opensandbox-cli 1.1.0__tar.gz → 1.1.1__tar.gz

{opensandbox_cli-1.1.0 → opensandbox_cli-1.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: opensandbox-cli
-Version: 1.1.0
+Version: 1.1.1
 Summary: OpenSandbox CLI - Command-line interface for managing sandboxes
 Project-URL: Homepage, https://open-sandbox.ai
 Project-URL: Repository, https://github.com/opensandbox-group/OpenSandbox
@@ -224,10 +224,11 @@ Classifier: Topic :: Software Development :: Libraries
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Requires-Dist: click<9.0,>=8.1.0
-Requires-Dist: opensandbox<2.0.0,>=1.1.0
+Requires-Dist: opensandbox<2.0.0,>=1.1.1
 Requires-Dist: pyyaml<7.0,>=6.0
 Requires-Dist: rich<14.0,>=13.0.0
 Requires-Dist: tomli>=2.0.0; python_version < '3.11'
+Requires-Dist: tomlkit<1.0,>=0.13.0
 Description-Content-Type: text/markdown
 
 # OpenSandbox CLI
@@ -235,6 +236,7 @@ Description-Content-Type: text/markdown
 `osb` is the command-line interface for OpenSandbox. It is built for the common day-to-day flows:
 
 - create and manage sandboxes
+- build golden-image templates and create sandboxes from templates or snapshots
 - run commands inside a sandbox
 - read and modify sandbox files
 - inspect runtime egress policy
@@ -387,6 +389,103 @@ Create with Credential Vault proxy enabled:
 osb sandbox create --image python:3.12 --network-policy-file network-policy.json --credential-proxy -o json
 ```
 
+Create from a template (golden image):
+
+```bash
+osb sandbox create --template <template-id> --timeout 30m -o json
+```
+
+Template mode fixes the workload shape on the server: `--image`, `--env`,
+`--resource`, `--entrypoint`, `--volumes-file`, and `--credential-proxy` cannot
+be combined with `--template`. Only `--timeout` (required), `--metadata`,
+`--extension`, and `--network-policy-file` may accompany it. Only templates in
+the `Succeeded` phase can be used. See [Manage templates](#manage-templates).
+
+Create from a snapshot:
+
+```bash
+osb sandbox create --snapshot-id <snapshot-id> --timeout 30m -o json
+```
+
+`--image`, `--template`, and `--snapshot-id` are mutually exclusive.
+
+Create from a request file (`-f`, like `kubectl apply -f`):
+
+```bash
+osb sandbox create -f sandbox-request.json -o json
+```
+
+`sandbox-request.json` uses the public `CreateSandboxRequest` JSON format
+(camelCase keys):
+
+```json
+{
+  "image": "python:3.12",
+  "timeout": 1800,
+  "resourceLimits": { "cpu": "1", "memory": "2Gi" },
+  "entrypoint": ["python", "-m", "http.server"],
+  "networkPolicy": {
+    "defaultAction": "deny",
+    "egress": [{ "action": "allow", "target": "pypi.org" }]
+  }
+}
+```
+
+- Exactly one of `image` (string or `{ "uri": ..., "auth": { "username": ..., "password": ... } }`),
+  `templateId`, or `snapshotId` is required; `timeout` is integer seconds, or
+  `null` for manual cleanup.
+- Supported fields: `image`, `templateId`, `snapshotId`, `platform`, `timeout`,
+  `resourceLimits`, `resourceRequests`, `env`, `metadata`, `extensions`,
+  `entrypoint`, `networkPolicy`, `credentialProxy`, `secureAccess`, `volumes`,
+  `lifecycle`.
+- `-f` cannot be combined with request-building flags; `--skip-health-check`,
+  `--ready-timeout`, and `-o` still apply. In template mode the file may only
+  set `timeout`, `metadata`, `extensions`, and `networkPolicy` alongside
+  `templateId` (a finite `timeout` is required).
+
+### Manage templates
+
+Templates are golden-image builds; the build runs asynchronously, so poll
+`template get` until the status phase is `Succeeded`. Template management
+requires a Kubernetes-backed runtime.
+
+```bash
+osb template create --image python:3.12 --publish s3://bucket/publish -o json
+osb template get <template-id> -o json
+osb template list -o json
+osb template delete <template-id> -o json
+```
+
+`template create` also accepts `--resource cpu=1 memory=512Mi disk=2Gi`,
+`--entrypoint` (repeat per argv item), `--env KEY=VALUE`, `--metadata
+KEY=VALUE`, `--format native|overlaybd`, `--readiness-probe`, and
+`--warmup-seconds`. Or pass a request file in the public `CreateTemplateRequest`
+JSON format:
+
+```bash
+osb template create -f template-request.json -o json
+```
+
+```json
+{
+  "image": "python:3.12",
+  "publish": "s3://bucket/publish",
+  "resourceLimits": { "cpu": "1", "memory": "512Mi" },
+  "readiness": { "probe": "tcp://127.0.0.1:44772", "warmupSeconds": 60 }
+}
+```
+
+### Manage snapshots
+
+Snapshots capture a sandbox's state and can back new sandboxes.
+
+```bash
+osb snapshot create <sandbox-id> --name golden -o json
+osb snapshot get <snapshot-id> -o json
+osb snapshot list --sandbox-id <sandbox-id> -o json
+osb snapshot delete <snapshot-id> -o json
+```
+
 ### List and inspect sandboxes
 
 ```bash
@@ -431,6 +530,10 @@ osb command status <sandbox-id> <execution-id> -o json
 osb command logs <sandbox-id> <execution-id> -o json
 ```
 
+Background start errors or a stream ending before startup confirmation make the
+CLI exit non-zero without success metadata. After a successful start, use
+`command status` and `command logs` to check the process's eventual result.
+
 By default the payload after `--` is joined into one shell command string, so
 pipelines, redirection, and `$VAR` expansion work as in a terminal. Add `--argv`
 to pass the arguments to the executable as a literal argv list (no shell) when
@@ -561,6 +664,8 @@ Not every command supports every format. Use `--help` on the specific command wh
 The main command groups are:
 
 - `osb sandbox`: lifecycle management
+- `osb template`: golden-image template builds
+- `osb snapshot`: snapshot management
 - `osb command`: command execution and persistent sessions
 - `osb file`: file and directory operations
 - `osb egress`: runtime egress policy
@@ -573,6 +678,8 @@ Explore them directly:
 
 ```bash
 osb sandbox --help
+osb template --help
+osb snapshot --help
 osb command --help
 osb file --help
 osb skills --help

{opensandbox_cli-1.1.0 → opensandbox_cli-1.1.1}/README.md

@@ -3,6 +3,7 @@
 `osb` is the command-line interface for OpenSandbox. It is built for the common day-to-day flows:
 
 - create and manage sandboxes
+- build golden-image templates and create sandboxes from templates or snapshots
 - run commands inside a sandbox
 - read and modify sandbox files
 - inspect runtime egress policy
@@ -155,6 +156,103 @@ Create with Credential Vault proxy enabled:
 osb sandbox create --image python:3.12 --network-policy-file network-policy.json --credential-proxy -o json
 ```
 
+Create from a template (golden image):
+
+```bash
+osb sandbox create --template <template-id> --timeout 30m -o json
+```
+
+Template mode fixes the workload shape on the server: `--image`, `--env`,
+`--resource`, `--entrypoint`, `--volumes-file`, and `--credential-proxy` cannot
+be combined with `--template`. Only `--timeout` (required), `--metadata`,
+`--extension`, and `--network-policy-file` may accompany it. Only templates in
+the `Succeeded` phase can be used. See [Manage templates](#manage-templates).
+
+Create from a snapshot:
+
+```bash
+osb sandbox create --snapshot-id <snapshot-id> --timeout 30m -o json
+```
+
+`--image`, `--template`, and `--snapshot-id` are mutually exclusive.
+
+Create from a request file (`-f`, like `kubectl apply -f`):
+
+```bash
+osb sandbox create -f sandbox-request.json -o json
+```
+
+`sandbox-request.json` uses the public `CreateSandboxRequest` JSON format
+(camelCase keys):
+
+```json
+{
+  "image": "python:3.12",
+  "timeout": 1800,
+  "resourceLimits": { "cpu": "1", "memory": "2Gi" },
+  "entrypoint": ["python", "-m", "http.server"],
+  "networkPolicy": {
+    "defaultAction": "deny",
+    "egress": [{ "action": "allow", "target": "pypi.org" }]
+  }
+}
+```
+
+- Exactly one of `image` (string or `{ "uri": ..., "auth": { "username": ..., "password": ... } }`),
+  `templateId`, or `snapshotId` is required; `timeout` is integer seconds, or
+  `null` for manual cleanup.
+- Supported fields: `image`, `templateId`, `snapshotId`, `platform`, `timeout`,
+  `resourceLimits`, `resourceRequests`, `env`, `metadata`, `extensions`,
+  `entrypoint`, `networkPolicy`, `credentialProxy`, `secureAccess`, `volumes`,
+  `lifecycle`.
+- `-f` cannot be combined with request-building flags; `--skip-health-check`,
+  `--ready-timeout`, and `-o` still apply. In template mode the file may only
+  set `timeout`, `metadata`, `extensions`, and `networkPolicy` alongside
+  `templateId` (a finite `timeout` is required).
+
+### Manage templates
+
+Templates are golden-image builds; the build runs asynchronously, so poll
+`template get` until the status phase is `Succeeded`. Template management
+requires a Kubernetes-backed runtime.
+
+```bash
+osb template create --image python:3.12 --publish s3://bucket/publish -o json
+osb template get <template-id> -o json
+osb template list -o json
+osb template delete <template-id> -o json
+```
+
+`template create` also accepts `--resource cpu=1 memory=512Mi disk=2Gi`,
+`--entrypoint` (repeat per argv item), `--env KEY=VALUE`, `--metadata
+KEY=VALUE`, `--format native|overlaybd`, `--readiness-probe`, and
+`--warmup-seconds`. Or pass a request file in the public `CreateTemplateRequest`
+JSON format:
+
+```bash
+osb template create -f template-request.json -o json
+```
+
+```json
+{
+  "image": "python:3.12",
+  "publish": "s3://bucket/publish",
+  "resourceLimits": { "cpu": "1", "memory": "512Mi" },
+  "readiness": { "probe": "tcp://127.0.0.1:44772", "warmupSeconds": 60 }
+}
+```
+
+### Manage snapshots
+
+Snapshots capture a sandbox's state and can back new sandboxes.
+
+```bash
+osb snapshot create <sandbox-id> --name golden -o json
+osb snapshot get <snapshot-id> -o json
+osb snapshot list --sandbox-id <sandbox-id> -o json
+osb snapshot delete <snapshot-id> -o json
+```
+
 ### List and inspect sandboxes
 
 ```bash
@@ -199,6 +297,10 @@ osb command status <sandbox-id> <execution-id> -o json
 osb command logs <sandbox-id> <execution-id> -o json
 ```
 
+Background start errors or a stream ending before startup confirmation make the
+CLI exit non-zero without success metadata. After a successful start, use
+`command status` and `command logs` to check the process's eventual result.
+
 By default the payload after `--` is joined into one shell command string, so
 pipelines, redirection, and `$VAR` expansion work as in a terminal. Add `--argv`
 to pass the arguments to the executable as a literal argv list (no shell) when
@@ -329,6 +431,8 @@ Not every command supports every format. Use `--help` on the specific command wh
 The main command groups are:
 
 - `osb sandbox`: lifecycle management
+- `osb template`: golden-image template builds
+- `osb snapshot`: snapshot management
 - `osb command`: command execution and persistent sessions
 - `osb file`: file and directory operations
 - `osb egress`: runtime egress policy
@@ -341,6 +445,8 @@ Explore them directly:
 
 ```bash
 osb sandbox --help
+osb template --help
+osb snapshot --help
 osb command --help
 osb file --help
 osb skills --help

{opensandbox_cli-1.1.0 → opensandbox_cli-1.1.1}/pyproject.toml

@@ -44,10 +44,11 @@ classifiers = [
 dependencies = [
     # `command run --argv` passes a list to commands.run; the SDK accepts a
     # list there from 0.1.17. Release the CLI only after that SDK is published.
-    "opensandbox>=1.1.0,<2.0.0",
+    "opensandbox>=1.1.1,<2.0.0",
     "click>=8.1.0,<9.0",
     "rich>=13.0.0,<14.0",
     "pyyaml>=6.0,<7.0",
+    "tomlkit>=0.13.0,<1.0",
     "tomli>=2.0.0; python_version < '3.11'",
 ]
 

{opensandbox_cli-1.1.0 → opensandbox_cli-1.1.1}/src/opensandbox_cli/client.py

@@ -90,15 +90,10 @@ class ClientContext:
             self._manager = SandboxManagerSync.create(self.connection_config)
         return self._manager
 
-    def resolve_sandbox_id(self, sandbox_id: str) -> str:
-        """Return the sandbox ID exactly as provided by the user."""
-        return sandbox_id
-
     def connect_sandbox(
         self, sandbox_id: str, *, skip_health_check: bool = True
     ) -> SandboxSync:
         """Connect to an existing sandbox by ID."""
-        sandbox_id = self.resolve_sandbox_id(sandbox_id)
         return SandboxSync.connect(
             sandbox_id,
             connection_config=self.connection_config,

{opensandbox_cli-1.1.0 → opensandbox_cli-1.1.1}/src/opensandbox_cli/commands/command.py

@@ -18,10 +18,11 @@ from __future__ import annotations
 
 import shlex
 import sys
+from collections.abc import Callable
 from datetime import timedelta
 
 import click
-from opensandbox.models.execd import OutputMessage, RunCommandOpts
+from opensandbox.models.execd import Execution, OutputMessage, RunCommandOpts
 from opensandbox.models.execd_sync import ExecutionHandlersSync
 
 from opensandbox_cli.client import ClientContext
@@ -41,7 +42,29 @@ def command_group(ctx: click.Context) -> None:
         click.echo(ctx.get_help())
 
 
-# ---- run ------------------------------------------------------------------
+def _stream_handlers() -> tuple[ExecutionHandlersSync, Callable[[], None]]:
+    """Create stdout/stderr streaming handlers and a trailing-newline flusher."""
+    last_text = ""
+
+    def on_stdout(msg: OutputMessage) -> None:
+        nonlocal last_text
+        last_text = msg.text
+        sys.stdout.write(msg.text)
+        sys.stdout.flush()
+
+    def on_stderr(msg: OutputMessage) -> None:
+        nonlocal last_text
+        last_text = msg.text
+        sys.stderr.write(msg.text)
+        sys.stderr.flush()
+
+    def flush_newline() -> None:
+        if last_text and not last_text.endswith("\n"):
+            sys.stdout.write("\n")
+            sys.stdout.flush()
+
+    return ExecutionHandlersSync(on_stdout=on_stdout, on_stderr=on_stderr), flush_newline
+
 
 def _run_command(
     obj: ClientContext,
@@ -55,15 +78,10 @@ def _run_command(
 ) -> None:
     """Shared implementation for ``command run``.
 
-    Mode contract:
-    - foreground (default): stream output directly, allow only ``-o raw``
-    - background (``--background``): return a tracked execution object, allow structured output
-
-    Payload contract:
-    - default: join the arguments into one shell command string (works against
-      every deployed execd)
-    - ``--argv``: send the arguments as a literal argv list, no shell; needs an
-      execd that accepts the ``argv`` request field
+    Foreground mode streams output and allows only ``-o raw``; background mode
+    returns a tracked execution object and allows structured output. The payload
+    is joined into one shell command string unless ``argv`` sends it as a
+    literal argv list (needs an argv-capable execd).
     """
     allowed = ("table", "json", "yaml") if background else ("raw",)
     fallback = "table" if background else "raw"
@@ -84,6 +102,7 @@ def _run_command(
 
         if background:
             execution = sandbox.commands.run(payload, opts=opts)
+            _handle_execution_error(obj, execution, background=True)
             obj.output.success_panel(
                 {
                     "execution_id": execution.id,
@@ -94,42 +113,33 @@ def _run_command(
             )
             return
 
-        # Foreground: stream stdout/stderr to terminal
-        last_text = ""
-
-        def on_stdout(msg: OutputMessage) -> None:
-            nonlocal last_text
-            last_text = msg.text
-            sys.stdout.write(msg.text)
-            sys.stdout.flush()
-
-        def on_stderr(msg: OutputMessage) -> None:
-            nonlocal last_text
-            last_text = msg.text
-            sys.stderr.write(msg.text)
-            sys.stderr.flush()
-
-        handlers = ExecutionHandlersSync(on_stdout=on_stdout, on_stderr=on_stderr)
+        handlers, flush_newline = _stream_handlers()
         execution = sandbox.commands.run(payload, opts=opts, handlers=handlers)
-
-        # Ensure terminal prompt starts on a new line
-        if last_text and not last_text.endswith("\n"):
-            sys.stdout.write("\n")
-            sys.stdout.flush()
-
+        flush_newline()
         _handle_execution_error(obj, execution)
     finally:
         sandbox.close()
 
 
-def _handle_execution_error(obj: ClientContext, execution) -> None:
-    """Exit non-zero if the execution finished with an error."""
+def _handle_execution_error(
+    obj: ClientContext, execution: Execution, *, background: bool = False
+) -> None:
+    """Exit non-zero on execution errors or missing completion/startup confirmation."""
     if execution.error:
         obj.output.error_panel(
             f"{execution.error.name}: {execution.error.value}",
             title="Execution Error",
         )
         sys.exit(1)
+    if execution.complete is None:
+        confirmation = (
+            "background command startup was confirmed" if background else "the command finished"
+        )
+        obj.output.error_panel(
+            f"The output stream ended before {confirmation}, so its result is unknown.",
+            title="Execution Incomplete",
+        )
+        sys.exit(1)
 
 
 @command_group.command(
@@ -185,8 +195,6 @@ def command_run(
     )
 
 
-# ---- status ---------------------------------------------------------------
-
 @command_group.command("status")
 @click.argument("sandbox_id")
 @click.argument("execution_id")
@@ -209,8 +217,6 @@ def command_status(
         sandbox.close()
 
 
-# ---- logs -----------------------------------------------------------------
-
 @command_group.command("logs")
 @click.argument("sandbox_id")
 @click.argument("execution_id")
@@ -242,8 +248,6 @@ def command_logs(
         sandbox.close()
 
 
-# ---- interrupt ------------------------------------------------------------
-
 @command_group.command("interrupt")
 @click.argument("sandbox_id")
 @click.argument("execution_id")
@@ -330,21 +334,7 @@ def session_run(
     cmd_str = " ".join(shlex.quote(arg) for arg in command)
     sandbox = obj.connect_sandbox(sandbox_id)
     try:
-        last_text = ""
-
-        def on_stdout(msg: OutputMessage) -> None:
-            nonlocal last_text
-            last_text = msg.text
-            sys.stdout.write(msg.text)
-            sys.stdout.flush()
-
-        def on_stderr(msg: OutputMessage) -> None:
-            nonlocal last_text
-            last_text = msg.text
-            sys.stderr.write(msg.text)
-            sys.stderr.flush()
-
-        handlers = ExecutionHandlersSync(on_stdout=on_stdout, on_stderr=on_stderr)
+        handlers, flush_newline = _stream_handlers()
         execution = sandbox.commands.run_in_session(
             session_id,
             cmd_str,
@@ -352,11 +342,7 @@ def session_run(
             timeout=timeout,
             handlers=handlers,
         )
-
-        if last_text and not last_text.endswith("\n"):
-            sys.stdout.write("\n")
-            sys.stdout.flush()
-
+        flush_newline()
         _handle_execution_error(obj, execution)
     finally:
         sandbox.close()

{opensandbox_cli-1.1.0 → opensandbox_cli-1.1.1}/src/opensandbox_cli/commands/config_cmd.py

@@ -20,6 +20,10 @@ from collections.abc import Mapping
 from typing import Any
 
 import click
+import tomlkit
+from tomlkit.container import OutOfOrderTableProxy
+from tomlkit.exceptions import ParseError
+from tomlkit.items import InlineTable, Table
 
 from opensandbox_cli.client import ClientContext
 from opensandbox_cli.config import init_config_file, resolve_config
@@ -34,13 +38,11 @@ def config_group(ctx: click.Context) -> None:
         click.echo(ctx.get_help())
 
 
-# ---- init -----------------------------------------------------------------
-
 @config_group.command("init")
 @click.option("--force", is_flag=True, default=False, help="Overwrite existing config file.")
 @output_option("table", "json", "yaml")
-@handle_errors
 @click.pass_obj
+@handle_errors
 def config_init(obj: ClientContext, force: bool, output_format: str | None) -> None:
     """Create a default configuration file."""
     output = prepare_output(
@@ -54,8 +56,6 @@ def config_init(obj: ClientContext, force: bool, output_format: str | None) -> N
         output.warning(str(exc))
 
 
-# ---- show -----------------------------------------------------------------
-
 _SENSITIVE_CONFIG_KEYS = {
     "api_key",
 }
@@ -80,6 +80,7 @@ def _sanitize_config_for_display(data: Mapping[str, Any]) -> dict[str, Any]:
         sanitized[key] = value
     return sanitized
 
+
 @config_group.command("show")
 @output_option("table", "json", "yaml")
 @click.pass_obj
@@ -105,14 +106,34 @@ def config_show(obj: ClientContext, output_format: str | None) -> None:
     )
 
 
-# ---- set ------------------------------------------------------------------
+def _parse_toml_value(raw: str) -> Any:
+    """Infer a TOML scalar type from a raw CLI string.
+
+    Booleans, integers, and floats are recognized so values like ``false`` or
+    ``30`` keep their native TOML type; anything else is stored as a string.
+    The value is always serialized by tomlkit, so quotes, escapes, and
+    whitespace in string values are encoded correctly.
+    """
+    normalized = raw.lower()
+    if normalized in ("true", "false"):
+        return normalized == "true"
+    try:
+        return int(raw)
+    except ValueError:
+        pass
+    try:
+        return float(raw)
+    except ValueError:
+        pass
+    return raw
+
 
 @config_group.command("set")
 @click.argument("key")
 @click.argument("value")
 @output_option("table", "json", "yaml")
-@handle_errors
 @click.pass_obj
+@handle_errors
 def config_set(
     obj: ClientContext,
     key: str,
@@ -125,59 +146,27 @@ def config_set(
     if not path.exists():
         raise click.ClickException(f"Config file not found: {path}. Run 'osb config init' first.")
 
-    content = path.read_text()
-
-    # TODO: Replace this regex-based TOML editing with a parser-backed update
-    # path so formatting/comments survive reliably as config complexity grows.
-    # Simple key replacement in TOML
-    # Supports dotted keys like connection.domain
-    parts = key.split(".", 1)
-    if len(parts) == 2:
-        section, field = parts
-        # Try to find and update existing value
-        import re
-
-        section_pattern = rf"(\[{re.escape(section)}\].*?)(?=\n\[|\Z)"
-        section_match = re.search(section_pattern, content, re.DOTALL)
-
-        # Infer TOML value type: bool > int > float > string
-        def _toml_value(raw: str) -> str:
-            if raw.lower() in ("true", "false"):
-                return raw.lower()
-            try:
-                int(raw)
-                return raw
-            except ValueError:
-                pass
-            try:
-                float(raw)
-                return raw
-            except ValueError:
-                pass
-            return f'"{raw}"'
-
-        toml_val = _toml_value(value)
-
-        if section_match:
-            section_text = section_match.group(1)
-            field_pattern = rf'^(#?\s*{re.escape(field)}\s*=\s*).*$'
-            field_match = re.search(field_pattern, section_text, re.MULTILINE)
-            if field_match:
-                new_line = f'{field} = {toml_val}'
-                new_section = section_text[:field_match.start()] + new_line + section_text[field_match.end():]
-                content = content[:section_match.start()] + new_section + content[section_match.end():]
-            else:
-                # Add field to section
-                insert_pos = section_match.end()
-                content = content[:insert_pos] + f'\n{field} = {toml_val}' + content[insert_pos:]
-        else:
-            # Add new section
-            content += f'\n[{section}]\n{field} = {toml_val}\n'
-    else:
+    section, _, field = key.partition(".")
+    if not section or not field or "." in field:
         raise click.ClickException(
             "Key must be in 'section.field' format (e.g. connection.domain)."
         )
 
-    path.write_text(content)
+    try:
+        document = tomlkit.parse(path.read_text(encoding="utf-8"))
+    except ParseError as exc:
+        raise click.ClickException(
+            f"Config file is not valid TOML ({path}): {exc}"
+        ) from exc
+
+    table = document.get(section)
+    if table is None:
+        table = tomlkit.table()
+        document[section] = table
+    if not isinstance(table, (Table, InlineTable, OutOfOrderTableProxy)):
+        raise click.ClickException(f"Cannot set {key}: '{section}' is not a TOML table.")
+
+    table[field] = _parse_toml_value(value)
+    path.write_text(tomlkit.dumps(document), encoding="utf-8")
 
     obj.output.success(f"Set {key} = {value}")