runcloud 0.1.106 → 0.1.107

package/dist/commands/sandbox.js

@@ -263,6 +263,33 @@ function secretSelector(opts) {
 function collectRepeatable(value, previous) {
     return [...previous, value];
 }
+export function parseTagPairs(values) {
+    return values.map((raw) => {
+        const at = raw.indexOf('=');
+        if (at <= 0) {
+            throw new Error(`--tag must be key=value (got ${JSON.stringify(raw)})`);
+        }
+        return [raw.slice(0, at), raw.slice(at + 1)];
+    });
+}
+export async function resolveSandboxByTag(api, tags) {
+    if (tags.length === 0) {
+        throw new Error('Provide a sandbox id, or --tag key=value to find one.');
+    }
+    const query = new URLSearchParams();
+    for (const [key, value] of parseTagPairs(tags))
+        query.append('tag', `${key}:${value}`);
+    const data = await api.get(`/run-cloud/sandboxes?${query}`);
+    const items = data?.items ?? [];
+    if (items.length === 0) {
+        throw new Error(`No sandbox matches ${tags.join(' ')}.`);
+    }
+    if (items.length > 1) {
+        const listed = items.map((s) => `  ${s.id}${s.name ? `  ${s.name}` : ''}`).join('\n');
+        throw new Error(`${items.length} sandboxes match ${tags.join(' ')} — narrow it, or pass an id:\n${listed}`);
+    }
+    return items[0].id;
+}
 export function registerSandbox(program) {
     const sandbox = program.command('sandbox').description('Spawn and control microVM sandboxes');
     const defaultHelp = new Help();
@@ -362,12 +389,16 @@ export function registerSandbox(program) {
         .command('list')
         .description('List sandboxes')
         .option('--state <state>', 'filter by state')
-        .option('--name <name>', 'filter by name (exact)')).action((opts) => run(async () => {
+        .option('--name <name>', 'filter by name (exact)')
+        .option('--tag <key=value>', 'filter by tag; repeatable, and a sandbox must carry every one', collectRepeatable, [])).action((opts) => run(async () => {
         const query = new URLSearchParams();
         if (opts.state)
             query.set('state', opts.state);
         if (opts.name)
             query.set('name', opts.name);
+        for (const [key, value] of parseTagPairs(opts.tag ?? [])) {
+            query.append('tag', `${key}:${value}`);
+        }
         const qs = query.size ? `?${query}` : '';
         const api = runCloudApi();
         const [data, boxes] = await Promise.all([
@@ -384,6 +415,23 @@ export function registerSandbox(program) {
         else
             console.log(renderSandboxList(items));
     }));
+    withOutput(sandbox
+        .command('tag')
+        .description('Set or remove tags on a sandbox')
+        .argument('<id>', 'sandbox id')
+        .argument('<pairs...>', 'key=value to set, or key= to remove')).action((id, pairs, opts) => run(async () => {
+        const tags = Object.fromEntries(parseTagPairs(pairs).map(([key, value]) => [key, value === '' ? null : value]));
+        const updated = await runCloudApi().patch(`/run-cloud/sandboxes/${encodeURIComponent(id)}/tags`, { tags });
+        if (opts.json)
+            printJson(updated);
+        else {
+            const applied = (updated?.tags ?? {});
+            const entries = Object.entries(applied);
+            console.log(entries.length === 0
+                ? `${id} now has no tags`
+                : `${id}\n${entries.map(([k, v]) => `  ${k}=${v}`).join('\n')}`);
+        }
+    }));
     withOutput(sandbox
         .command('get')
         .description('Inspect a sandbox, including its public hostname when exposed')
@@ -497,15 +545,17 @@ export function registerSandbox(program) {
     sandbox
         .command('shell')
         .description('Open an interactive shell (resumes paused sandboxes)')
-        .argument('<id>', 'sandbox id')
-        .action((id) => run(async () => {
+        .argument('[id]', 'sandbox id; omit when using --tag')
+        .option('--tag <key=value>', 'find the sandbox by tag instead of id; repeatable, must match exactly one', collectRepeatable, [])
+        .action((id, opts) => run(async () => {
         const credentials = requireCredentials();
         const api = new ApiClient(credentials.apiUrl, credentials.token);
-        await prepareSandboxShell(api, id);
+        const sandboxId = id ?? (await resolveSandboxByTag(api, opts.tag ?? []));
+        await prepareSandboxShell(api, sandboxId);
         process.exitCode = await runSandboxShell({
             apiUrl: credentials.apiUrl,
             token: credentials.token,
-            sandboxId: id,
+            sandboxId,
         });
     }));
     for (const lifecycle of [

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.1.106';
+export const CLI_VERSION = '0.1.107';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.1.106",
+  "version": "0.1.107",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "Apache-2.0",
   "keywords": [

package/skills/run-cloud-sandboxes/SKILL.md

@@ -204,6 +204,76 @@ signed browser desktop. The CLI also provides `screenshot`, `click`, `type`,
 and `key` subcommands for explicit pixel-coordinate automation. Keep signed
 desktop URLs private and inspect each subcommand's help before automation.
 
+## Tag Sandboxes, and Find Them Again
+
+Tags are arbitrary `key=value` metadata on a lease. They are how an operator
+gets from a symptom back to the machine that caused it, and they **outlive the
+sandbox** — so "which sandbox ran this?" is still answerable after the VM is
+gone, which is usually when you are asking.
+
+Tag on create, or on an existing sandbox:
+
+```bash
+runcloud sandbox create --image runcloud/agent-base   # then:
+runcloud sandbox tag sbx_123 newly.run=run-42 owner=qasim
+runcloud sandbox tag sbx_123 owner=          # empty value removes the key
+```
+
+Find by tag — repeatable, and a sandbox must carry every one:
+
+```bash
+runcloud sandbox list --tag newly.run=run-42 --json
+runcloud sandbox shell --tag newly.run=run-42   # resolves, then opens a shell
+```
+
+`shell --tag` refuses to guess: no match and several matches are both errors,
+and the ambiguous case lists what it found. Opening a shell on the wrong
+machine is worse than being told to be precise.
+
+Reserved keys the platform sets itself — do not overwrite them:
+
+| key | meaning |
+| --- | --- |
+| `newly.kind` | what created it (`ci`, …) |
+| `newly.run` | the CI run id |
+| `newly.environment` | the CI environment id |
+| `newly.session` / `newly.role` | Newly session association, for simulators |
+
+### Debugging when you have only a log line
+
+The control plane logs a sandbox's tags on **create** and **destroy**, so the
+first step needs no API token and no database access:
+
+```bash
+gcloud logging read \
+  'resource.labels.service_name="cp-api-dev" AND jsonPayload.message="run.cloud sandbox created"' \
+  --limit 20 --freshness=6h --format=json
+```
+
+Then either query as a normal user (`runcloud sandbox list --tag …`), or use the
+ops endpoint, which is org-agnostic and audited — the right tool when you do not
+know whose org it was:
+
+```
+GET /diagnose/sandbox?tag=newly.run:run-42
+```
+
+It is gated by an ops OIDC token, not a user credential: mint one by
+impersonating the `cp-diagnose-ops-<env>` service account, which every engineer
+can do. Destroyed sandboxes are included on purpose.
+
+**Credentials.** The CLI defaults to **prod**. For dev, set both:
+
+```bash
+export RUN_CLOUD_API_URL=https://cp-api-dev-97683904813.us-east4.run.app
+export RUN_CLOUD_API_TOKEN=...   # RUN_CLOUD_DEV_API_TOKEN in secrets/dev.yaml
+```
+
+Key names do not match the env vars, and `sops` needs
+`gcloud auth application-default login` rather than plain `gcloud auth login` —
+see the Secrets section of the root `CLAUDE.md`/`AGENTS.md` before concluding
+you lack access.
+
 ## Guardrails
 
 - Destroy every sandbox created during a task unless the user explicitly asks
@@ -215,3 +285,5 @@ desktop URLs private and inspect each subcommand's help before automation.
   URLs in logs, screenshots, PR comments, or chat output.
 - Do not claim that CLI-only lifecycle, image, secret-group, desktop, or stable
   hostname commands are TypeScript SDK methods.
+- Do not overwrite a `newly.*` tag; the platform sets those and support reads
+  them. Add your own key instead.