npm - ghostdock - Versions diffs - 0.0.19 → 0.1.0 - Mend

ghostdock 0.0.19 → 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/cli-reference.md DELETED Viewed

@@ -1,1714 +0,0 @@
-# ghostdock CLI reference
-<!-- Generated by `bun run sync:cli-reference` from the CLI's command tree. Do not edit. -->
-Every command the `ghostdock` CLI ships, with its full description and flags.
-For how to install, log in and choose an organization, read [cli.md](cli.md). Concepts and
-workflows are in the built-in skills (`ghostdock skills list`).
-Binaries: `ghostdock`, `gdock`.
-Global flag `--base-url`: API origin (overrides GHOSTDOCK_BASE_URL and the built-in default).
-Global flag `--json`: Print the result as one JSON document on stdout, for scripts and agents. Without it, output is for people.
-## `ghostdock apps`
-Published apps of an organization.
-### `ghostdock apps list`
-List the live published apps (sites) of an organization, with their URLs. Each app has a siteId to pass to sites unpublish.
-```
-ghostdock apps list [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `apps_list`.
-## `ghostdock docker`
-Docker over the private network: a sandbox's Docker engine from this machine.
-### `ghostdock docker context`
-Point Docker at a sandbox's Docker engine over the private network: plain `docker` and `docker compose` then run there. Creates (or updates) the Docker context ghostdock-<org>-<sandbox> for tcp://<sandbox>.<org>.ghostdock.internal:2376 with a client certificate of this machine's device, and makes it the current context. Needs `ghostdock network connect` first, and Docker's CLI. The certificate lives 30 days; `network connect` and this command renew it with 10 days left. An expired certificate fails Docker's TLS handshake with Docker's own error: run this command again. Docker's `no such host` on a ghostdock.internal address means this machine is not connected: run `ghostdock network connect`. After an organization rename the old name stops resolving: run it again to update the host.
-```
-ghostdock docker context <sandbox> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox>` | Sandbox name, from `network ls`. Required. |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-| `--use` | Make it the current Docker context (`docker context use`). `--no-use` only creates or updates it. Default: `true`. |
-## `ghostdock env`
-Manage organization environment variables and secrets.
-### `ghostdock env delete`
-Delete a variable or secret.
-```
-ghostdock env delete <name> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<name>` | Environment variable name. Required. |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-MCP tool: `env_delete`.
-### `ghostdock env get`
-Print one variable value in full (secrets cannot be read).
-```
-ghostdock env get <name> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<name>` | Environment variable name. Required. |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-MCP tool: `env_get`.
-### `ghostdock env list`
-List variables and secrets.
-```
-ghostdock env list [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-MCP tool: `env_list`.
-### `ghostdock env set`
-Create or replace a variable or secret.
-```
-ghostdock env set <name> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<name>` | Environment variable name. Required. |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-| `--value <value>` | Value to store. |
-| `--value-stdin` | Read the value from stdin — keeps secrets out of shell history. |
-| `--secret` | Shorthand for --kind secret. Required when creating a secret. |
-| `--kind <value>` | variable or secret. Required when creating; on an update, omit to keep the existing kind or pass the other to convert. |
-| `--comment <value>` | Note about what this value is for. |
-MCP tool: `env_set`.
-## `ghostdock images`
-Organization image catalog: OCI bookmarks, Dockerfiles and Compose files.
-### `ghostdock images add`
-Bookmark an OCI image ref in the organization’s image catalog. Fails if it is already bookmarked.
-```
-ghostdock images add --ref <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--ref <string>` | OCI image reference, e.g. ghcr.io/acme/app:latest. Required. |
-| `--label <string>` | Display label for the bookmark. Optional. |
-MCP tool: `images_add`.
-### `ghostdock images add-compose`
-Add a Compose project to the organization’s image catalog. Give its files, or a reference: a Compose project published as an OCI artifact (oci://…), used through include: with an optional override. ghostdock.* service labels (of the files, or of the override) become its manifest. Fails if the name is taken.
-```
-ghostdock images add-compose --name <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--name <string>` | Image name, unique in the organization. Required. |
-| `--files <object>` | Compose files by file name. Must include docker-compose.yml/yaml or compose.yml/yaml. (JSON object) |
-| `--reference <string>` | A published Compose project instead of files, e.g. oci://docker.io/ghostdockhq/headless-compose:ubuntu-26.04. |
-| `--override <string>` | With reference: a Compose file merged into it (services, environment, labels). |
-MCP tool: `images_add_compose`.
-### `ghostdock images add-dockerfile`
-Add a Dockerfile to the organization’s image catalog. ghostdock.* LABEL lines become its manifest. Fails if the name is taken.
-```
-ghostdock images add-dockerfile --name <string> --dockerfile <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--name <string>` | Image name, unique in the organization. Required. |
-| `--dockerfile <string>` | Dockerfile text. ghostdock.* LABEL lines become the image manifest. Required. |
-MCP tool: `images_add_dockerfile`.
-### `ghostdock images get`
-Get one catalog image with its spec, manifest and requirements. Returns kind, spec and a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps. An OCI bookmark’s manifest is null: its labels are read at create time.
-```
-ghostdock images get <image-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<image-id>` | Catalog image id, from images list or images get. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `images_get`.
-### `ghostdock images list`
-List the images an organization can boot sandboxes from. OCI bookmarks, images add-dockerfile and images add-compose rows, and refs its sandboxes use. A discovery catalog, not an allowlist: sandboxes create accepts any OCI ref. Items carry sandboxCount and a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps. An OCI bookmark stores no labels (manifest null): sandboxes create reads them from the digest the ref names then.
-```
-ghostdock images list [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `images_list`.
-### `ghostdock images remove`
-Remove an image from the organization’s catalog. Sandboxes already using it are not affected.
-```
-ghostdock images remove <image-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<image-id>` | Catalog image id, from images list or images get. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `images_remove`.
-### `ghostdock images update-compose`
-Replace a catalog Compose image’s files, reference, override and/or name. Re-parses its labels.
-```
-ghostdock images update-compose <image-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<image-id>` | Catalog image id, from images list or images get. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--files <object>` | New Compose files by file name. Omit to keep the current files. (JSON object) |
-| `--reference <string>` | A new reference (oci://…): the image becomes a Compose reference. |
-| `--override <string>` | A reference’s new override; null removes it. |
-| `--name <string>` | New image name. Omit to keep it. |
-MCP tool: `images_update_compose`.
-### `ghostdock images update-dockerfile`
-Replace a catalog Dockerfile, optionally renaming it. Re-parses its ghostdock.* labels.
-```
-ghostdock images update-dockerfile <image-id> --dockerfile <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<image-id>` | Catalog image id, from images list or images get. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--dockerfile <string>` | Dockerfile text. ghostdock.* LABEL lines become the image manifest. Required. |
-| `--name <string>` | New image name. Omit to keep it. |
-MCP tool: `images_update_dockerfile`.
-## `ghostdock login`
-Sign in and store a device access token for this machine (~/.config/ghostdock/credentials.json).
-```
-ghostdock login [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--wait` | Poll until the login is approved in the browser (default timeout 5 minutes). |
-| `--code <value>` | Redeem the one-time paste code shown in the browser instead of polling. |
-| `--timeout <value>` | Max seconds to poll when using --wait (default 300). |
-| `--org <value>` | Set this organization (id or slug) as the default once logged in. |
-## `ghostdock logout`
-Revoke the device session and remove stored credentials.
-```
-ghostdock logout
-```
-## `ghostdock network`
-The private network: reach your sandboxes by address and name from this machine.
-### `ghostdock network connect`
-Put this machine into the private network through one provider: WireGuard and split DNS. The organization (--org, else the default) becomes this machine's short-name organization. Also re-arms a paused device: with the tunnel up and nothing changed, without sudo.
-```
-ghostdock network connect [provider] [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<provider>` | Sandbox provider name or id. Omit for the organization's default provider (else the platform default). Only its sandboxes are reachable; connecting through another replaces the connection. |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-### `ghostdock network devices`
-Your devices in the private network.
-```
-ghostdock network devices <command>
-```
-### `ghostdock network devices remove`
-Remove one of your devices from the private network.
-```
-ghostdock network devices remove <id>
-```
-| Argument | Description |
-| --- | --- |
-| `<id>` | Device id, from `network devices`. Required. |
-### `ghostdock network disconnect`
-Take this machine out of the private network, and remove split DNS an earlier connection left (macOS).
-```
-ghostdock network disconnect
-```
-### `ghostdock network ls`
-Sandboxes of an organization with their private addresses and names, and which are reachable through the current connection.
-```
-ghostdock network ls [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-### `ghostdock network status`
-Whether this machine is connected, through which provider, and as which device.
-```
-ghostdock network status
-```
-## `ghostdock organizations`
-Organizations you belong to.
-### `ghostdock organizations current`
-Show which organization commands use, and where it comes from.
-```
-ghostdock organizations current [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <value>` | Check what this --org would resolve to. |
-### `ghostdock organizations list`
-List the organizations you belong to, with their ids and slugs.
-```
-ghostdock organizations list
-```
-MCP tool: `organizations_list`.
-### `ghostdock organizations use`
-Set the default organization for commands run without --org (in every directory).
-```
-ghostdock organizations use [org] [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<org>` | Organization id or slug. |
-| `--clear` | Remove the default organization. |
-## `ghostdock projects`
-Deployable projects, their deployments and environment.
-### `ghostdock projects create`
-Create an empty project. Nothing is deployed until projects publish.
-```
-ghostdock projects create --display-name <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--display-name <string>` | Project name. Required. |
-MCP tool: `projects_create`.
-### `ghostdock projects deployments`
-Deployments of a project.
-### `ghostdock projects deployments get`
-Get one deploy attempt, with links to its stored files. fileUrls are authenticated GET paths for source.zip and generated Compose files.
-```
-ghostdock projects deployments get <deployment-id> --project-id <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<deployment-id>` | Deployment id, from projects deployments list. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--project-id <string>` | Project id, from projects list (projects publish returns it too). Required. |
-MCP tool: `projects_deployments_get`.
-### `ghostdock projects deployments list`
-List a project’s deploy attempts, newest first.
-```
-ghostdock projects deployments list <project-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `projects_deployments_list`.
-### `ghostdock projects env`
-Environment a project exports.
-### `ghostdock projects env delete`
-Delete one of a project’s own variables or secrets.
-```
-ghostdock projects env delete <name> --project-id <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--project-id <string>` | Project id, from projects list (projects publish returns it too). Required. |
-MCP tool: `projects_env_delete`.
-### `ghostdock projects env get`
-Get a project’s stored environment. Local entries (secret values withheld), organization opt-ins and bindings, applied on every deploy.
-```
-ghostdock projects env get <project-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `projects_env_get`.
-### `ghostdock projects env select`
-Replace the organization entries a project exports. Full replace: environment is the whole list ([] clears it), and omitting bindings clears the remaps. Read the environment skill (`ghostdock skills get environment`).
-```
-ghostdock projects env select <project-id> --environment <array> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--environment <array>` | Organization catalogue entry names to export under their own names. (JSON array) Required. |
-| `--bindings <array>` | Slot-centric org bindings. Omit to clear existing remaps. (JSON array) |
-MCP tool: `projects_env_select`.
-### `ghostdock projects env set`
-Create or replace one of a project’s own variables or secrets. Prefer the CLI for secret values so they stay out of the conversation.
-```
-ghostdock projects env set <name> --project-id <string> --value <string> --kind <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--project-id <string>` | Project id, from projects list (projects publish returns it too). Required. |
-| `--value <string>` | The value to store. A secret value can be replaced later but never read back. Required. |
-| `--kind <string>` | "variable" or "secret". A secret value can be replaced but never read back. Required. |
-| `--comment <string>` | Optional note shown with the entry, e.g. what it is for. |
-MCP tool: `projects_env_set`.
-### `ghostdock projects get`
-Get a project with its latest attempt and live deployment. latestDeploymentId includes failures; liveDeploymentId / liveUrl is the success that serves the public URL.
-```
-ghostdock projects get <project-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `projects_get`.
-### `ghostdock projects list`
-List an organization’s projects. A project owns its environment, deployment history and live URL. apps list lists live URLs instead.
-```
-ghostdock projects list [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `projects_list`.
-### `ghostdock projects publish`
-Inspect local source with the deploy agent and publish to the CDN or a sandbox.
-```
-ghostdock projects publish [path] [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-| `--project-id <value>` | Existing project id. Omit to create a project. |
-| `--replan` | Force a new planner run even when the stored spec still matches. |
-| `--require-verify` | Fail the deploy (verify_failed) when detected tests fail. Default false: tests still run and are reported. |
-| `--spec <value>` | JSON DeploymentSpec to execute on a fresh sandbox instead of planning. Mutually exclusive with --replan. |
-| `--display-name <value>` | Optional display name. |
-| `--tag <value>` | Optional caller tag (git SHA or free-form label) stored on the deployment. |
-| `--auto-stop-interval-minutes <value>` | Same as `sandboxes create`. Omit for the 20-minute default. Pass -1 to keep it running. 0 is rejected. |
-| `--auto-delete-after-days <value>` | Same as `sandboxes create`: days stopped before the record is deleted (0–365). Omit for the 14-day default. Pass 0 to delete the record when it stops. |
-| `--resources <value>` | Same as `sandboxes create`: JSON { cpu, memoryGiB, diskGiB }. |
-| `--environment <value>` | Same as `sandboxes create --environment`: JSON { organization, bindings, local }. Required after awaiting_configuration. |
-| `--auto-wake <value>` | Same as `sandboxes urls create --auto-wake`. Default true for the minted URL. |
-| `--public <value>` | Same as `sandboxes urls create --public`. Default true for the minted URL. |
-| `--sandbox-provider-id <value>` | Same as `sandboxes create`: configured sandbox-provider instance id (omit for the organization default). |
-| `--zip <value>` | Local ZIP of the source tree. |
-| `<path>` | File or directory to publish (additional paths are allowed). |
-MCP tool: `projects_publish`.
-### `ghostdock projects redeploy`
-Deploy a project’s stored source again, with its current environment. No new upload. Omit deploymentId to retry the last attempt that stored source. Same outcomes and settings as projects publish; read the publishing skill (`ghostdock skills get publishing`).
-```
-ghostdock projects redeploy <project-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--deployment-id <string>` | Ship this version’s stored upload and spec. Omit to retry the last attempt that stored source. |
-| `--require-verify` | When true, a failing verify step stops the deploy (verify_failed) and tears the sandbox down. Default false. |
-| `--tag <string>` | Optional caller tag stored on the new deployment. Metadata only. |
-| `--resources <object>` | Compute sizing. For image/dockerfile/compose: layered on platform defaults when omitted. For snapshot: optional override applied via resize after create. (JSON object) |
-| `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the sandbox. -1 means always on. 0 is rejected. Omit for the platform default. Provider-native timers are optional backup. |
-| `--lifecycle <string>` | What may make the sandbox disappear on its own. ephemeral: every stop wipes the VM and its disk, and the next start runs its Compose project again (edits in the project folder kept, everything else gone; locks too). auto_delete (default): a stop keeps the disk, and the record goes autoDeleteAfterDays after the stop. keep: never removed automatically. Omit for the image label ghostdock.ephemeral, else auto_delete. ephemeral is chosen here only. |
-| `--auto-delete-after-days <integer>` | Days the sandbox stays stopped before the platform worker deletes the record (0–365; 0 deletes it when it stops). Omit for the platform default (14). Not with keep. A container a person locked holds it. |
-| `--sandbox-provider-id <string>` | Configured sandbox-provider instance id from providers list (not the provider kind). Omit to use the organization default (the org choice, else the platform default); if that provider lacks a capability this create needs, the first listed provider that accepts new sandboxes and has it is used. When no provider fits, the call fails with a not-configured error. |
-| `--environment <object>` | Environment to give this sandbox. organization: names of organization entries (from env list) to export under their own names. bindings: remap org entries onto slot names ({ name: slot, organization: orgEntryName }). local: sandbox-only variables/secrets to create with the sandbox (kind required for each). Both land as ordinary process environment variables ($NAME / process.env.NAME); a local entry overrides an organization entry of the same name. When booting from an organization snapshot, omit organization/bindings/local to keep manifest env defaults, but still supply every name in requiredEnvironment (via organization, bindings, or local). Otherwise a sandbox gets nothing unless listed here. (JSON object) |
-| `--auto-wake` | Same as urls[].autoWake on sandboxes create. Default true for the minted URL. |
-| `--public` | Same as urls[].public on sandboxes create. Default true for the minted URL. |
-MCP tool: `projects_redeploy`.
-### `ghostdock projects update`
-Rename a project.
-```
-ghostdock projects update <project-id> --display-name <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--display-name <string>` | New name. Null or empty clears it. Required. |
-MCP tool: `projects_update`.
-## `ghostdock providers`
-Sandbox providers of an organization.
-### `ghostdock providers disconnect`
-Disconnect one of the organization’s own sandbox providers. Owner or admin. Fails while sandboxes still use it. If organization snapshots live on it, the first call fails: pass confirmLinkedDeletion to delete them permanently. Also frees its custom domain and removes incomplete Incus setups; a default provider falls back to the platform default.
-```
-ghostdock providers disconnect <sandbox-provider-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-provider-id>` | Sandbox provider id, from providers list. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--confirm-linked-deletion` | Required when this provider still has organization snapshots. Permanently deletes those snapshots, then disconnects. |
-MCP tool: `providers_disconnect`.
-### `ghostdock providers list`
-List the sandbox providers an organization can create sandboxes on. Includes its own connected providers and the platform providers it may use, in fallback order. Use an item id as sandboxProviderId. Only items with acceptsNewSandboxes true take new sandboxes; an own provider stays incomplete until customDomain.status is active. defaultSandboxProviderId is the effective default. Read the sandboxes skill (`ghostdock skills get sandboxes`) for the details.
-```
-ghostdock providers list [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `providers_list`.
-### `ghostdock providers rename`
-Rename one of the organization’s own sandbox providers. Owner or admin. Platform providers cannot be renamed; names must be unique in the organization.
-```
-ghostdock providers rename <sandbox-provider-id> --name <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-provider-id>` | Sandbox provider id, from providers list. Required. |
-| `--name <string>` | New name, unique in the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `providers_rename`.
-### `ghostdock providers set-default`
-Set the provider used when a create omits sandboxProviderId. Applies to sandboxes create, projects publish and projects redeploy. Pass an own connected provider or a platform provider that accepts new sandboxes; pass null (or platformDefaultSandboxProviderId) to follow the platform default. Owner or admin.
-```
-ghostdock providers set-default <sandbox-provider-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-provider-id>` | Instance id from providers list (own or platform), or null to follow the platform default. Passing platformDefaultSandboxProviderId also follows the platform default; it is never pinned. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `providers_set_default`.
-### `ghostdock providers start-incus`
-Start connecting an Incus host as a sandbox provider. Owner or admin. Returns sshPublicKey and aiSetupPrompt; then call providers verify-incus. To finish an incomplete setup, reuse it from providers list instead of starting again. Read the incus-setup skill (`ghostdock skills get incus-setup`) first.
-```
-ghostdock providers start-incus [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--name <string>` | Name for the new provider. Optional. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `providers_start_incus`.
-### `ghostdock providers verify-incus`
-Check or finish connecting an Incus host. Owner or admin. Connects over SSH with the stored key and checks Incus 6.3+, skopeo and umoci. Omit sshHost to re-check the stored address; pass it (with the other host fields) only to move the provider. A failed check marks the provider error. Read the incus-setup skill (`ghostdock skills get incus-setup`).
-```
-ghostdock providers verify-incus <sandbox-provider-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-provider-id>` | Sandbox provider id, from providers list. Required. |
-| `--ssh-host <string>` | Host to SSH to. Omit to re-check the stored address; pass it only to set up or move the provider. |
-| `--ssh-port <integer>` | SSH port. Default 22. |
-| `--ssh-user <string>` | SSH login. Default incus-user. |
-| `--ingress-host <string>` | Public hostname for HTTP(S) when it is not the SSH host (also the DNS A/AAAA target). |
-| `--ssh-proxy-port <integer>` | Port for sandbox SSH on the host. Default 2222. |
-| `--name <string>` | New name. Optional. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `providers_verify_incus`.
-## `ghostdock registry`
-Log in to the organization container registry.
-### `ghostdock registry credentials`
-Print registry host, username, and the one-hour password.
-```
-ghostdock registry credentials [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-| `--provider <value>` | Sandbox provider id. Omit for the provider `sandboxes create` would pick (org default, else platform default, else the first that fits). |
-MCP tool: `registry_credentials`.
-### `ghostdock registry login`
-Fetch a one-hour password and run docker login --password-stdin.
-```
-ghostdock registry login [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-| `--provider <value>` | Sandbox provider id. Omit for the provider `sandboxes create` would pick (org default, else platform default, else the first that fits). |
-## `ghostdock sandboxes`
-Create, run and manage sandboxes.
-### `ghostdock sandboxes build`
-Create a sandbox from a local Dockerfile or Compose directory. Zips the directory (or takes --zip) and builds it on the sandbox provider; use it when the Dockerfile copies local files or the Compose project has build contexts.
-```
-ghostdock sandboxes build [path] --kind <value> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-| `--kind <value>` | dockerfile or compose. Required. |
-| `--sandbox-provider-id <value>` | Configured sandbox-provider instance id (omit for the organization default). |
-| `--display-name <value>` | Optional sandbox display name. |
-| `--zip <value>` | Local ZIP of the build directory (Dockerfile or compose file at the zip root). |
-| `<path>` | Build directory to zip and create from. |
-### `ghostdock sandboxes commands`
-Run commands in a sandbox and read their output.
-### `ghostdock sandboxes commands get`
-Get a shell command’s status and exit code.
-```
-ghostdock sandboxes commands get <command-id> --sandbox-id <string> --session-id <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<command-id>` | Command id returned by sandboxes commands run. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--session-id <string>` | Session id returned by sandboxes commands run together with the commandId. Required. |
-| `--start` | Start the container first when it is not running, without asking. |
-MCP tool: `sandboxes_commands_get`.
-### `ghostdock sandboxes commands kill`
-Interrupt a running shell command.
-```
-ghostdock sandboxes commands kill <command-id> --sandbox-id <string> --session-id <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<command-id>` | Command id returned by sandboxes commands run. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--session-id <string>` | Session id returned by sandboxes commands run together with the commandId. Required. |
-| `--start` | Start the container first when it is not running, without asking. |
-MCP tool: `sandboxes_commands_kill`.
-### `ghostdock sandboxes commands logs`
-Get a page of a shell command’s stdout and stderr.
-```
-ghostdock sandboxes commands logs <command-id> --sandbox-id <string> --session-id <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<command-id>` | Command id returned by sandboxes commands run. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--session-id <string>` | Session id returned by sandboxes commands run together with the commandId. Required. |
-| `--offset <integer>` | Character offset to continue reading from. Default 0. |
-| `--start` | Start the container first when it is not running, without asking. |
-MCP tool: `sandboxes_commands_logs`.
-### `ghostdock sandboxes commands run`
-Run a shell command in a sandbox. Waits up to 120 seconds, then returns sessionId and commandId to poll. Starts the sandbox when allowed. Sessions do not survive idle-stop: for a process that must keep running, read the sandbox-boot skill (`ghostdock skills get sandbox-boot`). Never put secret values in the command; it is logged.
-```
-ghostdock sandboxes commands run <sandbox-id> --command <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--command <string>` | Shell command to run. Never include secret values: commands are logged. Required. |
-| `--session-id <string>` | Session from sandboxes shells create, to keep cwd and environment from earlier commands. Omit for a one-off session. |
-| `--cwd <string>` | Directory to run the command in. |
-| `--wait-seconds <number>` | Seconds to wait before returning handles to poll: 1 to 120, default 120. |
-| `--start` | Start the container first when it is not running, without asking. |
-MCP tool: `sandboxes_commands_run`.
-### `ghostdock sandboxes containers`
-Containers of a sandbox’s Docker engine.
-### `ghostdock sandboxes containers list`
-List the containers of a sandbox, running or not. Each with state, health, restart policy, ports, Compose project and service, its lock (locked, and whether a person or its ghostdock.lock label decided), ghostdock.* labels, and which one is the default. A stopped sandbox lists none (it is not started for this).
-```
-ghostdock sandboxes containers list <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_containers_list`.
-### `ghostdock sandboxes containers lock`
-Lock a container against removal. A locked container cannot be removed, renamed or recreated through Docker (docker rm, compose down, a compose up that would recreate it) until it is unlocked here; start, stop and restart still work. It also pauses the sandbox’s auto-delete. An ephemeral sandbox’s stop still wipes it. Never starts the sandbox: a stopped one gets the lock at its next start.
-```
-ghostdock sandboxes containers lock <sandbox-id> <container> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `<container>` | Container, by name. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_containers_lock`.
-### `ghostdock sandboxes containers logs`
-Read a container’s output, as docker logs does. Oldest first, each line with its stream (stdout, stderr) and time. The last tail lines (default 200), or with after only the lines after that time: pass the last line’s time to follow. truncated says lines were left out. A stopped sandbox has none (it is not started for this).
-```
-ghostdock sandboxes containers logs <sandbox-id> <container> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `<container>` | Container, by name. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--tail <integer>` | The last N lines (at most 5000). |
-| `--after <string>` | Only lines after this time: the time of the last line already read. |
-| `--follow` | Keep printing new lines until Ctrl-C. |
-| `--timestamps` | Put each line's time in front of it. |
-MCP tool: `sandboxes_containers_logs`.
-### `ghostdock sandboxes containers restart`
-Restart a container, as docker restart does (stopping as docker stop does). Starts the sandbox when needed.
-```
-ghostdock sandboxes containers restart <sandbox-id> <container> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `<container>` | Container, by name. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_containers_restart`.
-### `ghostdock sandboxes containers start`
-Start a stopped container, as docker start does. A running container stays as it is. Starts the sandbox when needed.
-```
-ghostdock sandboxes containers start <sandbox-id> <container> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `<container>` | Container, by name. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_containers_start`.
-### `ghostdock sandboxes containers stop`
-Stop a container, as docker stop does. It gets its own stop signal, then a kill after its own stop timeout. It stays stopped while the sandbox sleeps and wakes, as Docker keeps a stopped container stopped, unless its restart policy is always. On a stopped sandbox it does nothing (note sandbox_stopped). A lock does not block it. note says when it was the default container or the last one running: then SSH, commands and files have nowhere to land until one runs.
-```
-ghostdock sandboxes containers stop <sandbox-id> <container> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `<container>` | Container, by name. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_containers_stop`.
-### `ghostdock sandboxes containers unlock`
-Unlock a container so Docker can remove or recreate it. Also one its image locked with the ghostdock.lock label. Never starts the sandbox: a stopped one gets it at its next start, and an overdue auto-delete it held goes ahead.
-```
-ghostdock sandboxes containers unlock <sandbox-id> <container> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `<container>` | Container, by name. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_containers_unlock`.
-### `ghostdock sandboxes create`
-Create a sandbox from a snapshot, OCI image, Dockerfile or Compose files. Inline content only: for a directory or ZIP (Dockerfile COPY/ADD, Compose build files) use `ghostdock sandboxes build`. Snapshots and catalog images can require environment entries, URL ports and MCP names (requiredEnvironment / requiredUrls / requiredMcps); a missing environment entry fails with its names (missingEnvironment), and removing a required URL or MCP fails with them (missingUrls / missingMcps). Every source but a snapshot becomes a Compose project in the sandbox, run once with docker compose up -d; after that Docker is the truth. Returns once the project is up, with `boot`: how long the sandbox (VM) and the project's compose up took, each in ms, and the images it pulled. Idle-stop and auto-delete apply (defaults 20 minutes / 14 days). Read the sandboxes skill (`ghostdock skills get sandboxes`) for sources, manifests, lifecycle and providers.
-```
-ghostdock sandboxes create --source <object> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--display-name <string>` | Display name for the sandbox. Optional. |
-| `--source <object>` | What the sandbox boots from. Required. "image" boots an org catalog row by id ({ id } from images list / images get — images add OCI bookmarks, images add-dockerfile, and images add-compose rows) or any OCI ref ({ ref }); "dockerfile" builds inline Dockerfile text only (ghostdock.* LABEL lines parsed for manifest; this tool has no build directory, so COPY/ADD of local files fails — use the CLI `ghostdock sandboxes build --kind dockerfile` with a directory or ZIP); "compose" runs the given inline files with docker compose up -d (must include docker-compose.yml/yaml or compose.yml/yaml; ghostdock.* service labels parsed for manifest). Every source but a snapshot becomes a Compose project in /srv/ghostdock/<sandbox name>, run once; an image is one service named after it, a Dockerfile the service app. A Compose project that needs extra files is not accepted here — use `ghostdock sandboxes build --kind compose`. "compose" also takes a published Compose project instead of files ({ reference: "oci://…", override? }): it runs through include:, the override merged into it. Image, dockerfile, and compose sources never appear in snapshots list. Published static sites use sites publish (CDN), not a snapshot. (JSON object) Required. |
-| `--restart <string>` | Restart policy of the service an image or a Dockerfile becomes, Docker's names: unless-stopped (default), always, on-failure, or no (it does not come back after the sandbox sleeps). Not for Compose: its files set restart:. |
-| `--resources <object>` | Compute sizing. For image/dockerfile/compose: layered on platform defaults when omitted. For snapshot: optional override applied via resize after create. (JSON object) |
-| `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the sandbox. -1 means always on. 0 is rejected. Omit for the platform default. Provider-native timers are optional backup. |
-| `--lifecycle <string>` | What may make the sandbox disappear on its own. ephemeral: every stop wipes the VM and its disk, and the next start runs its Compose project again (edits in the project folder kept, everything else gone; locks too). auto_delete (default): a stop keeps the disk, and the record goes autoDeleteAfterDays after the stop. keep: never removed automatically. Omit for the image label ghostdock.ephemeral, else auto_delete. ephemeral is chosen here only. |
-| `--auto-delete-after-days <integer>` | Days the sandbox stays stopped before the platform worker deletes the record (0–365; 0 deletes it when it stops). Omit for the platform default (14). Not with keep. A container a person locked holds it. |
-| `--sandbox-provider-id <string>` | Configured sandbox-provider instance id from providers list (not the provider kind). Omit to use the organization default (the org choice, else the platform default); if that provider lacks a capability this create needs, the first listed provider that accepts new sandboxes and has it is used. When no provider fits, the call fails with a not-configured error. |
-| `--environment <object>` | Environment to give this sandbox. organization: names of organization entries (from env list) to export under their own names. bindings: remap org entries onto slot names ({ name: slot, organization: orgEntryName }). local: sandbox-only variables/secrets to create with the sandbox (kind required for each). Both land as ordinary process environment variables ($NAME / process.env.NAME); a local entry overrides an organization entry of the same name. When booting from an organization snapshot, omit organization/bindings/local to keep manifest env defaults, but still supply every name in requiredEnvironment (via organization, bindings, or local). Otherwise a sandbox gets nothing unless listed here. (JSON object) |
-| `--image-base <string>` | How the disk is made for one of Ghostdock's platform images: auto (default) clones the host's image base, a disk with the image already on it, when there is one; off always starts from an empty disk that pulls the image. For tests and comparisons; other images always start empty. |
-| `--urls <array>` | Changes to the image’s or snapshot’s URLs, keyed by port. Omit for the image URLs as they are; otherwise you get the image URLs plus yours: an entry on the same port replaces that URL completely (omitted fields take their defaults), and { port, remove: true } drops it; removing a port the image does not declare does nothing. A required port cannot be removed. TCP URLs are always public. (JSON array) |
-| `--mcps <array>` | Changes to the image’s or snapshot’s MCP exposures, keyed by name. Omit for the image MCPs as they are; otherwise you get the image MCPs plus yours: an entry with the same name replaces that MCP completely, and { name, remove: true } drops it; removing a name the image does not declare does nothing. A required MCP (requiredMcps) cannot be removed. (JSON array) |
-MCP tool: `sandboxes_create`.
-### `ghostdock sandboxes default-container`
-Show, set or clear the sandbox’s default container. SSH, the terminal, files, commands and MCP land there when no container is named. Without container or clear it only shows the setting.
-```
-ghostdock sandboxes default-container <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--container <string>` | Container to make the default, by name. The running sandbox must have it. |
-| `--clear` | Clear the default. |
-| `--start` | Start the container first when it is not running, without asking. |
-MCP tool: `sandboxes_default_container`.
-### `ghostdock sandboxes delete`
-Permanently delete a sandbox and its files. Refused while it has locked containers (sandbox_has_locked_containers, naming them) unless deleteLocked is true.
-```
-ghostdock sandboxes delete <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--delete-locked` | Delete it with its locked containers. Without it, a locked container refuses the delete. |
-MCP tool: `sandboxes_delete`.
-### `ghostdock sandboxes env`
-Environment of one sandbox.
-### `ghostdock sandboxes env delete`
-Delete one of a sandbox’s own variables or secrets.
-```
-ghostdock sandboxes env delete <name> --sandbox-id <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--restart` | When true and the sandbox is running, stop then start after saving so processes pick up the change. Default: sync only. |
-MCP tool: `sandboxes_env_delete`.
-### `ghostdock sandboxes env get`
-Get a sandbox’s environment: selections, bindings and local entries. Shows each organization entry with whether it is selected, exportAs, and overriddenByLocal; secret values are withheld. Nothing is inherited.
-```
-ghostdock sandboxes env get <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_env_get`.
-### `ghostdock sandboxes env select`
-Replace the organization entries a sandbox exports. Full replace: environment is the whole list ([] clears it), and omitting bindings clears the remaps. Running processes keep their old values until restarted (pass restart). Read the environment skill (`ghostdock skills get environment`).
-```
-ghostdock sandboxes env select <sandbox-id> --environment <array> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--environment <array>` | Organization catalogue entry names to export under their own names. Pass [] to clear plain selections. (JSON array) Required. |
-| `--bindings <array>` | Slot-centric org bindings: export an organization entry under a (possibly different) sandbox env name. Omit to clear existing remaps (full replace). (JSON array) |
-| `--restart` | When true and the sandbox is running, stop then start after saving so processes pick up the change. Default: sync only; already-running processes keep the old values until restarted. |
-MCP tool: `sandboxes_env_select`.
-### `ghostdock sandboxes env set`
-Create or replace one of a sandbox’s own variables or secrets. It overrides an organization entry of the same name. kind is required when creating. Setting secrets via this tool is allowed; prefer the Ghostdock CLI so values stay out of the conversation, and never put them in commands.
-```
-ghostdock sandboxes env set <name> --sandbox-id <string> --value <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--value <string>` | The value to store. A secret value can be replaced later but never read back. Required. |
-| `--kind <string>` | Required when creating. Use "secret" for credentials; secret values can be replaced but never read back. Omit when updating to keep the existing kind. |
-| `--comment <string>` | Optional note shown with the entry, e.g. what it is for. |
-| `--restart` | When true and the sandbox is running, stop then start after saving so processes pick up the change. Default: sync only. |
-MCP tool: `sandboxes_env_set`.
-### `ghostdock sandboxes files`
-Files inside a sandbox.
-### `ghostdock sandboxes files list`
-List the files in a sandbox directory. Default: the container's start folder (its dir).
-```
-ghostdock sandboxes files list <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--path <string>` | Directory to list: absolute, or relative to the container's start folder (its dir: the login user's home, else WORKDIR, else /). Defaults to that folder. |
-| `--start` | Start the container first when it is not running, without asking. |
-MCP tool: `sandboxes_files_list`.
-### `ghostdock sandboxes files read`
-Read a file from a sandbox: utf8 text, or base64 for small binaries.
-```
-ghostdock sandboxes files read <path> --sandbox-id <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<path>` | File path: absolute, or relative to the container's start folder (for example src/App.vue). Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--start` | Start the container first when it is not running, without asking. |
-MCP tool: `sandboxes_files_read`.
-### `ghostdock sandboxes files upload`
-Upload local files or directories to a sandbox's container, into its start folder (the login user's home, else WORKDIR, else /).
-```
-ghostdock sandboxes files upload <sandbox-id> [path] [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name or id. Required. |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-| `--container <value>` | Container the files land in, by name, from `ghostdock sandboxes containers list`. Default: the sandbox's default container, else the one running container. |
-| `--start` | Start the container first when it is not running, without asking. |
-| `--zip <value>` | Local ZIP file to upload. |
-| `<path>` | File or directory to upload (additional paths are allowed). |
-MCP tool: `sandboxes_files_upload`.
-### `ghostdock sandboxes list`
-List the sandboxes of an organization, with their lifecycle and deadlines. Each has a name (e.g. quiet-harbor), unique in the organization, that every sandbox tool accepts as sandboxId.
-```
-ghostdock sandboxes list [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_list`.
-### `ghostdock sandboxes mcps`
-MCP endpoints a sandbox exposes.
-### `ghostdock sandboxes mcps create`
-Expose an MCP server running in a sandbox. Idempotent by name.
-```
-ghostdock sandboxes mcps create <sandbox-id> --name <string> --port <integer> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--name <string>` | Endpoint name, unique in the sandbox. Letters, digits, _ and -, starting with a letter. Required. |
-| `--port <integer>` | Port the MCP server listens on inside the sandbox. Required. |
-| `--path <string>` | HTTP path of the MCP endpoint. Default /mcp. |
-| `--auto-wake` | Start the sandbox when the endpoint is called while it is stopped. Default false. |
-MCP tool: `sandboxes_mcps_create`.
-### `ghostdock sandboxes mcps delete`
-Delete an MCP endpoint of a sandbox.
-```
-ghostdock sandboxes mcps delete <mcp-id>
-```
-| Argument | Description |
-| --- | --- |
-| `<mcp-id>` | MCP endpoint id, from sandboxes mcps list or sandboxes mcps create. Required. |
-MCP tool: `sandboxes_mcps_delete`.
-### `ghostdock sandboxes mcps list`
-List the MCP endpoints a sandbox exposes (name, port, path, autoWake).
-```
-ghostdock sandboxes mcps list <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_mcps_list`.
-### `ghostdock sandboxes mcps update`
-Change an MCP endpoint’s name, port, path or autoWake setting.
-```
-ghostdock sandboxes mcps update <mcp-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<mcp-id>` | MCP endpoint id, from sandboxes mcps list or sandboxes mcps create. Required. |
-| `--name <string>` | New endpoint name. Omit to keep it. |
-| `--port <integer>` | New port inside the sandbox. Omit to keep it. |
-| `--path <string>` | New HTTP path. Omit to keep it. |
-| `--auto-wake` | Start the sandbox when the endpoint is called while it is stopped. Omit to keep it. |
-MCP tool: `sandboxes_mcps_update`.
-### `ghostdock sandboxes resize`
-Change a sandbox’s CPU and/or memory. While running only increases are allowed; stop it first to decrease (this tool does not stop it). Disk: sandboxes resize-disk.
-```
-ghostdock sandboxes resize <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--cpu <number>` | Number of CPUs. |
-| `--memory-gib <number>` | Memory in GiB. |
-MCP tool: `sandboxes_resize`.
-### `ghostdock sandboxes resize-disk`
-Grow a sandbox’s disk. The sandbox must be stopped first (this tool does not stop it). Disk only grows, never shrinks.
-```
-ghostdock sandboxes resize-disk <sandbox-id> --disk-gib <number> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--disk-gib <number>` | New total disk size in GiB; must be larger than the current size. Required. |
-MCP tool: `sandboxes_resize_disk`.
-### `ghostdock sandboxes shells`
-Shell sessions that keep cwd and environment between commands.
-### `ghostdock sandboxes shells close`
-Close a shell session.
-```
-ghostdock sandboxes shells close <session-id> --sandbox-id <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<session-id>` | Session id from sandboxes shells create. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--start` | Start the container first when it is not running, without asking. |
-MCP tool: `sandboxes_shells_close`.
-### `ghostdock sandboxes shells create`
-Open a shell session that keeps cwd and environment between commands. Starts the sandbox when allowed; the session ends at idle-stop.
-```
-ghostdock sandboxes shells create <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--session-id <string>` | Id for the new session: a slug. Omit to generate one. |
-| `--start` | Start the container first when it is not running, without asking. |
-MCP tool: `sandboxes_shells_create`.
-### `ghostdock sandboxes ssh`
-SSH access to a sandbox.
-### `ghostdock sandboxes ssh get`
-Get temporary SSH access to a sandbox (command and token, 60 minutes). Starts the sandbox when needed. Idle-stop still applies, independent of the token.
-```
-ghostdock sandboxes ssh get <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
-| `--start` | Start the container first when it is not running, without asking. |
-MCP tool: `sandboxes_ssh_get`.
-### `ghostdock sandboxes ssh revoke`
-Revoke a sandbox’s active SSH access.
-```
-ghostdock sandboxes ssh revoke <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_ssh_revoke`.
-### `ghostdock sandboxes status`
-Get a sandbox’s status and lifecycle deadlines without waking it. Returns idleStopsAt, deletesAt and `boot` (the last start: sandbox and container times in ms) and does not reset idle activity.
-```
-ghostdock sandboxes status <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_status`.
-### `ghostdock sandboxes stop`
-Stop a running sandbox without deleting its files.
-```
-ghostdock sandboxes stop <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_stop`.
-### `ghostdock sandboxes storage`
-### `ghostdock sandboxes storage delete`
-Delete a named volume or a top-level sandbox folder, with everything in it. Refused while a container mounts it (in any state: a stopped one counts, so stopping does not help), mounts a folder above it (a bind of /), or a volume keeps its data in the folder: remove those first.
-```
-ghostdock sandboxes storage delete <sandbox-id> --kind <string> --name <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--kind <string>` | volume or folder. Required. |
-| `--name <string>` | The volume’s name, or the folder’s path in the sandbox (/srv, not /srv/app). Required. |
-MCP tool: `sandboxes_storage_delete`.
-### `ghostdock sandboxes storage list`
-List a sandbox’s volumes and sandbox folders. The sandbox folders are where bind mounts land. Each with its size and sizeState (measured; measuring: ask again in a few seconds; tooBig: too big to measure cheaply; outside: a volume bound outside the sandbox folders, not measured nor browsable) and the containers using it, plus every container’s mounts. truncated says entries were left out. A stopped sandbox lists none (it is not started for this).
-```
-ghostdock sandboxes storage list <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_storage_list`.
-### `ghostdock sandboxes tools`
-Tools of the MCP servers inside a sandbox.
-### `ghostdock sandboxes tools call`
-Call a tool on an MCP server inside a sandbox. Wakes a stopped sandbox when the endpoint has autoWake.
-```
-ghostdock sandboxes tools call <name> --sandbox-id <string> --arguments <object> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<name>` | Tool name, from sandboxes tools list. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--arguments <object>` | Tool arguments as a JSON object. (JSON object) Required. |
-| `--mcp-name <string>` | MCP endpoint to call. Needed when several endpoints expose the same tool name. |
-MCP tool: `sandboxes_tools_call`.
-### `ghostdock sandboxes tools list`
-List the tools of the MCP servers a sandbox exposes. A server that cannot be reached is reported in errors; the others are still listed.
-```
-ghostdock sandboxes tools list <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--mcp-name <string>` | Only list the tools of this MCP endpoint. |
-MCP tool: `sandboxes_tools_list`.
-### `ghostdock sandboxes update`
-Change a sandbox’s display name, idle-stop interval or lifecycle. Omit a field to keep it; null resets it to the platform default. Ephemeral is chosen at create only.
-```
-ghostdock sandboxes update <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--display-name <string>` | New display name. Null clears it; omit to keep it. |
-| `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the sandbox. -1 always on. 0 is rejected. Null resets to the platform default. Provider-native timers are optional backup. |
-| `--lifecycle <string>` | auto_delete: the record goes autoDeleteAfterDays after the sandbox stops. keep: never removed automatically. |
-| `--auto-delete-after-days <integer>` | Days stopped before the record is deleted (0–365; 0 deletes it when it stops). Null writes the platform default. Not with keep. |
-MCP tool: `sandboxes_update`.
-### `ghostdock sandboxes urls`
-URLs that expose sandbox ports.
-### `ghostdock sandboxes urls create`
-Expose a sandbox port as a URL. Idempotent by port: when the sandbox already has a URL on that port, it is returned unchanged (autoWake, public and title are not applied); use sandboxes urls update to change it. HTTP defaults to private with no wake-on-visit; TCP URLs use TLS (not HTTP) and are always public — for a private port use sandboxes ssh get and an SSH forward. Read the sandboxes skill (`ghostdock skills get sandboxes`) for TCP clients.
-```
-ghostdock sandboxes urls create <sandbox-id> --port <integer> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--port <integer>` | Port inside the sandbox to expose. Required. |
-| `--protocol <string>` | "http" (default) or "tcp". TCP URLs use TLS and are always public. |
-| `--auto-wake` | Start the sandbox when the URL is visited while it is stopped. Default false. |
-| `--public` | Reachable without signing in. Default false; TCP URLs are always public. |
-| `--title <string>` | Name shown for the URL, up to 40 characters. A titled HTTP URL gets its own button on the sandbox card; TCP titles are shown in URL lists. Untitled HTTP URLs are listed under "Open URL". |
-MCP tool: `sandboxes_urls_create`.
-### `ghostdock sandboxes urls delete`
-Delete a sandbox URL.
-```
-ghostdock sandboxes urls delete <url-id>
-```
-| Argument | Description |
-| --- | --- |
-| `<url-id>` | Sandbox URL id, from sandboxes urls list or sandboxes urls create. Required. |
-MCP tool: `sandboxes_urls_delete`.
-### `ghostdock sandboxes urls list`
-List the URLs that expose a sandbox’s ports, with protocol, access and title. A titled URL (for example `Desktop`, the desktop image’s desktop in a browser) gets its own button in the app.
-```
-ghostdock sandboxes urls list <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_urls_list`.
-### `ghostdock sandboxes urls update`
-Change a sandbox URL’s port, protocol, autoWake, public setting or title. TCP cannot be private.
-```
-ghostdock sandboxes urls update <url-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<url-id>` | Sandbox URL id, from sandboxes urls list or sandboxes urls create. Required. |
-| `--port <integer>` | New port inside the sandbox. Omit to keep it. |
-| `--protocol <string>` | "http" or "tcp". Omit to keep the current protocol. |
-| `--auto-wake` | Start the sandbox when the URL is visited while it is stopped. Omit to keep it. |
-| `--public` | Reachable without signing in. Omit to keep it; TCP cannot be made private. |
-| `--title <string>` | Name shown for the URL, up to 40 characters. A titled HTTP URL gets its own button on the sandbox card; TCP titles are shown in URL lists. Untitled HTTP URLs are listed under "Open URL". Omit to keep it; null removes it. |
-MCP tool: `sandboxes_urls_update`.
-### `ghostdock sandboxes wake`
-Start a stopped sandbox, or reset the idle-stop countdown of a running one. Returns status, idleStopsAt / deletesAt, and `boot` (sandbox and container start times in ms; null when it was already running).
-```
-ghostdock sandboxes wake <sandbox-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sandboxes_wake`.
-## `ghostdock sites`
-Static sites on the CDN.
-### `ghostdock sites publish`
-Publish a local directory or ZIP to the CDN.
-```
-ghostdock sites publish [path] [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
-| `--display-name <value>` | Optional site display name. |
-| `--zip <value>` | Local ZIP file to publish. |
-| `<path>` | File or directory to publish (additional paths are allowed). |
-MCP tool: `sites_publish`.
-### `ghostdock sites unpublish`
-Take a published static site offline.
-```
-ghostdock sites unpublish <site-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<site-id>` | Site id: the slug in the public URL, as returned by sites publish or apps list. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `sites_unpublish`.
-## `ghostdock skills`
-List and read Agent Skills (same catalog as MCP skill://index.json).
-### `ghostdock skills get`
-Print one SKILL.md (URI from the discovery index, or a skill name).
-```
-ghostdock skills get <uri>
-```
-| Argument | Description |
-| --- | --- |
-| `<uri>` | skill:// URI, org/name, or skill name. Required. |
-MCP tool: `skills_get`.
-### `ghostdock skills list`
-List the Agent Skills discovery index.
-```
-ghostdock skills list
-```
-MCP tool: `skills_list`.
-## `ghostdock snapshots`
-Sandbox snapshots.
-### `ghostdock snapshots create`
-Save a sandbox’s filesystem as a reusable organization snapshot. The sandbox must be stopped, unless stopAndResume. Captures its URLs and environment into a manifest (secrets as required, without values). Waits up to ~120 seconds; if still pending it returns timedOut, then poll snapshots get. Setting secret values here is allowed; prefer the Ghostdock CLI so they stay out of the conversation.
-```
-ghostdock snapshots create <sandbox-id> --name <string> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--name <string>` | Snapshot name, unique in the organization. Required. |
-| `--stop-and-resume` | When the sandbox is running: stop it, snapshot, then start it again. Without this it must already be stopped. |
-| `--include-secret-values <array>` | Names of sandbox-local secrets whose values to embed in the snapshot. Organization secrets cannot be copied. (JSON array) |
-| `--manifest <object>` | Replaces the captured URLs and environment entirely (no merge). An omitted ephemeral is copied from the sandbox. Secret values are stored encrypted. (JSON object) |
-MCP tool: `snapshots_create`.
-### `ghostdock snapshots delete`
-Permanently delete an organization snapshot (provider artifact and record).
-```
-ghostdock snapshots delete <snapshot-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<snapshot-id>` | Snapshot id from snapshots list (the provider snapshot name) or its database id. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `snapshots_delete`.
-### `ghostdock snapshots get`
-Get one snapshot with its manifest and required environment, URLs and MCPs. Returns a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps. Poll it after snapshots create while status is pending.
-```
-ghostdock snapshots get <snapshot-id> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<snapshot-id>` | Snapshot id from snapshots list (the provider snapshot name) or its database id. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `snapshots_get`.
-### `ghostdock snapshots list`
-List the snapshots an organization can boot sandboxes from. Each item has status (pending, active, error), the provider that holds it (sandboxProviderId; boot it there), sandboxCount, and a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps.
-```
-ghostdock snapshots list [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-MCP tool: `snapshots_list`.
-### `ghostdock snapshots update-manifest`
-Replace a snapshot’s manifest (URLs, environment, MCPs). Does not change the snapshot itself. Secret values in the body are stored encrypted; the response is redacted. Setting secret values here is allowed; prefer the Ghostdock CLI so they stay out of the conversation.
-```
-ghostdock snapshots update-manifest <snapshot-id> --manifest <object> [flags]
-```
-| Argument | Description |
-| --- | --- |
-| `<snapshot-id>` | Snapshot id from snapshots list (the provider snapshot name) or its database id. Required. |
-| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
-| `--manifest <object>` | The new manifest; replaces the stored one. An omitted ephemeral keeps the stored value. Secret values are stored encrypted. (JSON object) Required. |
-MCP tool: `snapshots_update_manifest`.
-## `ghostdock tools`
-List available agent tools.
-```
-ghostdock tools
-```
-## `ghostdock whoami`
-Show the account this CLI is currently authenticated as.
-```
-ghostdock whoami
-```