@tangle-network/sandbox-cli 0.9.2-develop.20260626160426.615563e → 0.9.2

package/README.md

@@ -30,7 +30,9 @@ npx @tangle-network/sandbox-cli sandbox list
 npx tangle-sandbox --help
 ```
 
-Never run bare `npx tangle` (or `npx tangle-cli`) — those npm names belong to unrelated third-party packages and would execute someone else's code. The official names are `@tangle-network/sandbox-cli` and its forwarding alias `tangle-sandbox`.
+Never run bare `npx tangle` (or `npx tangle-cli`).
+Those npm names belong to unrelated third-party packages and would execute someone else's code.
+The official names are `@tangle-network/sandbox-cli` and its forwarding alias `tangle-sandbox`.
 
 Install globally to expose the short `tangle` binary on PATH:
 
@@ -56,14 +58,13 @@ Three flows are supported:
 
 - **Browser login** (default): `tangle auth login` opens a browser to complete OAuth with `github`, `google`, or `microsoft` identity providers.
 - **Device code**: `tangle auth login --no-browser` for headless environments.
-- **API key**: `tangle auth login --api-key sk-tan-...` (or set `TANGLE_API_KEY`; `SANDBOX_API_KEY` accepted as deprecated alias).
+- **API key**: `tangle auth login --api-key sk-tan-...` (or set `TANGLE_API_KEY`).
 
 Credential lookup precedence:
 
 1. `--api-key` flag
-2. `TANGLE_API_KEY` environment variable (preferred)
-3. `SANDBOX_API_KEY` environment variable (deprecated alias, accepted for backwards compatibility)
-4. `~/.tangle/credentials` (populated by `tangle auth login`)
+2. `TANGLE_API_KEY` environment variable
+3. `~/.tangle/credentials` (populated by `tangle auth login`)
 
 Common commands:
 
@@ -86,10 +87,12 @@ Top-level command groups:
 - `exec`
 - `ssh`
 - `agent`
+- `fleet`
 - `snapshot`
 - `usage`
 - `permissions`
 - `backend`
+- `batch`
 - `process`
 - `fs`
 
@@ -100,7 +103,7 @@ Examples:
 tangle auth login --api-key sk_...
 
 # sandbox lifecycle
-tangle sandbox create --name my-box --image node:20 --ssh
+tangle sandbox create --name my-box --environment node:20 --ssh
 tangle sandbox list
 tangle sandbox get sbx_123
 tangle sandbox stop sbx_123
@@ -111,13 +114,23 @@ tangle sandbox delete sbx_123
 tangle exec sbx_123 "npm test"
 tangle ssh sbx_123
 tangle agent prompt sbx_123 "Summarize this repo"
-tangle agent task sbx_123 "Fix the failing tests"
+tangle agent prompt sbx_123 "Fix the failing tests"
+tangle fleet create --count 4 --coordinator
 
 # grant hub connections to the agent (see hub-reference.md for the 3 modes).
 # the connection is an id or a provider name (resolved via `tangle hub connections`).
-tangle agent task sbx_123 "triage issues" \
-  --connection github:github.issues.listIssues,github.issues.create
-tangle agent task sbx_123 "file the report" --connection github:* --allow-writes
+tangle agent prompt sbx_123 "triage issues" \
+  --connection github:github.issues.search,github.issues.create
+tangle agent prompt sbx_123 "file the report" --connection github:* --allow-writes
+
+# temporary GPU for an eval; omitted provider picks the cheapest configured cloud
+tangle sandbox gpu run sbx_123 \
+  --accelerator-kind nvidia-3090 \
+  --accelerator-memory 24000 \
+  --max-spend-usd 1 \
+  --max-lifetime 900 \
+  --idle-timeout 120 \
+  -- python eval.py
 
 # state and operations
 tangle secret list
@@ -127,18 +140,90 @@ tangle fs ls sbx_123 /workspace
 ```
 
 Hub commands (`tangle hub …`) and `tangle agent --connection` auto-mint a
-short-lived platform Hub key from your `tangle auth login` session — no separate
+short-lived platform Hub key from your `tangle auth login` session, with no separate
 key needed. See [`hub-reference.md`](./hub-reference.md) for the `--connection`
 grant modes, `--allow-writes`, and `permissions revert-writes`.
 
+## Temporary GPUs
+
+Keep the base sandbox cheap and attach a GPU only while the accelerated command runs.
+Omit `--provider` to let Tangle choose the cheapest configured GPU cloud.
+Always set a spend cap and lifetime.
+
+```bash
+# Attach, run one command, and destroy the lease.
+tangle sandbox gpu run sbx_123 \
+  --accelerator-kind nvidia-3090 \
+  --accelerator-memory 24000 \
+  --max-spend-usd 1 \
+  --max-lifetime 900 \
+  --idle-timeout 120 \
+  -- python eval.py
+```
+
+For multiple GPU commands, use the manual lifecycle:
+
+```bash
+tangle sandbox gpu attach sbx_123 \
+  --accelerator-kind nvidia-3090 \
+  --accelerator-memory 24000 \
+  --max-spend-usd 1 \
+  --max-lifetime 900 \
+  --idle-timeout 120
+
+tangle sandbox gpu list sbx_123
+tangle sandbox gpu exec sbx_123 gpu_abc -- python eval.py
+tangle sandbox gpu detach sbx_123 gpu_abc
+```
+
+Create-time GPU flags are a shortcut over the same lease lifecycle:
+
+```bash
+tangle sandbox create --name gpu-eval \
+  --accelerator-kind nvidia-3090 \
+  --accelerator-memory 24000 \
+  --gpu-max-spend-usd 1 \
+  --gpu-max-lifetime 900 \
+  --gpu-idle-timeout 120
+```
+
+The final detach output includes billed seconds and customer cost.
+Use `tangle usage` to inspect account-level GPU seconds and GPU spend.
+
+## Batch Runs
+
+Run each task against one explicitly named backend:
+
+```bash
+tangle batch run --tasks tasks.json --backend primary=opencode
+```
+
+`tasks.json` is an array of `{ "id": "...", "message": "..." }` objects or an object with a `tasks` array.
+At least one `--backend <id=type>` is required with `--tasks` or `--task`.
+
+Repeat `--backend <id=type>` to run every task against multiple backends:
+
+```bash
+tangle batch run --tasks tasks.json \
+  --backend writer=opencode \
+  --backend reviewer=claude-code \
+  --stream
+```
+
+Backend IDs must be unique and use 1 to 128 letters, numbers, dots, underscores, or hyphens.
+Use `--model provider/model` only when one backend is selected.
+Each result is identified by both `taskId` and `backendId`.
+JSON output reports `totalTasks`, `totalBackends`, `totalExecutions`, `totalSuccess`, `totalFailure`, `totalRetries`, and `successRate`.
+
+Use `--request <file.json>` when each backend needs its own model, profile, server, or lifecycle configuration.
+The file uses the same complete request shape as the TypeScript SDK and cannot be combined with inline task or backend flags.
+
 ## Provisioning Coverage
 
-`tangle sandbox create` exposes the full SDK provisioning surface, including image/environment, resources (CPU, memory, disk), lifetime and idle timeout, driver and backend selection (`opencode`, `claude-code`, `codex`, `cursor`, `amp`, and other registry backends), SSH and web terminal, env and secret injection, metadata, initial permissions, git clone, tool pre-install, BYOS3 storage, snapshot restore, and outbound network controls. Run `tangle sandbox create --help` for the canonical flag list.
+`tangle sandbox create` supports environments or container images, resources, temporary GPU leases, lifecycle limits, driver and backend selection, SSH and web terminal, environment variables, secrets, metadata, git clone, BYOS3 storage, and snapshot restore.
+Use the `tools`, `permissions`, `network`, and `expose` commands after creation.
+Run `tangle sandbox create --help` for the current flag list.
 
 ## Limitations
 
 - `snapshot restore` creates a new sandbox from a snapshot; the command signature suggests in-place restore.
-
-## Design Follow-Up
-
-For the architecture review, parity checklist, and auth flow spec, see [CHECKLIST.md](./CHECKLIST.md).

package/SKILL.md

@@ -1,13 +1,14 @@
 ---
 name: tangle-cli
-description: Use when interacting with Tangle sandboxes, executing hub tools, managing agent tasks, operating on sandbox filesystems, building workflows, connecting to external providers, or setting up integrations and automations from a terminal. Triggers include tangle, tangle sandbox, tangle hub, tangle agent, tangle exec, tangle fs, tangle snapshot, tangle secret, tangle workflows, tangle hub connect, github, slack, google, microsoft, external connections, provider integrations, hub tools, or any tangle command.
+description: Use Tangle Sandbox CLI for lifecycle, prompts, files, fleets, Hub tools, and integrations.
 ---
 
 # Tangle CLI
 
 ## Overview
 
-`tangle` is the CLI for Tangle Sandbox operations — create sandboxes, run agents, execute hub tools, manage files, secrets, snapshots, git, and more. All commands support `--help` for inline reference.
+`tangle` is the CLI for Tangle Sandbox operations: create sandboxes, run agents, execute hub tools, and manage files, secrets, snapshots, and git.
+All commands support `--help` for inline reference.
 
 ## Auth
 
@@ -16,7 +17,7 @@ Generic command auth modes, resolved in order:
 | Priority | Source | Set via |
 |----------|--------|--------|
 | 1 | CLI flag | `--api-key <key>` |
-| 2 | Env var | `TANGLE_API_KEY` or `SANDBOX_API_KEY` |
+| 2 | Env var | `TANGLE_API_KEY` |
 | 3 | Profile store | `tangle auth login` (keychain or file) |
 
 Hub commands resolve auth in this order:
@@ -25,10 +26,11 @@ Hub commands resolve auth in this order:
 |----------|--------|--------|
 | 1 | CLI flag | `--api-key <key>` |
 | 2 | Hub capability | `TANGLE_HUB_CAPABILITY_TOKEN` |
-| 3 | Env var | `TANGLE_API_KEY` or `SANDBOX_API_KEY` |
+| 3 | Env var | `TANGLE_API_KEY` |
 | 4 | Profile store | `tangle auth login` (keychain or file) |
 
-**Inside a sandbox:** `tangle` is automatically authenticated. No extra auth needed — commands work out of the box.
+**Inside a sandbox:** `tangle` is automatically authenticated.
+No extra authentication is needed.
 
 ```bash
 # Browser login (preferred)
@@ -48,7 +50,7 @@ tangle auth login --profile work
 tangle auth profiles use work
 ```
 
-For hub env auth, set **exactly one** of `TANGLE_API_KEY`/`SANDBOX_API_KEY` or `TANGLE_HUB_CAPABILITY_TOKEN`.
+For hub env auth, set **exactly one** of `TANGLE_API_KEY` or `TANGLE_HUB_CAPABILITY_TOKEN`.
 
 ## Sandbox Lifecycle
 
@@ -67,7 +69,45 @@ tangle sandbox expose <id> --port 3000
 tangle sandbox urls <id>
 ```
 
-## Hub — Full Workflow
+## Temporary GPUs
+
+Use a normal sandbox first, then attach a GPU only for the work that needs it.
+Omit `--provider` to use the cheapest configured GPU cloud.
+Always set a spend cap and lifetime.
+
+```bash
+# One-shot eval: attach GPU, run command, always destroy the lease.
+tangle sandbox gpu run <sandbox-id> \
+  --accelerator-kind nvidia-3090 \
+  --accelerator-memory 24000 \
+  --max-spend-usd 1 \
+  --max-lifetime 900 \
+  --idle-timeout 120 \
+  -- python eval.py
+
+# Manual lifecycle when the agent needs multiple GPU commands.
+tangle sandbox gpu attach <sandbox-id> \
+  --accelerator-kind nvidia-3090 \
+  --accelerator-memory 24000 \
+  --max-spend-usd 1 \
+  --max-lifetime 900 \
+  --idle-timeout 120
+tangle sandbox gpu exec <sandbox-id> <gpu-lease-id> -- python eval.py
+tangle sandbox gpu detach <sandbox-id> <gpu-lease-id>
+```
+
+For fleets, put the same GPU lease cap on every worker:
+
+```bash
+tangle fleet create --count 4 \
+  --accelerator-kind nvidia-3090 \
+  --accelerator-memory 24000 \
+  --gpu-max-spend-usd 1 \
+  --gpu-max-lifetime 900 \
+  --gpu-idle-timeout 120
+```
+
+## Full Hub Workflow
 
 Hub lets agents use connected provider tools (GitHub, etc.) through Tangle without seeing provider OAuth tokens.
 
@@ -98,17 +138,17 @@ tangle hub tools sources --json
 tangle hub tools search "github issues" --provider github --json
 
 # Describe a tool to see input/output schemas
-tangle hub tools describe github.issues.listIssues --json
+tangle hub tools describe github.issues.search --json
 ```
 
 ### Tool Execution
 
-Two equivalent commands — `call` and `exec`:
+Two equivalent commands are available: `call` and `exec`.
 
 ```bash
 # Basic call: <path tokens...> <json-input>
-tangle hub call github issues listIssues '{"owner":"tangle-network","repo":"agent-dev-container"}'
-tangle hub exec github.issues.listIssues '{"owner":"tangle-network","repo":"agent-dev-container"}'
+tangle hub call github issues search '{"q":"repo:tangle-network/agent-dev-container is:issue"}'
+tangle hub exec github.issues.search '{"q":"repo:tangle-network/agent-dev-container is:issue"}'
 
 # With explicit connection
 tangle hub call github issues createIssue '{"owner":"foo","repo":"bar","title":"Fix bug"}' --connection conn_xxx
@@ -116,7 +156,8 @@ tangle hub call github issues createIssue '{"owner":"foo","repo":"bar","title":"
 
 ### Policy & Approvals
 
-Tools default to `ask` policy — they pause and require approval on first use.
+Tools default to the `ask` policy.
+They pause and require approval on first use.
 
 ```bash
 # List pending approvals
@@ -125,7 +166,7 @@ tangle hub approvals approve <approval-id>
 tangle hub approvals deny <approval-id>
 
 # Set policy to always allow (skip future approvals)
-tangle hub permissions set --connection conn_xxx --action github.issues.listIssues --decision allow
+tangle hub permissions set --connection conn_xxx --action github.issues.search --decision allow
 
 # Set policy to always deny (block tool)
 tangle hub permissions set --connection conn_xxx --action github.issues.deleteIssue --decision deny
@@ -172,20 +213,14 @@ tangle secret update DATABASE_URL "new-value"
 tangle secret delete DATABASE_URL
 ```
 
-## Snapshots & Checkpoints
+## Snapshots
 
 ```bash
-# Snapshots (point-in-time for cloning/restoring)
 tangle snapshot create <sandbox-id>
 tangle snapshot list <sandbox-id>
 tangle snapshot restore <sandbox-id> <snapshot-id>   # creates new sandbox
 tangle snapshot revert <sandbox-id> <snapshot-id>    # reverts in-place
 tangle snapshot delete <sandbox-id> <snapshot-id>
-
-# Checkpoints (lightweight, local)
-tangle checkpoint create <id>
-tangle checkpoint list|ls <id>
-tangle checkpoint delete|rm <id> <checkpoint-id>
 ```
 
 ## Templates
@@ -221,14 +256,65 @@ tangle team invitations [team]  # List pending/historical invitations
 
 ## Workflows
 
+Authenticate with the `sk-tan-*` API key (`TANGLE_API_KEY`), same as the other
+platform commands, not a hub capability token. These commands address the
+platform control plane, not the sandbox API. The host resolves from
+`--base-url`, then `TANGLE_HUB_URL` (which a spawned sandbox injects to name
+its own hub, so it wins over an ambient value), then `TANGLE_PLATFORM_URL`,
+then `https://id.tangle.tools`. On `workflows`,
+`--base-url` names the PLATFORM host — unlike `tangle keys`, where `--base-url`
+is the sandbox API and `--platform-url` is the platform.
+
+Authoring a workflow (graph topology, guards, joins, KV state, decisions):
+https://sandbox.tangle.tools/docs/workflows
+
 ```bash
 tangle workflows validate workflow.yml
 tangle workflows schema              # print JSON Schema
 tangle workflows create workflow.yml
+tangle workflows apply workflow.yml  # create or update, matched by the definition's name
 tangle workflows list
+tangle workflows fleet               # run tallies over a trailing window, failing first
 tangle workflows get <id>
 tangle workflows update <id> workflow.yml
+tangle workflows enable <id>
+tangle workflows disable <id>
 tangle workflows delete <id>
+
+# Templates
+tangle workflows templates                                   # starter gallery
+tangle workflows init <template-id>                          # instantiate, print YAML
+tangle workflows init <template-id> --param repo=o/r --file workflow.yml
+
+# Revisions
+tangle workflows revisions <id>          # definition history
+tangle workflows revision <id> <rev>     # one revision's YAML
+tangle workflows rollback <id> <rev>     # restore a rev as the new head
+
+# Runs
+tangle workflows run <id>                                   # trigger a run
+tangle workflows run <id> --input pull_request.number=123   # with trigger inputs
+tangle workflows run <id> --wait                            # wait + print result
+tangle workflows runs <id>                                  # run history
+tangle workflows run-detail <id> <runId>                    # single-run detail
+tangle workflows events <id> <runId>                        # tail live progress
+tangle workflows cancel <id> <runId>                        # cancel a queued/running run
+tangle workflows retry <id> <runId>                         # re-run a failed run with the same trigger context
+
+# Cross-run KV state
+tangle workflows kv list <id>
+tangle workflows kv get <id> <key>
+tangle workflows kv set <id> <key> '{"cursor":123}'
+tangle workflows kv set <id> <key> '{"cursor":123}' --cas 4   # compare-and-swap
+tangle workflows kv delete <id> <key>
+
+# Run artifacts
+tangle workflows artifacts <id> <runId>
+tangle workflows artifact-download <id> <runId> <artifactId> --out report.json
+
+# Human decisions
+tangle workflows decisions <id>                              # pending approvals
+tangle workflows decision-resolve <id> <runId> --choice deploy
 ```
 
 ## Other Commands
@@ -257,6 +343,7 @@ tangle tools install <id> python 3.12
 
 # Batch tasks across sandboxes
 tangle batch run --tasks tasks.json
+tangle batch run --tasks tasks.json --backend writer=opencode --backend reviewer=claude-code --stream
 
 # Intelligence reports
 tangle intelligence sandbox <id>
@@ -286,22 +373,23 @@ tangle permissions add <sandboxId> --userId <userId> --role editor
 
 | Goal | Commands |
 |------|----------|
-| Spin up sandbox, run agent | `tangle sandbox create --name X` → `tangle agent task <id> "..."` |
-| Connect GitHub, read issues | `tangle hub connect github` → `tangle hub tools search "issues" --provider github` → `tangle hub call github issues listIssues '{"owner":"X","repo":"Y"}'` |
+| Spin up sandbox, run agent | `tangle sandbox create --name X` → `tangle agent prompt <id> "..."` |
+| Connect GitHub, read issues | `tangle hub connect github` → `tangle hub tools search "issues" --provider github` → `tangle hub call github issues search '{"q":"repo:X/Y is:issue"}'` |
 | Push code from sandbox to GitHub | `tangle hub connect github` → `tangle git add <id> files` → `tangle git commit <id> -m "msg"` → `tangle git push <id>` |
 | Save and restore state | `tangle snapshot create <id>` → ...work... → `tangle snapshot revert <id> <snap-id>` |
 | Set secret for agent use | `tangle secret create GITHUB_TOKEN "..."` → agent reads via `process.env.GITHUB_TOKEN` |
 | Set hub permissions | `tangle hub permissions set --connection conn_xxx --action github.issues.createIssue --decision allow` |
-| Batch parallel agent tasks | `tangle batch run --tasks tasks.json` (array of `{sandboxId, message}`) |
+| Batch parallel agent prompts | `tangle batch run --tasks tasks.json --backend primary=opencode` (array of `{id, message}`) |
+| Compare backends on the same tasks | `tangle batch run --tasks tasks.json --backend writer=opencode --backend reviewer=claude-code --stream` |
 
 ## Common Mistakes
 
-- **Forgetting `--reveal` on `secret show`** — values are hidden by default for safety.
-- **Using API-key env and `TANGLE_HUB_CAPABILITY_TOKEN` together for hub** — set exactly one env auth source, or use `--api-key` to override both.
-- **Calling hub tools without `--approve` on first use** — use `--approve` or set policy to `allow` first.
-- **Missing `--json` flag when piping output** — many commands need explicit `--json` for machine-readable output.
-- **`tangle hub exec` vs `tangle exec`** — `hub exec` runs hub tools; `exec` runs shell commands in a sandbox.
-- **`hub resume` doesn't replay** — after `hub resume --accept`, rerun original `hub exec` with `--approve`.
+- **Forgetting `--reveal` on `secret show`:** values are hidden by default for safety.
+- **Using API-key env and `TANGLE_HUB_CAPABILITY_TOKEN` together for hub:** set exactly one env auth source, or use `--api-key` to override both.
+- **Calling hub tools without `--approve` on first use:** use `--approve` or set policy to `allow` first.
+- **Missing `--json` when piping output:** many commands need explicit `--json` for machine-readable output.
+- **`tangle hub exec` vs `tangle exec`:** `hub exec` runs hub tools; `exec` runs shell commands in a sandbox.
+- **`hub resume` does not replay:** after `hub resume --accept`, rerun the original `hub exec` with `--approve`.
 
 ## Token Safety