ghostdock 0.0.7 → 0.0.9

package/dist/cli-reference.md

@@ -0,0 +1,1527 @@
+# ghostdock CLI reference
+
+<!-- Generated by `bun run sync:cli-reference` from the CLI's command tree. Do not edit. -->
+
+Every command the `ghostdock` CLI ships, with its full description and flags.
+For how to install, log in and choose an organization, read [cli.md](cli.md). Concepts and
+workflows are in the built-in skills (`ghostdock skills list`).
+
+Binaries: `ghostdock`, `gdock`.
+Global flag `--base-url`: API origin (overrides GHOSTDOCK_BASE_URL and the built-in default).
+Global flag `--json`: Print the result as one JSON document on stdout, for scripts and agents. Without it, output is for people.
+
+## `ghostdock apps`
+
+Published apps of an organization.
+
+### `ghostdock apps list`
+
+List the live published apps (sites) of an organization, with their URLs. Each app has a siteId to pass to sites unpublish.
+
+```
+ghostdock apps list [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `apps_list`.
+
+## `ghostdock env`
+
+Manage organization environment variables and secrets.
+
+### `ghostdock env delete`
+
+Delete a variable or secret.
+
+```
+ghostdock env delete <name> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<name>` | Environment variable name. Required. |
+| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+
+MCP tool: `env_delete`.
+
+### `ghostdock env get`
+
+Print one variable value in full (secrets cannot be read).
+
+```
+ghostdock env get <name> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<name>` | Environment variable name. Required. |
+| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+
+MCP tool: `env_get`.
+
+### `ghostdock env list`
+
+List variables and secrets.
+
+```
+ghostdock env list [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+
+MCP tool: `env_list`.
+
+### `ghostdock env set`
+
+Create or replace a variable or secret.
+
+```
+ghostdock env set <name> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<name>` | Environment variable name. Required. |
+| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--value <value>` | Value to store. |
+| `--value-stdin` | Read the value from stdin — keeps secrets out of shell history. |
+| `--secret` | Shorthand for --kind secret. Required when creating a secret. |
+| `--kind <value>` | variable or secret. Required when creating; on an update, omit to keep the existing kind or pass the other to convert. |
+| `--comment <value>` | Note about what this value is for. |
+
+MCP tool: `env_set`.
+
+## `ghostdock images`
+
+Organization image catalog: OCI bookmarks, Dockerfiles and Compose files.
+
+### `ghostdock images add`
+
+Bookmark an OCI image ref in the organization’s image catalog. Fails if it is already bookmarked.
+
+```
+ghostdock images add --ref <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--ref <string>` | OCI image reference, e.g. ghcr.io/acme/app:latest. Required. |
+| `--label <string>` | Display label for the bookmark. Optional. |
+
+MCP tool: `images_add`.
+
+### `ghostdock images add-compose`
+
+Add Compose files to the organization’s image catalog. Must include docker-compose.yml/yaml or compose.yml/yaml; ghostdock.* service labels become its manifest. Fails if the name is taken.
+
+```
+ghostdock images add-compose --name <string> --files <object> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--name <string>` | Image name, unique in the organization. Required. |
+| `--files <object>` | Compose files by file name. Must include docker-compose.yml/yaml or compose.yml/yaml. (JSON object) Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `images_add_compose`.
+
+### `ghostdock images add-dockerfile`
+
+Add a Dockerfile to the organization’s image catalog. ghostdock.* LABEL lines become its manifest. Fails if the name is taken.
+
+```
+ghostdock images add-dockerfile --name <string> --dockerfile <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--name <string>` | Image name, unique in the organization. Required. |
+| `--dockerfile <string>` | Dockerfile text. ghostdock.* LABEL lines become the image manifest. Required. |
+
+MCP tool: `images_add_dockerfile`.
+
+### `ghostdock images get`
+
+Get one catalog image with its spec, manifest and requirements. Returns kind, spec and a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps. An OCI bookmark’s manifest is null: its labels are read at create time.
+
+```
+ghostdock images get <image-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<image-id>` | Catalog image id, from images list or images get. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `images_get`.
+
+### `ghostdock images list`
+
+List the images an organization can boot sandboxes from. OCI bookmarks, images add-dockerfile and images add-compose rows, and refs its sandboxes use. A discovery catalog, not an allowlist: sandboxes create accepts any OCI ref. Items carry sandboxCount and a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps. An OCI bookmark stores no labels (manifest null): sandboxes create reads them from the digest the ref names then.
+
+```
+ghostdock images list [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `images_list`.
+
+### `ghostdock images remove`
+
+Remove an image from the organization’s catalog. Sandboxes already using it are not affected.
+
+```
+ghostdock images remove <image-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<image-id>` | Catalog image id, from images list or images get. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `images_remove`.
+
+### `ghostdock images update-compose`
+
+Replace a catalog Compose image’s files and/or name. Re-parses its labels.
+
+```
+ghostdock images update-compose <image-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<image-id>` | Catalog image id, from images list or images get. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--files <object>` | New Compose files by file name. Omit to keep the current files. (JSON object) |
+| `--name <string>` | New image name. Omit to keep it. |
+
+MCP tool: `images_update_compose`.
+
+### `ghostdock images update-dockerfile`
+
+Replace a catalog Dockerfile, optionally renaming it. Re-parses its ghostdock.* labels.
+
+```
+ghostdock images update-dockerfile <image-id> --dockerfile <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<image-id>` | Catalog image id, from images list or images get. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--dockerfile <string>` | Dockerfile text. ghostdock.* LABEL lines become the image manifest. Required. |
+| `--name <string>` | New image name. Omit to keep it. |
+
+MCP tool: `images_update_dockerfile`.
+
+## `ghostdock login`
+
+Sign in and store a device access token for this CLI.
+
+```
+ghostdock login [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--wait` | Poll until the login is approved in the browser (default timeout 5 minutes). |
+| `--code <value>` | Redeem the one-time paste code shown in the browser instead of polling. |
+| `--timeout <value>` | Max seconds to poll when using --wait (default 300). |
+| `--org <value>` | Set this organization (id or slug) as the default once logged in. |
+
+## `ghostdock logout`
+
+Revoke the device session and remove stored credentials.
+
+```
+ghostdock logout
+```
+
+## `ghostdock network`
+
+The private network: reach your sandboxes by address and name from this machine.
+
+### `ghostdock network connect`
+
+Put this machine into the private network: WireGuard and split DNS. Asks for sudo once.
+
+```
+ghostdock network connect [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+
+### `ghostdock network devices`
+
+Your devices in the private network.
+
+```
+ghostdock network devices <command>
+```
+
+### `ghostdock network devices remove`
+
+Remove one of your devices from the private network.
+
+```
+ghostdock network devices remove <id>
+```
+
+| Argument | Description |
+| --- | --- |
+| `<id>` | Device id, from `network devices`. Required. |
+
+### `ghostdock network disconnect`
+
+Take this machine out of the private network.
+
+```
+ghostdock network disconnect
+```
+
+### `ghostdock network ls`
+
+Sandboxes of an organization with their private addresses and names.
+
+```
+ghostdock network ls [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+
+### `ghostdock network status`
+
+Whether this machine is connected, and as which device.
+
+```
+ghostdock network status
+```
+
+### `ghostdock network use`
+
+Choose the organization <sandbox>.gdock.internal names resolve in on this machine.
+
+```
+ghostdock network use [org] [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<org>` | Organization id or slug. |
+| `--clear` | Turn short names off. |
+
+## `ghostdock organizations`
+
+Organizations you belong to.
+
+### `ghostdock organizations current`
+
+Show which organization commands use, and where it comes from.
+
+```
+ghostdock organizations current [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <value>` | Check what this --org would resolve to. |
+
+### `ghostdock organizations list`
+
+List the organizations you belong to, with their ids and slugs.
+
+```
+ghostdock organizations list
+```
+
+MCP tool: `organizations_list`.
+
+### `ghostdock organizations use`
+
+Set the default organization for commands run in this directory.
+
+```
+ghostdock organizations use [org] [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<org>` | Organization id or slug. |
+| `--clear` | Remove the default organization. |
+
+## `ghostdock projects`
+
+Deployable projects, their deployments and environment.
+
+### `ghostdock projects create`
+
+Create an empty project. Nothing is deployed until projects publish.
+
+```
+ghostdock projects create --display-name <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--display-name <string>` | Project name. Required. |
+
+MCP tool: `projects_create`.
+
+### `ghostdock projects deployments`
+
+Deployments of a project.
+
+### `ghostdock projects deployments get`
+
+Get one deploy attempt, with links to its stored files. fileUrls are authenticated GET paths for source.zip and generated Compose files.
+
+```
+ghostdock projects deployments get <deployment-id> --project-id <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<deployment-id>` | Deployment id, from projects deployments list. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--project-id <string>` | Project id, from projects list (projects publish returns it too). Required. |
+
+MCP tool: `projects_deployments_get`.
+
+### `ghostdock projects deployments list`
+
+List a project’s deploy attempts, newest first.
+
+```
+ghostdock projects deployments list <project-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `projects_deployments_list`.
+
+### `ghostdock projects env`
+
+Environment a project exports.
+
+### `ghostdock projects env delete`
+
+Delete one of a project’s own variables or secrets.
+
+```
+ghostdock projects env delete <name> --project-id <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--project-id <string>` | Project id, from projects list (projects publish returns it too). Required. |
+
+MCP tool: `projects_env_delete`.
+
+### `ghostdock projects env get`
+
+Get a project’s stored environment. Local entries (secret values withheld), organization opt-ins and bindings, applied on every deploy.
+
+```
+ghostdock projects env get <project-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `projects_env_get`.
+
+### `ghostdock projects env select`
+
+Replace the organization entries a project exports. Full replace: environment is the whole list ([] clears it), and omitting bindings clears the remaps. Read the environment skill (`ghostdock skills get environment`).
+
+```
+ghostdock projects env select <project-id> --environment <array> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--environment <array>` | Organization catalogue entry names to export under their own names. (JSON array) Required. |
+| `--bindings <array>` | Slot-centric org bindings. Omit to clear existing remaps. (JSON array) |
+
+MCP tool: `projects_env_select`.
+
+### `ghostdock projects env set`
+
+Create or replace one of a project’s own variables or secrets. Prefer the CLI for secret values so they stay out of the conversation.
+
+```
+ghostdock projects env set <name> --project-id <string> --value <string> --kind <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--project-id <string>` | Project id, from projects list (projects publish returns it too). Required. |
+| `--value <string>` | The value to store. A secret value can be replaced later but never read back. Required. |
+| `--kind <string>` | "variable" or "secret". A secret value can be replaced but never read back. Required. |
+| `--comment <string>` | Optional note shown with the entry, e.g. what it is for. |
+
+MCP tool: `projects_env_set`.
+
+### `ghostdock projects get`
+
+Get a project with its latest attempt and live deployment. latestDeploymentId includes failures; liveDeploymentId / liveUrl is the success that serves the public URL.
+
+```
+ghostdock projects get <project-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `projects_get`.
+
+### `ghostdock projects list`
+
+List an organization’s projects. A project owns its environment, deployment history and live URL. apps list lists live URLs instead.
+
+```
+ghostdock projects list [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `projects_list`.
+
+### `ghostdock projects publish`
+
+Inspect local source with the deploy agent and publish to the CDN or a sandbox.
+
+```
+ghostdock projects publish [path] [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--project-id <value>` | Existing project id. Omit to create a project. |
+| `--replan` | Force a new planner run even when the stored spec still matches. |
+| `--require-verify` | Fail the deploy (verify_failed) when detected tests fail. Default false: tests still run and are reported. |
+| `--spec <value>` | JSON DeploymentSpec to execute on a fresh sandbox instead of planning. Mutually exclusive with --replan. |
+| `--display-name <value>` | Optional display name. |
+| `--tag <value>` | Optional caller tag (git SHA or free-form label) stored on the deployment. |
+| `--auto-stop-interval-minutes <value>` | Same as `sandboxes create`. Omit for the 20-minute default. Pass -1 to keep it running. 0 is rejected. |
+| `--auto-delete-interval-minutes <value>` | Same as `sandboxes create`. Omit for the 14-day default. Pass 0 to delete the record when it stops, or -1 to keep it. |
+| `--resources <value>` | Same as `sandboxes create`: JSON { cpu, memoryGiB, diskGiB }. |
+| `--environment <value>` | Same as `sandboxes create --environment`: JSON { organization, bindings, local }. Required after awaiting_configuration. |
+| `--auto-wake <value>` | Same as `sandboxes urls create --auto-wake`. Default true for the minted URL. |
+| `--public <value>` | Same as `sandboxes urls create --public`. Default true for the minted URL. |
+| `--sandbox-provider-id <value>` | Same as `sandboxes create`: configured sandbox-provider instance id (omit for the organization default). |
+| `--zip <value>` | Local ZIP of the source tree. |
+| `<path>` | File or directory to publish (additional paths are allowed). |
+
+MCP tool: `projects_publish`.
+
+### `ghostdock projects redeploy`
+
+Deploy a project’s stored source again, with its current environment. No new upload. Omit deploymentId to retry the last attempt that stored source. Same outcomes and settings as projects publish; read the publishing skill (`ghostdock skills get publishing`).
+
+```
+ghostdock projects redeploy <project-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--deployment-id <string>` | Ship this version’s stored upload and spec. Omit to retry the last attempt that stored source. |
+| `--require-verify` | When true, a failing verify step stops the deploy (verify_failed) and tears the sandbox down. Default false. |
+| `--tag <string>` | Optional caller tag stored on the new deployment. Metadata only. |
+| `--resources <object>` | Compute sizing. For image/dockerfile/compose: layered on platform defaults when omitted. For snapshot: optional override applied via resize after create. (JSON object) |
+| `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the sandbox. -1 means always on. 0 is rejected. Omit for the platform default. Provider-native timers are optional backup. |
+| `--auto-delete-interval-minutes <number>` | Minutes the sandbox stays stopped before the platform worker deletes the record. 0 deletes it when it stops. -1 keeps it until a person deletes it. Omit for the platform default. Provider-native timers are optional backup. |
+| `--sandbox-provider-id <string>` | Configured sandbox-provider instance id from providers list (not the provider kind). Omit to use the organization default (the org choice, else the platform default); if that provider lacks a capability this create needs, the first listed provider that accepts new sandboxes and has it is used. When no provider fits, the call fails with a not-configured error. |
+| `--environment <object>` | Environment to give this sandbox. organization: names of organization entries (from env list) to export under their own names. bindings: remap org entries onto slot names ({ name: slot, organization: orgEntryName }). local: sandbox-only variables/secrets to create with the sandbox (kind required for each). Both land as ordinary process environment variables ($NAME / process.env.NAME); a local entry overrides an organization entry of the same name. When booting from an organization snapshot, omit organization/bindings/local to keep manifest env defaults, but still supply every name in requiredEnvironment (via organization, bindings, or local). Otherwise a sandbox gets nothing unless listed here. (JSON object) |
+| `--ephemeral` | Mark the sandbox ephemeral: every stop destroys the machine and the next start boots fresh, while the record, URLs, and settings stay. Omit to use the image label ghostdock.ephemeral, or false when that label is absent. Does not change idle-stop or auto-delete. |
+| `--auto-wake` | Same as urls[].autoWake on sandboxes create. Default true for the minted URL. |
+| `--public` | Same as urls[].public on sandboxes create. Default true for the minted URL. |
+
+MCP tool: `projects_redeploy`.
+
+### `ghostdock projects update`
+
+Rename a project.
+
+```
+ghostdock projects update <project-id> --display-name <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<project-id>` | Project id, from projects list (projects publish returns it too). Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--display-name <string>` | New name. Null or empty clears it. Required. |
+
+MCP tool: `projects_update`.
+
+## `ghostdock providers`
+
+Sandbox providers of an organization.
+
+### `ghostdock providers disconnect`
+
+Disconnect one of the organization’s own sandbox providers. Owner or admin. Fails while sandboxes still use it. If organization snapshots live on it, the first call fails: pass confirmLinkedDeletion to delete them permanently. Also frees its custom domain and removes incomplete Incus setups; a default provider falls back to the platform default.
+
+```
+ghostdock providers disconnect <sandbox-provider-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-provider-id>` | Sandbox provider id, from providers list. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--confirm-linked-deletion` | Required when this provider still has organization snapshots. Permanently deletes those snapshots, then disconnects. |
+
+MCP tool: `providers_disconnect`.
+
+### `ghostdock providers list`
+
+List the sandbox providers an organization can create sandboxes on. Includes its own connected providers and the platform providers it may use, in fallback order. Use an item id as sandboxProviderId. Only items with acceptsNewSandboxes true take new sandboxes; an own provider stays incomplete until customDomain.status is active. defaultSandboxProviderId is the effective default. Read the sandboxes skill (`ghostdock skills get sandboxes`) for the details.
+
+```
+ghostdock providers list [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `providers_list`.
+
+### `ghostdock providers rename`
+
+Rename one of the organization’s own sandbox providers. Owner or admin. Platform providers cannot be renamed; names must be unique in the organization.
+
+```
+ghostdock providers rename <sandbox-provider-id> --name <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-provider-id>` | Sandbox provider id, from providers list. Required. |
+| `--name <string>` | New name, unique in the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `providers_rename`.
+
+### `ghostdock providers set-default`
+
+Set the provider used when a create omits sandboxProviderId. Applies to sandboxes create, projects publish and projects redeploy. Pass an own connected provider or a platform provider that accepts new sandboxes; pass null (or platformDefaultSandboxProviderId) to follow the platform default. Owner or admin.
+
+```
+ghostdock providers set-default <sandbox-provider-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-provider-id>` | Instance id from providers list (own or platform), or null to follow the platform default. Passing platformDefaultSandboxProviderId also follows the platform default; it is never pinned. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `providers_set_default`.
+
+### `ghostdock providers start-incus`
+
+Start connecting an Incus host as a sandbox provider. Owner or admin. Returns sshPublicKey and aiSetupPrompt; then call providers verify-incus. To finish an incomplete setup, reuse it from providers list instead of starting again. Read the incus-setup skill (`ghostdock skills get incus-setup`) first.
+
+```
+ghostdock providers start-incus [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--name <string>` | Name for the new provider. Optional. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `providers_start_incus`.
+
+### `ghostdock providers verify-incus`
+
+Check or finish connecting an Incus host. Owner or admin. Connects over SSH with the stored key and checks Incus 6.3+, skopeo and umoci. Omit sshHost to re-check the stored address; pass it (with the other host fields) only to move the provider. A failed check marks the provider error. Read the incus-setup skill (`ghostdock skills get incus-setup`).
+
+```
+ghostdock providers verify-incus <sandbox-provider-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-provider-id>` | Sandbox provider id, from providers list. Required. |
+| `--ssh-host <string>` | Host to SSH to. Omit to re-check the stored address; pass it only to set up or move the provider. |
+| `--ssh-port <integer>` | SSH port. Default 22. |
+| `--ssh-user <string>` | SSH login. Default incus-user. |
+| `--ingress-host <string>` | Public hostname for HTTP(S) when it is not the SSH host (also the DNS A/AAAA target). |
+| `--ssh-proxy-port <integer>` | Port for sandbox SSH on the host. Default 2222. |
+| `--name <string>` | New name. Optional. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `providers_verify_incus`.
+
+## `ghostdock registry`
+
+Log in to the organization container registry.
+
+### `ghostdock registry credentials`
+
+Print registry host, username, and the one-hour password.
+
+```
+ghostdock registry credentials [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--provider <value>` | Sandbox provider id. Omit for the provider `sandboxes create` would pick (org default, else platform default, else the first that fits). |
+
+MCP tool: `registry_credentials`.
+
+### `ghostdock registry login`
+
+Fetch a one-hour password and run docker login --password-stdin.
+
+```
+ghostdock registry login [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--provider <value>` | Sandbox provider id. Omit for the provider `sandboxes create` would pick (org default, else platform default, else the first that fits). |
+
+## `ghostdock sandboxes`
+
+Create, run and manage sandboxes.
+
+### `ghostdock sandboxes build`
+
+Create a sandbox from a local Dockerfile or Compose directory. Zips the directory (or takes --zip) and builds it on the sandbox provider; use it when the Dockerfile copies local files or the Compose project has build contexts.
+
+```
+ghostdock sandboxes build [path] --kind <value> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--kind <value>` | dockerfile or compose. Required. |
+| `--sandbox-provider-id <value>` | Configured sandbox-provider instance id (omit for the organization default). |
+| `--display-name <value>` | Optional sandbox display name. |
+| `--zip <value>` | Local ZIP of the build directory (Dockerfile or compose file at the zip root). |
+| `<path>` | Build directory to zip and create from. |
+
+### `ghostdock sandboxes commands`
+
+Run commands in a sandbox and read their output.
+
+### `ghostdock sandboxes commands get`
+
+Get a shell command’s status and exit code.
+
+```
+ghostdock sandboxes commands get <command-id> --sandbox-id <string> --session-id <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<command-id>` | Command id returned by sandboxes commands run. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--session-id <string>` | Session id returned by sandboxes commands run together with the commandId. Required. |
+
+MCP tool: `sandboxes_commands_get`.
+
+### `ghostdock sandboxes commands kill`
+
+Interrupt a running shell command.
+
+```
+ghostdock sandboxes commands kill <command-id> --sandbox-id <string> --session-id <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<command-id>` | Command id returned by sandboxes commands run. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--session-id <string>` | Session id returned by sandboxes commands run together with the commandId. Required. |
+
+MCP tool: `sandboxes_commands_kill`.
+
+### `ghostdock sandboxes commands logs`
+
+Get a page of a shell command’s stdout and stderr.
+
+```
+ghostdock sandboxes commands logs <command-id> --sandbox-id <string> --session-id <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<command-id>` | Command id returned by sandboxes commands run. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--session-id <string>` | Session id returned by sandboxes commands run together with the commandId. Required. |
+| `--offset <integer>` | Character offset to continue reading from. Default 0. |
+
+MCP tool: `sandboxes_commands_logs`.
+
+### `ghostdock sandboxes commands run`
+
+Run a shell command in a sandbox. Waits up to 120 seconds, then returns sessionId and commandId to poll. Starts the sandbox when allowed. Sessions do not survive idle-stop: for a process that must keep running, read the sandbox-boot skill (`ghostdock skills get sandbox-boot`). Never put secret values in the command; it is logged.
+
+```
+ghostdock sandboxes commands run <sandbox-id> --command <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--command <string>` | Shell command to run. Never include secret values: commands are logged. Required. |
+| `--session-id <string>` | Session from sandboxes shells create, to keep cwd and environment from earlier commands. Omit for a one-off session. |
+| `--cwd <string>` | Directory to run the command in. |
+| `--wait-seconds <number>` | Seconds to wait before returning handles to poll: 1 to 120, default 120. |
+
+MCP tool: `sandboxes_commands_run`.
+
+### `ghostdock sandboxes create`
+
+Create a sandbox from a snapshot, OCI image, Dockerfile or Compose files. Inline content only: for a directory or ZIP (Dockerfile COPY/ADD, Compose build files) use `ghostdock sandboxes build`. Snapshots and catalog images can require environment entries, URL ports and MCP names (requiredEnvironment / requiredUrls / requiredMcps); a missing environment entry fails with its names (missingEnvironment), and removing a required URL or MCP fails with them (missingUrls / missingMcps). Returns once the sandbox is running, with `boot`: how long the sandbox (VM) and, when one was started, its container took to start, each in ms. Idle-stop and auto-delete apply (defaults 20 minutes / 14 days). Read the sandboxes skill (`ghostdock skills get sandboxes`) for sources, manifests, lifecycle and providers.
+
+```
+ghostdock sandboxes create --source <object> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--display-name <string>` | Display name for the sandbox. Optional. |
+| `--source <object>` | What the sandbox boots from. Required. "image" boots an org catalog row by id ({ id } from images list / images get — images add OCI bookmarks, images add-dockerfile, and images add-compose rows) or any OCI ref ({ ref }); "dockerfile" builds inline Dockerfile text only (ghostdock.* LABEL lines parsed for manifest; this tool has no build directory, so COPY/ADD of local files fails — use the CLI `ghostdock sandboxes build --kind dockerfile` with a directory or ZIP); "compose" boots Docker-in-Docker from the given inline files (must include docker-compose.yml/yaml or compose.yml/yaml; ghostdock.* service labels parsed for manifest). A Compose project that needs extra files is not accepted here — use `ghostdock sandboxes build --kind compose`. Image, dockerfile, and compose sources never appear in snapshots list. Published static sites use sites publish (CDN), not a snapshot. (JSON object) Required. |
+| `--resources <object>` | Compute sizing. For image/dockerfile/compose: layered on platform defaults when omitted. For snapshot: optional override applied via resize after create. (JSON object) |
+| `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the sandbox. -1 means always on. 0 is rejected. Omit for the platform default. Provider-native timers are optional backup. |
+| `--auto-delete-interval-minutes <number>` | Minutes the sandbox stays stopped before the platform worker deletes the record. 0 deletes it when it stops. -1 keeps it until a person deletes it. Omit for the platform default. Provider-native timers are optional backup. |
+| `--sandbox-provider-id <string>` | Configured sandbox-provider instance id from providers list (not the provider kind). Omit to use the organization default (the org choice, else the platform default); if that provider lacks a capability this create needs, the first listed provider that accepts new sandboxes and has it is used. When no provider fits, the call fails with a not-configured error. |
+| `--environment <object>` | Environment to give this sandbox. organization: names of organization entries (from env list) to export under their own names. bindings: remap org entries onto slot names ({ name: slot, organization: orgEntryName }). local: sandbox-only variables/secrets to create with the sandbox (kind required for each). Both land as ordinary process environment variables ($NAME / process.env.NAME); a local entry overrides an organization entry of the same name. When booting from an organization snapshot, omit organization/bindings/local to keep manifest env defaults, but still supply every name in requiredEnvironment (via organization, bindings, or local). Otherwise a sandbox gets nothing unless listed here. (JSON object) |
+| `--ephemeral` | Mark the sandbox ephemeral: every stop destroys the machine and the next start boots fresh, while the record, URLs, and settings stay. Omit to use the image label ghostdock.ephemeral, or false when that label is absent. Does not change idle-stop or auto-delete. |
+| `--urls <array>` | Changes to the image’s or snapshot’s URLs, keyed by port. Omit for the image URLs as they are; otherwise you get the image URLs plus yours: an entry on the same port replaces that URL completely (omitted fields take their defaults), and { port, remove: true } drops it; removing a port the image does not declare does nothing. A required port cannot be removed. TCP URLs are always public. (JSON array) |
+| `--mcps <array>` | Changes to the image’s or snapshot’s MCP exposures, keyed by name. Omit for the image MCPs as they are; otherwise you get the image MCPs plus yours: an entry with the same name replaces that MCP completely, and { name, remove: true } drops it; removing a name the image does not declare does nothing. A required MCP (requiredMcps) cannot be removed. (JSON array) |
+
+MCP tool: `sandboxes_create`.
+
+### `ghostdock sandboxes delete`
+
+Permanently delete a sandbox and its files.
+
+```
+ghostdock sandboxes delete <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_delete`.
+
+### `ghostdock sandboxes env`
+
+Environment of one sandbox.
+
+### `ghostdock sandboxes env delete`
+
+Delete one of a sandbox’s own variables or secrets.
+
+```
+ghostdock sandboxes env delete <name> --sandbox-id <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--restart` | When true and the sandbox is running, stop then start after saving so processes pick up the change. Default: sync only. |
+
+MCP tool: `sandboxes_env_delete`.
+
+### `ghostdock sandboxes env get`
+
+Get a sandbox’s environment: selections, bindings and local entries. Shows each organization entry with whether it is selected, exportAs, and overriddenByLocal; secret values are withheld. Nothing is inherited.
+
+```
+ghostdock sandboxes env get <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_env_get`.
+
+### `ghostdock sandboxes env select`
+
+Replace the organization entries a sandbox exports. Full replace: environment is the whole list ([] clears it), and omitting bindings clears the remaps. Running processes keep their old values until restarted (pass restart). Read the environment skill (`ghostdock skills get environment`).
+
+```
+ghostdock sandboxes env select <sandbox-id> --environment <array> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--environment <array>` | Organization catalogue entry names to export under their own names. Pass [] to clear plain selections. (JSON array) Required. |
+| `--bindings <array>` | Slot-centric org bindings: export an organization entry under a (possibly different) sandbox env name. Omit to clear existing remaps (full replace). (JSON array) |
+| `--restart` | When true and the sandbox is running, stop then start after saving so processes pick up the change. Default: sync only; already-running processes keep the old values until restarted. |
+
+MCP tool: `sandboxes_env_select`.
+
+### `ghostdock sandboxes env set`
+
+Create or replace one of a sandbox’s own variables or secrets. It overrides an organization entry of the same name. kind is required when creating. Setting secrets via this tool is allowed; prefer the Ghostdock CLI so values stay out of the conversation, and never put them in commands.
+
+```
+ghostdock sandboxes env set <name> --sandbox-id <string> --value <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<name>` | Environment variable name, e.g. DATABASE_URL. Letters, digits and underscores only. Case-sensitive; stored exactly as provided. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--value <string>` | The value to store. A secret value can be replaced later but never read back. Required. |
+| `--kind <string>` | Required when creating. Use "secret" for credentials; secret values can be replaced but never read back. Omit when updating to keep the existing kind. |
+| `--comment <string>` | Optional note shown with the entry, e.g. what it is for. |
+| `--restart` | When true and the sandbox is running, stop then start after saving so processes pick up the change. Default: sync only. |
+
+MCP tool: `sandboxes_env_set`.
+
+### `ghostdock sandboxes files`
+
+Files inside a sandbox.
+
+### `ghostdock sandboxes files list`
+
+List the files in a sandbox directory (default /workspace).
+
+```
+ghostdock sandboxes files list <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--path <string>` | Directory to list. Absolute or relative to /. Defaults to /workspace. |
+
+MCP tool: `sandboxes_files_list`.
+
+### `ghostdock sandboxes files read`
+
+Read a file from a sandbox: utf8 text, or base64 for small binaries.
+
+```
+ghostdock sandboxes files read <path> --sandbox-id <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<path>` | File path. Absolute or relative to / (for example /workspace/src/App.vue). Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+
+MCP tool: `sandboxes_files_read`.
+
+### `ghostdock sandboxes files upload`
+
+Upload local files or directories to a sandbox using multipart form data.
+
+```
+ghostdock sandboxes files upload <sandbox-id> [path] [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name or id. Required. |
+| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--zip <value>` | Local ZIP file to upload. |
+| `<path>` | File or directory to upload (additional paths are allowed). |
+
+MCP tool: `sandboxes_files_upload`.
+
+### `ghostdock sandboxes list`
+
+List the sandboxes of an organization, including whether each is ephemeral. Each has a name (e.g. quiet-harbor), unique in the organization, that every sandbox tool accepts as sandboxId.
+
+```
+ghostdock sandboxes list [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_list`.
+
+### `ghostdock sandboxes mcps`
+
+MCP endpoints a sandbox exposes.
+
+### `ghostdock sandboxes mcps create`
+
+Expose an MCP server running in a sandbox. Idempotent by name.
+
+```
+ghostdock sandboxes mcps create <sandbox-id> --name <string> --port <integer> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--name <string>` | Endpoint name, unique in the sandbox. Letters, digits, _ and -, starting with a letter. Required. |
+| `--port <integer>` | Port the MCP server listens on inside the sandbox. Required. |
+| `--path <string>` | HTTP path of the MCP endpoint. Default /mcp. |
+| `--auto-wake` | Start the sandbox when the endpoint is called while it is stopped. Default false. |
+
+MCP tool: `sandboxes_mcps_create`.
+
+### `ghostdock sandboxes mcps delete`
+
+Delete an MCP endpoint of a sandbox.
+
+```
+ghostdock sandboxes mcps delete <mcp-id>
+```
+
+| Argument | Description |
+| --- | --- |
+| `<mcp-id>` | MCP endpoint id, from sandboxes mcps list or sandboxes mcps create. Required. |
+
+MCP tool: `sandboxes_mcps_delete`.
+
+### `ghostdock sandboxes mcps list`
+
+List the MCP endpoints a sandbox exposes (name, port, path, autoWake).
+
+```
+ghostdock sandboxes mcps list <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_mcps_list`.
+
+### `ghostdock sandboxes mcps update`
+
+Change an MCP endpoint’s name, port, path or autoWake setting.
+
+```
+ghostdock sandboxes mcps update <mcp-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<mcp-id>` | MCP endpoint id, from sandboxes mcps list or sandboxes mcps create. Required. |
+| `--name <string>` | New endpoint name. Omit to keep it. |
+| `--port <integer>` | New port inside the sandbox. Omit to keep it. |
+| `--path <string>` | New HTTP path. Omit to keep it. |
+| `--auto-wake` | Start the sandbox when the endpoint is called while it is stopped. Omit to keep it. |
+
+MCP tool: `sandboxes_mcps_update`.
+
+### `ghostdock sandboxes resize`
+
+Change a sandbox’s CPU and/or memory. While running only increases are allowed; stop it first to decrease (this tool does not stop it). Disk: sandboxes resize-disk.
+
+```
+ghostdock sandboxes resize <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--cpu <number>` | Number of CPUs. |
+| `--memory-gib <number>` | Memory in GiB. |
+
+MCP tool: `sandboxes_resize`.
+
+### `ghostdock sandboxes resize-disk`
+
+Grow a sandbox’s disk. The sandbox must be stopped first (this tool does not stop it). Disk only grows, never shrinks.
+
+```
+ghostdock sandboxes resize-disk <sandbox-id> --disk-gib <number> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--disk-gib <number>` | New total disk size in GiB; must be larger than the current size. Required. |
+
+MCP tool: `sandboxes_resize_disk`.
+
+### `ghostdock sandboxes set-boot`
+
+Register a command that starts now and again after every restart. For example bun dev. On Compose it runs after the stack; on a Dockerfile it replaces the image CMD. Snapshots cannot register one. Read the sandbox-boot skill (`ghostdock skills get sandbox-boot`).
+
+```
+ghostdock sandboxes set-boot <sandbox-id> --command <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--command <string>` | Command to start, e.g. bun dev. Required. |
+| `--cwd <string>` | Directory to run it in. Default /. |
+| `--start` | Also start it now, not only after restarts. Default true. |
+
+MCP tool: `sandboxes_set_boot`.
+
+### `ghostdock sandboxes shells`
+
+Shell sessions that keep cwd and environment between commands.
+
+### `ghostdock sandboxes shells close`
+
+Close a shell session.
+
+```
+ghostdock sandboxes shells close <session-id> --sandbox-id <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<session-id>` | Session id from sandboxes shells create. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+
+MCP tool: `sandboxes_shells_close`.
+
+### `ghostdock sandboxes shells create`
+
+Open a shell session that keeps cwd and environment between commands. Starts the sandbox when allowed; the session ends at idle-stop.
+
+```
+ghostdock sandboxes shells create <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--session-id <string>` | Id for the new session: a slug; user-cmd, image-cmd and compose are reserved. Omit to generate one. |
+
+MCP tool: `sandboxes_shells_create`.
+
+### `ghostdock sandboxes ssh`
+
+SSH access to a sandbox.
+
+### `ghostdock sandboxes ssh get`
+
+Get temporary SSH access to a sandbox (command and token, 60 minutes). Starts the sandbox when needed. Idle-stop still applies, independent of the token.
+
+```
+ghostdock sandboxes ssh get <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_ssh_get`.
+
+### `ghostdock sandboxes ssh revoke`
+
+Revoke a sandbox’s active SSH access.
+
+```
+ghostdock sandboxes ssh revoke <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_ssh_revoke`.
+
+### `ghostdock sandboxes status`
+
+Get a sandbox’s status and lifecycle deadlines without waking it. Returns idleStopsAt, deletesAt and `boot` (the last start: sandbox and container times in ms) and does not reset idle activity.
+
+```
+ghostdock sandboxes status <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_status`.
+
+### `ghostdock sandboxes stop`
+
+Stop a running sandbox without deleting its files.
+
+```
+ghostdock sandboxes stop <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_stop`.
+
+### `ghostdock sandboxes tools`
+
+Tools of the MCP servers inside a sandbox.
+
+### `ghostdock sandboxes tools call`
+
+Call a tool on an MCP server inside a sandbox. Wakes a stopped sandbox when the endpoint has autoWake.
+
+```
+ghostdock sandboxes tools call <name> --sandbox-id <string> --arguments <object> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<name>` | Tool name, from sandboxes tools list. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--arguments <object>` | Tool arguments as a JSON object. (JSON object) Required. |
+| `--mcp-name <string>` | MCP endpoint to call. Needed when several endpoints expose the same tool name. |
+
+MCP tool: `sandboxes_tools_call`.
+
+### `ghostdock sandboxes tools list`
+
+List the tools of the MCP servers a sandbox exposes. A server that cannot be reached is reported in errors; the others are still listed.
+
+```
+ghostdock sandboxes tools list <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--mcp-name <string>` | Only list the tools of this MCP endpoint. |
+
+MCP tool: `sandboxes_tools_list`.
+
+### `ghostdock sandboxes update`
+
+Change a sandbox’s display name, idle-stop or auto-delete interval. Omit a field to keep it; null resets it to the platform default.
+
+```
+ghostdock sandboxes update <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--display-name <string>` | New display name. Null clears it; omit to keep it. |
+| `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the sandbox. -1 always on. 0 is rejected. Null resets to the platform default. Provider-native timers are optional backup. |
+| `--auto-delete-interval-minutes <number>` | Minutes the sandbox stays stopped before the record is deleted. 0 deletes it when it stops. -1 keeps it. Null resets to the platform default. Provider-native timers are optional backup. |
+
+MCP tool: `sandboxes_update`.
+
+### `ghostdock sandboxes urls`
+
+URLs that expose sandbox ports.
+
+### `ghostdock sandboxes urls create`
+
+Expose a sandbox port as a URL. Idempotent by port: when the sandbox already has a URL on that port, it is returned unchanged (autoWake, public and title are not applied); use sandboxes urls update to change it. HTTP defaults to private with no wake-on-visit; TCP URLs use TLS (not HTTP) and are always public — for a private port use sandboxes ssh get and an SSH forward. Read the sandboxes skill (`ghostdock skills get sandboxes`) for TCP clients.
+
+```
+ghostdock sandboxes urls create <sandbox-id> --port <integer> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--port <integer>` | Port inside the sandbox to expose. Required. |
+| `--protocol <string>` | "http" (default) or "tcp". TCP URLs use TLS and are always public. |
+| `--auto-wake` | Start the sandbox when the URL is visited while it is stopped. Default false. |
+| `--public` | Reachable without signing in. Default false; TCP URLs are always public. |
+| `--title <string>` | Name shown for the URL, up to 40 characters. A titled HTTP URL gets its own button on the sandbox card; TCP titles are shown in URL lists. Untitled HTTP URLs are listed under "Open URL". |
+
+MCP tool: `sandboxes_urls_create`.
+
+### `ghostdock sandboxes urls delete`
+
+Delete a sandbox URL.
+
+```
+ghostdock sandboxes urls delete <url-id>
+```
+
+| Argument | Description |
+| --- | --- |
+| `<url-id>` | Sandbox URL id, from sandboxes urls list or sandboxes urls create. Required. |
+
+MCP tool: `sandboxes_urls_delete`.
+
+### `ghostdock sandboxes urls list`
+
+List the URLs that expose a sandbox’s ports, with protocol, access and title. A titled URL (for example `Desktop`, the desktop image’s desktop in a browser) gets its own button in the app.
+
+```
+ghostdock sandboxes urls list <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_urls_list`.
+
+### `ghostdock sandboxes urls update`
+
+Change a sandbox URL’s port, protocol, autoWake, public setting or title. TCP cannot be private.
+
+```
+ghostdock sandboxes urls update <url-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<url-id>` | Sandbox URL id, from sandboxes urls list or sandboxes urls create. Required. |
+| `--port <integer>` | New port inside the sandbox. Omit to keep it. |
+| `--protocol <string>` | "http" or "tcp". Omit to keep the current protocol. |
+| `--auto-wake` | Start the sandbox when the URL is visited while it is stopped. Omit to keep it. |
+| `--public` | Reachable without signing in. Omit to keep it; TCP cannot be made private. |
+| `--title <string>` | Name shown for the URL, up to 40 characters. A titled HTTP URL gets its own button on the sandbox card; TCP titles are shown in URL lists. Untitled HTTP URLs are listed under "Open URL". Omit to keep it; null removes it. |
+
+MCP tool: `sandboxes_urls_update`.
+
+### `ghostdock sandboxes wake`
+
+Start a stopped sandbox, or reset the idle-stop countdown of a running one. Returns status, idleStopsAt / deletesAt, and `boot` (sandbox and container start times in ms; null when it was already running).
+
+```
+ghostdock sandboxes wake <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_wake`.
+
+## `ghostdock sites`
+
+Static sites on the CDN.
+
+### `ghostdock sites publish`
+
+Publish a local directory or ZIP to the CDN.
+
+```
+ghostdock sites publish [path] [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <value>` | Organization id or slug, from `ghostdock organizations list` (default: GHOSTDOCK_ORG, then `ghostdock organizations use`). |
+| `--display-name <value>` | Optional site display name. |
+| `--zip <value>` | Local ZIP file to publish. |
+| `<path>` | File or directory to publish (additional paths are allowed). |
+
+MCP tool: `sites_publish`.
+
+### `ghostdock sites unpublish`
+
+Take a published static site offline.
+
+```
+ghostdock sites unpublish <site-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<site-id>` | Site id: the slug in the public URL, as returned by sites publish or apps list. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sites_unpublish`.
+
+## `ghostdock skills`
+
+List and read Agent Skills (same catalog as MCP skill://index.json).
+
+### `ghostdock skills get`
+
+Print one SKILL.md (URI from the discovery index, or a skill name).
+
+```
+ghostdock skills get <uri>
+```
+
+| Argument | Description |
+| --- | --- |
+| `<uri>` | skill:// URI, org/name, or skill name. Required. |
+
+MCP tool: `skills_get`.
+
+### `ghostdock skills list`
+
+List the Agent Skills discovery index.
+
+```
+ghostdock skills list
+```
+
+MCP tool: `skills_list`.
+
+## `ghostdock snapshots`
+
+Sandbox snapshots.
+
+### `ghostdock snapshots create`
+
+Save a sandbox’s filesystem as a reusable organization snapshot. The sandbox must be stopped, unless stopAndResume. Captures its URLs and environment into a manifest (secrets as required, without values). Waits up to ~120 seconds; if still pending it returns timedOut, then poll snapshots get. Setting secret values here is allowed; prefer the Ghostdock CLI so they stay out of the conversation.
+
+```
+ghostdock snapshots create <sandbox-id> --name <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--name <string>` | Snapshot name, unique in the organization. Required. |
+| `--stop-and-resume` | When the sandbox is running: stop it, snapshot, then start it again. Without this it must already be stopped. |
+| `--include-secret-values <array>` | Names of sandbox-local secrets whose values to embed in the snapshot. Organization secrets cannot be copied. (JSON array) |
+| `--manifest <object>` | Replaces the captured URLs and environment entirely (no merge). An omitted ephemeral is copied from the sandbox. Secret values are stored encrypted. (JSON object) |
+
+MCP tool: `snapshots_create`.
+
+### `ghostdock snapshots delete`
+
+Permanently delete an organization snapshot (provider artifact and record).
+
+```
+ghostdock snapshots delete <snapshot-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<snapshot-id>` | Snapshot id from snapshots list (the provider snapshot name) or its database id. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `snapshots_delete`.
+
+### `ghostdock snapshots get`
+
+Get one snapshot with its manifest and required environment, URLs and MCPs. Returns a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps. Poll it after snapshots create while status is pending.
+
+```
+ghostdock snapshots get <snapshot-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<snapshot-id>` | Snapshot id from snapshots list (the provider snapshot name) or its database id. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `snapshots_get`.
+
+### `ghostdock snapshots list`
+
+List the snapshots an organization can boot sandboxes from. Each item has status (pending, active, error), the provider that holds it (sandboxProviderId; boot it there), sandboxCount, and a redacted manifest with requiredEnvironment / requiredUrls / requiredMcps.
+
+```
+ghostdock snapshots list [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `snapshots_list`.
+
+### `ghostdock snapshots update-manifest`
+
+Replace a snapshot’s manifest (URLs, environment, MCPs). Does not change the snapshot itself. Secret values in the body are stored encrypted; the response is redacted. Setting secret values here is allowed; prefer the Ghostdock CLI so they stay out of the conversation.
+
+```
+ghostdock snapshots update-manifest <snapshot-id> --manifest <object> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<snapshot-id>` | Snapshot id from snapshots list (the provider snapshot name) or its database id. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--manifest <object>` | The new manifest; replaces the stored one. An omitted ephemeral keeps the stored value. Secret values are stored encrypted. (JSON object) Required. |
+
+MCP tool: `snapshots_update_manifest`.
+
+## `ghostdock tools`
+
+List available agent tools.
+
+```
+ghostdock tools
+```
+
+## `ghostdock whoami`
+
+Show the account this CLI is currently authenticated as.
+
+```
+ghostdock whoami
+```