pi-microsandbox 0.1.1 → 0.3.0

package/docs/safety.md

@@ -4,30 +4,58 @@
 
 The default is fail-closed:
 
-- A valid, trusted project configuration is resolved before a sandbox is
-  started. A boot or image/tool failure blocks the seven routed tools (`read`,
-  `write`, `edit`, `ls`, `find`, `grep`, and `bash`).
-- `mode = "auto"` is retained as an alias for `"direct"`; both use a
-  same-absolute-path read/write bind. `mode = "git"`, `"direct"`, and
-  `"none"` select those behaviors explicitly.
+- A valid, trusted project configuration is resolved before a sandbox starts. A
+  boot, image, configuration, or tool failure blocks the seven routed tools
+  (`read`, `write`, `edit`, `ls`, `find`, `grep`, and `bash`). Failure never
+  silently falls back to host execution.
 - `execution_target = "host"` is an opt-in escape for routed tool calls. While
-  a sandbox is active it requires an interactive approval for the exact tool,
-  working directory, and recursively sorted arguments. It is not available in
+  a sandbox is active it requires interactive approval for the exact tool,
+  working directory, and recursively sorted arguments. It is unavailable in
   headless operation and is never silently selected.
 - `/msb off` is an explicit host-mode handoff and does not prompt. This is
   different from `fallback_mode = "host"`, which automatically uses host tools
-  after a sandbox failure and is shown as `MSB host fallback`.
+  after a sandbox failure and is shown as `MSB host fallback`. Both are
+  unsandboxed controls, not workspace settings.
 - A project cannot replace another process's sandbox: ownership is a
-  non-blocking kernel `flock` acquired before any sandbox or volume mutation.
-  The small bundled POSIX addon is loaded lazily, has no install script, and
-  never falls back to a racy PID check. Stale sandbox pruning never removes
-  volumes.
+  non-blocking kernel `flock` acquired before sandbox mutation. The small
+  bundled POSIX addon is loaded lazily, has no install script, and never falls
+  back to a racy PID check.
+
+There are no workspace modes. Inside a Git worktree, pi-microsandbox
+bind-mounts the entire worktree root read/write at the same lexical guest path.
+Outside Git, it bind-mounts the current directory. Commands start in the
+original current directory, but their path boundary is the selected root.
+
+This mount deliberately exposes host files. A Git worktree mount includes
+`.git`, untracked files, secrets such as `.env`, and sibling directories even
+when Pi starts in a subdirectory. Writes are immediately visible on the host,
+and separate sessions using the same checkout can read or overwrite one
+another's work. Use separate host worktrees or checkouts for isolation between
+sessions. Unsafe root mappings fail startup rather than falling back to a
+narrower mount.
 
 The extension entry point does not import the native SDK or load the flock
 addon. Unsupported hosts can still load Pi and remain blocked or explicitly
 off. pi-microsandbox supports Apple Silicon macOS and GNU Linux x86_64 or arm64
 with KVM; Windows, Intel macOS, and musl Linux are not supported.
 
+## Docker inside the guest
+
+The Docker daemon runs inside the microVM and listens only on the guest Unix
+socket. Access to that socket is root-equivalent inside the guest, not on the
+host. Readiness probes explicitly select that socket and reject unverified
+socket ownership. Docker and process-control environment variables are cleared
+for preparation, and configuration cannot forward them. Mounts that shadow
+protected guest executables or Docker runtime paths are rejected. The extension
+never mounts the host Docker socket, starts a host daemon, or copies host Docker
+configuration and registry credentials into the guest.
+
+A nested container can still reach anything mounted into the microVM, including
+the entire selected workspace and explicitly configured mounts. Treat a
+Dockerfile or Compose file as guest-root code and use read-only extra mounts
+where possible. Container egress remains behind the Microsandbox network
+policy.
+
 ## Host-read exceptions
 
 Pi-discovered `SKILL.md` reads are a narrow host-read exception. A standalone
@@ -39,4 +67,5 @@ become readable.
 
 ## Reporting vulnerabilities
 
-Report suspected vulnerabilities privately. See the [security policy](../SECURITY.md); do not open a public issue.
+Report suspected vulnerabilities privately. See the
+[security policy](../SECURITY.md); do not open a public issue.

package/docs/storage.md

@@ -1,57 +1,70 @@
-# Storage modes and retained work
+# Workspace storage
 
 [Back to README](../README.md)
 
-## Storage modes
-
-| Mode | Guest view | Host effect of routed writes |
-| --- | --- | --- |
-| `git` | A named volume at the repository root, with the same absolute path | Volume only |
-| `direct` | The current directory bind-mounted at the same absolute path | Host directory |
-| `none` | An empty tmpfs at the same absolute path | No host files; changes disappear with the sandbox |
-| `auto` | Same as `direct` | Host directory |
-
-`direct` is intentionally a warning-level escape from the Git isolation model:
-routed edits modify the live host directory. `none` is useful for testing path
-behavior and starts empty; it is not a retained workspace.
-
-## Git and retained volumes
-
-Git mode never bind-mounts the host checkout. On boot, pi-microsandbox captures the
-committed `HEAD` (and selected branch) into a temporary verified Git bundle,
-copies it into the guest, and seeds a named volume mounted at the repository's
-absolute root. Untracked files, including `.env`, and working-tree edits are
-not in that bundle. The temporary host and guest bundle files are removed after
-seeding, including failure paths.
-
-Edits and commits made in Git mode land in the retained volume. The host
-checkout is not changed by ordinary routed tools. A normal Pi session shutdown
-removes the sandbox but keeps the managed volume; the next boot reuses it only
-when the complete session/schema/mode/cwd identity matches. A copied or forked
-session state is rejected by the full session ID and gets a different resource
-identity.
-
-The SDK's `VolumeHandle` returned by `Volume.get()` does not expose a host
-path. pi-microsandbox therefore refuses to fabricate one: a newly created volume
-may show its path, while a later retained-volume lookup may not support
-`/msb volumes ls` or volume enrichment. The volume remains mountable by name
-and is never automatically deleted. Use the path recorded at creation time or
-the microsandbox volume tooling when host-side inspection is required.
-
-To manually synchronize a retained checkout, use a host-side fetch deliberately
-(the command is not performed automatically by pi-microsandbox):
+## One read/write workspace
+
+There are no workspace modes. pi-microsandbox selects one workspace root when
+it starts:
+
+- If the current working directory is inside a Git worktree, it mounts the
+  entire worktree root.
+- Otherwise, it mounts the current working directory itself.
+
+The selected root is bind-mounted read/write at the same lexical path inside
+the guest. Commands still start in the original current working directory.
+Writes are immediately visible in the host directory; there is no export or
+synchronization step.
+
+Starting Pi below a Git worktree root does not narrow the boundary. The sandbox
+can see the whole worktree, including `.git`, untracked files, sibling
+directories, and files such as `.env`. Separate Pi sessions that use the same
+checkout also use the same files, so their edits can conflict. Use separate
+host worktrees or checkouts when tasks need independent workspaces.
+
+The extension creates one project bind mount. Linked-worktree or submodule Git
+metadata stored outside the selected worktree root is not mounted separately.
+An unsupported path or symlink layout fails startup instead of silently
+mounting a narrower directory.
+
+## Inner Docker state
+
+Docker stores images, layers, containers, and build cache under
+`/var/lib/docker` on the sandbox root filesystem. It uses the `vfs` storage
+driver because nested overlay filesystems and project-backed mounts cannot be
+assumed to support `overlay2`. This state disappears when the sandbox is
+removed and is not written to the project mount. Separate sessions do not share
+an inner Docker cache.
+
+Containers started inside the microVM can reach the mounted workspace. Treat
+Dockerfiles and Compose files as code with access to the entire selected root.
+
+## Upgrading from named Git volumes
+
+Older releases could keep Git workspaces in named `pi-msb-vol-*` volumes. The
+new workspace behavior does not reconnect, migrate, or delete those volumes.
+They may contain the only copy of unexported work.
+
+Before upgrading, while the old `/msb volumes` and `/msb export` commands are
+still available, inventory every retained volume and export or copy any work
+you need. After upgrading, use Microsandbox itself:
+
+```sh
+msb volume ls
+mkdir -p ./legacy-workspace-recovery
+msb run --name pi-msb-recovery \
+  --mount-named pi-msb-vol-REPLACE_ME:/legacy:ro \
+  --mount-dir "$PWD/legacy-workspace-recovery:/recovery:rw" \
+  alpine -- sh -c 'cp -a /legacy/. /recovery/'
+msb rm pi-msb-recovery
+```
+
+Verify the copied files, then remove the old volume with:
 
 ```sh
-REPO=/absolute/path/to/checkout
-VOLUME_PATH=/path/returned-for-the-managed-volume
-BRANCH=$(git -C "$REPO" branch --show-current)
-
-git -C "$VOLUME_PATH" remote remove host 2>/dev/null || true
-git -C "$VOLUME_PATH" remote add host "$REPO"
-git -C "$VOLUME_PATH" fetch --no-tags host "$BRANCH"
-# Review before changing the retained checkout:
-git -C "$VOLUME_PATH" log --oneline --decorate --all -10
+msb volume rm pi-msb-vol-REPLACE_ME
 ```
 
-The host repository is an input to this explicit sync operation. Do not add a
-host checkout bind mount to Git mode.
+Copy the exact name from `msb volume ls`: a mistyped named mount can create a
+new empty volume. Choose an already-cached recovery image if `alpine` is
+unavailable. pi-microsandbox no longer lists, removes, or exports volumes.

package/docs/troubleshooting.md

@@ -4,17 +4,62 @@
 
 1. Run `/msb status` and `/msb logs`.
 2. If the state is `unavailable (blocked)`, fix the displayed configuration,
-   image, virtualization, or missing-tool error and run `/msb reload`.
+   image, virtualization, path, or missing-tool error and run `/msb reload`.
+   Startup failures fail closed; routed tools do not silently run on the host.
 3. If a process died, a later startup or `/msb prune` can remove its labelled
-   sandbox after the owner lock is free. The named volume is retained.
-4. If a same-name resource has different managed labels, pi-microsandbox refuses to
-   attach or replace it. Remove only a verified managed, unmounted volume with
-   `/msb volumes rm NAME --yes`.
-5. On unsupported virtualization hosts, use `PI_MSB_DISABLE=1` for explicit host
-   mode or configure `fallback_mode = "host"` knowingly. The latter remains
-   visibly distinct from `/msb off`.
+   sandbox after the owner lock is free.
+4. If a same-name resource has different managed labels, pi-microsandbox
+   refuses to attach or replace it. Verify the resource with Microsandbox's
+   tooling before removing it.
+5. On unsupported virtualization hosts, use `PI_MSB_DISABLE=1` or `/msb off`
+   for explicit host mode, or configure `fallback_mode = "host"` knowingly.
+   Automatic fallback remains visibly distinct from explicit off mode; both are
+   unsandboxed.
 6. For bootstrap failures, use an image that already contains the required
    command list or allow the configured network policy to reach the package
    repositories. Deny mode cannot bootstrap an image missing those commands.
 
-For installation prerequisites, see [installation and requirements](getting-started.md). To test a live sandbox from source, see the [live test matrix](development.md#live-test-matrix).
+There are no workspace modes. A cwd inside Git mounts the entire worktree root
+read/write at the same guest path; any other cwd mounts itself. If startup fails
+because the selected root or symlink layout cannot be represented safely, fix
+the host path rather than expecting a narrower mount. Remember that writes are
+immediate, `.git`, secrets, untracked files, and sibling directories are
+visible, concurrent sessions share a checkout, and nested containers can reach
+the mount.
+
+## Legacy named volumes
+
+Named Git volumes created by older releases are never migrated or deleted
+automatically. Before upgrading, use the old `/msb volumes` and `/msb export`
+commands to inventory and copy work while those commands are available. After
+upgrading, use Microsandbox's volume tooling to inspect and recover each
+`pi-msb-vol-*` volume, then remove it manually only after confirming that
+nothing is needed. Current pi-microsandbox commands do not manage these volumes.
+
+## Docker daemon problems
+
+`/msb status` shows the configured Docker mode, readiness, server version, and
+storage driver. Inside an active sandbox, start or recheck the daemon with:
+
+```sh
+pi-msb-docker-start 15000
+docker info
+```
+
+Startup logs are guest-local at `/var/log/pi-msb-dockerd.log`. Check the network
+prerequisites with `iptables --version` (it should report `nf_tables`), `nft
+--version`, and `sysctl net.ipv4.ip_forward` (it should be `1`). The daemon uses
+`vfs`; slower builds and higher disk use are expected compared with `overlay2`.
+Increase `memory_mib` or `docker.startup_timeout_ms` if startup is killed or
+large builds run out of memory. Small builds should have at least 1 GiB and
+larger Compose stacks should have 2 GiB or more; the default is 8 GiB.
+
+A published container port needs two mappings. Configure the outer
+`network.publish_ports` mapping before sandbox creation, then use Docker `-p`
+inside the guest. A Docker mapping by itself is not reachable from the host.
+Pull and container-egress failures under `deny` or `allowlist` are expected; do
+not bypass the outer policy or mount the host Docker socket as a workaround.
+
+For installation prerequisites, see
+[installation and requirements](getting-started.md). To test a live sandbox
+from source, see the [live test matrix](development.md#live-test-matrix).

package/extensions/pi-msb/command.ts

@@ -2,12 +2,10 @@ import type {
   ExtensionAPI,
   ExtensionCommandContext,
 } from "@earendil-works/pi-coding-agent";
-import {
-  LABEL_KEYS,
-  type MsbControl,
-  type PruneReport,
-  type RuntimeState,
-  type VolumeRecord,
+import type {
+  MsbControl,
+  PruneReport,
+  RuntimeState,
 } from "./types.ts";
 
 /** The small part of Pi's command context used by this module. */
@@ -24,10 +22,7 @@ const HELP = `Usage: /msb <command>
 
 /status                         Show the current runtime
 /on | /off | /reload            Change runtime state
-/prune                          Remove stale sandboxes (never volumes)
-/volumes ls                     List retained volumes
-/volumes rm <name> [--yes]      Remove one unmounted managed volume
-/export <paths...> [--to dir]   Safely export files from the sandbox
+/prune                          Remove stale sandboxes
 /logs [tail-lines]              Show recent sandbox logs
 /config                         Show redacted effective configuration
 /set <key> <value>              Set a session override
@@ -52,19 +47,6 @@ function displayTime(createdAt: number | undefined): string {
   return `${Math.floor(hours / 24)}d`;
 }
 
-function formatBytes(bytes: number | undefined): string {
-  if (bytes === undefined || !Number.isFinite(bytes)) return "unknown";
-  if (bytes < 1024) return `${bytes} B`;
-  const units = ["KiB", "MiB", "GiB", "TiB"];
-  let value = bytes;
-  let unit = -1;
-  while (value >= 1024 && unit < units.length - 1) {
-    value /= 1024;
-    unit++;
-  }
-  return `${value.toFixed(value >= 10 ? 0 : 1)} ${units[unit]}`;
-}
-
 /**
  * Format the short footer/status representation. A display ID is deliberately
  * not used as an identity here; the full sandbox name is the authoritative name.
@@ -74,7 +56,7 @@ export function formatStatus(state: RuntimeState): string | undefined {
     case "active": {
       const info = state.info;
       if (!info) return "MSB active (sandbox details unavailable)";
-      return `MSB active · ${info.mode} · ${info.name}`;
+      return `MSB active · ${info.root} · ${info.name}`;
     }
     case "booting":
       return "MSB booting…";
@@ -99,12 +81,9 @@ export function systemPromptNote(state: RuntimeState): string {
     case "active": {
       const info = state.info;
       if (!info) return "MSB is active, but runtime details are unavailable.";
-      const volume = info.volumeName
-        ? ` Retained volume: ${info.volumeName}${info.volumeHostPath ? ` at ${info.volumeHostPath}` : ""}.`
-        : "";
       const targetWarning =
         " Host-target execution, when enabled, is an explicit escape from the sandbox and should be used deliberately.";
-      return `MSB sandbox is active in ${info.mode} mode (${info.name}).${volume}${targetWarning}`;
+      return `MSB sandbox ${info.name} has the host workspace mounted read/write at ${info.root}.${targetWarning}`;
     }
     case "off":
       return "MSB is explicitly off: tools run on the host. No sandbox is active.";
@@ -194,34 +173,19 @@ function fullState(state: RuntimeState): string {
   }
 
   lines.push(`Name: ${info.name}`);
-  lines.push(`Mode: ${info.mode}`);
+  lines.push(`Workspace root: ${info.root}`);
+  lines.push(`Workdir: ${info.cwd}`);
   lines.push(`Image: ${info.image}`);
   lines.push(`PID: ${info.pid}`);
   lines.push(`Age: ${displayTime(info.createdAt)}`);
-  if (info.seedBranch) lines.push(`Branch: ${info.seedBranch}`);
-  if (info.seedSha) lines.push(`Seed SHA: ${info.seedSha}`);
-  if (info.volumeName) lines.push(`Retained volume: ${info.volumeName}`);
-  if (info.volumeHostPath) lines.push(`Volume path: ${info.volumeHostPath}`);
+  lines.push(`Docker mode: ${info.docker.mode}`);
+  lines.push(`Docker readiness: ${info.docker.readiness}`);
+  if (info.docker.version) lines.push(`Docker version: ${info.docker.version}`);
+  if (info.docker.storageDriver) lines.push(`Docker storage driver: ${info.docker.storageDriver}`);
+  if (info.docker.reason) lines.push(`Docker reason: ${info.docker.reason}`);
   return lines.join("\n");
 }
 
-function volumeLine(
-  volume: VolumeRecord,
-  details?: {
-    branch?: string;
-    lastCommit?: string;
-    dirtyCount?: number;
-    mounted?: boolean;
-  },
-): string {
-  const labels = volume.labels;
-  const branch = details?.branch ?? labels[LABEL_KEYS.seedBranch] ?? "-";
-  const lastCommit = details?.lastCommit ?? labels[LABEL_KEYS.seedSha] ?? "-";
-  const dirty = details?.dirtyCount === undefined ? "unknown" : String(details.dirtyCount);
-  const mounted = details?.mounted ? " mounted" : "";
-  return `${volume.name}  labels=${JSON.stringify(labels)}  path=${volume.hostPath}  size=${formatBytes(volume.usedBytes)}  age=${displayTime(volume.createdAt)}  branch=${branch}  last=${lastCommit}  dirty=${dirty}${mounted}`;
-}
-
 function redactedError(error: unknown, control: MsbControl): string {
   let message = error instanceof Error ? error.message : String(error);
   try {
@@ -238,15 +202,6 @@ function notify(ctx: CommandContext, message: string, type: "info" | "warning" |
   ctx.ui.notify(message, type);
 }
 
-async function confirm(
-  ctx: CommandContext,
-  title: string,
-  message: string,
-): Promise<boolean> {
-  if (!ctx.hasUI || typeof ctx.ui.confirm !== "function") return false;
-  return ctx.ui.confirm(title, message);
-}
-
 function parseTail(args: string[]): number | undefined {
   if (!args.length) return undefined;
   if (args.length !== 1 || !/^\d+$/.test(args[0])) {
@@ -257,118 +212,11 @@ function parseTail(args: string[]): number | undefined {
   return tail;
 }
 
-async function listVolumes(control: MsbControl): Promise<string> {
-  const volumes = await control.listVolumes();
-  if (!volumes.length) return "No retained volumes.\nVolumes are never pruned automatically.";
-  const rows = await Promise.all(
-    volumes.map(async (volume) => {
-      try {
-        const described = await control.describeVolume(volume.name);
-        return volumeLine(volume, described);
-      } catch {
-        return volumeLine(volume);
-      }
-    }),
-  );
-  return ["Retained volumes (volumes are never pruned automatically):", ...rows].join("\n");
-}
-
 function pruneSummary(report: PruneReport): string {
   const removed = report.removed.length ? report.removed.join(", ") : "none";
   const kept = report.kept.length ? report.kept.join(", ") : "none";
   const errors = report.errors.length ? report.errors.join("; ") : "none";
-  return `Prune complete\nInspected: ${report.inspected}\nRemoved: ${removed}\nKept: ${kept}\nErrors: ${errors}\nVolumes are never pruned.`;
-}
-
-async function handleVolumeRemove(
-  args: string[],
-  ctx: CommandContext,
-  control: MsbControl,
-): Promise<void> {
-  const yes = args.includes("--yes");
-  const names = args.filter((arg) => arg !== "--yes");
-  if (names.length !== 1 || args.filter((arg) => arg === "--yes").length > 1) {
-    throw new Error("usage: /msb volumes rm <name> [--yes]");
-  }
-  await ctx.waitForIdle();
-  const name = names[0];
-  const described = await control.describeVolume(name);
-  if (described.volume.labels[LABEL_KEYS.managed] !== "true") {
-    throw new Error("refusing to remove an unmanaged volume");
-  }
-  if (described.mounted) throw new Error("refusing to remove a mounted volume");
-
-  const metadata = volumeLine(described.volume, described);
-  if (!yes) {
-    if (!ctx.hasUI || typeof ctx.ui.confirm !== "function") {
-      throw new Error("volume removal requires --yes when no UI is available");
-    }
-    const approved = await confirm(
-      ctx,
-      "Remove retained volume?",
-      `This permanently removes the managed volume.\n${metadata}`,
-    );
-    if (!approved) {
-      notify(ctx, "Volume removal cancelled", "warning");
-      return;
-    }
-  }
-  await control.removeVolume(name);
-  notify(ctx, `Removed volume ${name}.`);
-}
-
-function parseExportArgs(args: string[]): { paths: string[]; destination?: string; yes: boolean } {
-  const paths: string[] = [];
-  let destination: string | undefined;
-  let yes = false;
-  for (let index = 0; index < args.length; index++) {
-    const arg = args[index];
-    if (arg === "--yes") {
-      if (yes) throw new Error("duplicate --yes");
-      yes = true;
-    } else if (arg === "--to") {
-      if (destination !== undefined || index + 1 >= args.length) {
-        throw new Error("usage: /msb export <paths...> [--to dir]");
-      }
-      destination = args[++index];
-    } else if (arg.startsWith("--")) {
-      throw new Error(`unknown export option ${arg}`);
-    } else {
-      paths.push(arg);
-    }
-  }
-  if (!paths.length) throw new Error("usage: /msb export <paths...> [--to dir]");
-  return { paths, destination, yes };
-}
-
-async function handleExport(
-  args: string[],
-  ctx: CommandContext,
-  control: MsbControl,
-): Promise<void> {
-  const { paths, destination, yes } = parseExportArgs(args);
-  await ctx.waitForIdle();
-  if (!yes && (!ctx.hasUI || typeof ctx.ui.confirm !== "function")) {
-    throw new Error("export requires --yes when no UI is available");
-  }
-  if (!yes && ctx.hasUI && typeof ctx.ui.confirm === "function") {
-    const where = destination ? ` to ${destination}` : " to the dedicated export directory";
-    const approved = await confirm(
-      ctx,
-      "Export sandbox files?",
-      `Export ${paths.length} path${paths.length === 1 ? "" : "s"}${where}. Existing destinations are never overwritten without confirmation.`,
-    );
-    if (!approved) {
-      notify(ctx, "Export cancelled", "warning");
-      return;
-    }
-  }
-  const results = await control.exportPaths(paths, destination);
-  if (!results.length) {
-    notify(ctx, "No paths were exported.", "warning");
-    return;
-  }
-  notify(ctx, results.map((result) => `${result.source} -> ${result.destination}`).join("\n"));
+  return `Prune complete\nInspected: ${report.inspected}\nRemoved: ${removed}\nKept: ${kept}\nErrors: ${errors}`;
 }
 
 async function handleNetwork(args: string[], control: MsbControl): Promise<string> {
@@ -443,16 +291,9 @@ async function executeCommand(
     case "reload": {
       if (tokens.length) throw new Error(`usage: /msb ${command}`);
       await ctx.waitForIdle();
-      const before = control.getState();
       if (command === "reload") await control.reload();
       else await control.setEnabled(command === "on");
-      const after = control.getState();
-      const reused =
-        before.info?.volumeName &&
-        after.info?.volumeName === before.info.volumeName
-          ? `\nVolume reused: ${after.info.volumeName}`
-          : "";
-      notify(ctx, `${fullState(after)}${reused}`);
+      notify(ctx, fullState(control.getState()));
       return;
     }
     case "prune": {
@@ -461,19 +302,6 @@ async function executeCommand(
       notify(ctx, pruneSummary(await control.pruneNow()));
       return;
     }
-    case "volumes":
-      if (tokens[0] === "ls" && tokens.length === 1) {
-        notify(ctx, await listVolumes(control));
-        return;
-      }
-      if (tokens[0] === "rm") {
-        await handleVolumeRemove(tokens.slice(1), ctx, control);
-        return;
-      }
-      throw new Error("usage: /msb volumes ls | /msb volumes rm <name> [--yes]");
-    case "export":
-      await handleExport(tokens, ctx, control);
-      return;
     case "logs":
       notify(ctx, await control.getLogs(parseTail(tokens)));
       return;
@@ -526,7 +354,7 @@ export function createCommandHandler(control: MsbControl): CommandHandler {
 
 export function registerMsbCommand(pi: ExtensionAPI, control: MsbControl): void {
   pi.registerCommand("msb", {
-    description: "Manage pi-microsandbox and retained volumes",
+    description: "Manage pi-microsandbox",
     handler: createCommandHandler(control),
   });
 }