI · MCP |
file_write | --path FILE --content TEXT [--workspace-session-id ID] | Overwrite a file and publish or keep it session-private. | CLI · MCP |
file_edit | --path FILE --edits JSON [--workspace-session-id ID] | Apply ordered exact-string replacements. | CLI · MCP |
file_blame | --path FILE | Show per-line ownership for a published file. | CLI · MCP |
Observability operations
Prefix: sandbox-observability-cli
| Operation | Arguments | Purpose | Manuals |
|---|---|---|---|
snapshot | [--sandbox-id ID] | Read one live snapshot or aggregate every ready sandbox. | CLI · MCP |
trace | --sandbox-id ID [--trace-id TRACE|last] | Render one trace as a span waterfall. | CLI · MCP |
events | --sandbox-id ID [--name NAME] [--since-ms MS] [--last-n N] | List newest-first domain events across traces. | CLI · MCP |
cgroup | --sandbox-id ID [--scope SCOPE] [--window-ms MS] | Read sandbox resource or workspace disk time series. | CLI · MCP |
layerstack | --sandbox-id ID [--workspace-id WS] [--window-ms MS] | Inspect live layer leases, bookings, and trends. | CLI · MCP |
HTTP-only exception
file_list is deliberately not in the CLI or MCP runtime catalog. It is available only as POST /files/list on the daemon HTTP listener and through the console proxy POST /api/sandboxes/<id>/files/list. Optional JSON fields are path, workspace_session_id, and limit.
Excluded internal operations
Workspace creation, capture, teardown, remount, LayerStack export, and export-chunk reads are internal coordination routes. They are intentionally absent here. Use exec_command automatic sessions and the public export_changes manager operation instead.
See Web console for the distinction between authenticated gateway RPC and the narrow daemon HTTP allowlist.