opensandbox-cli 1.2.0__tar.gz → 1.2.1__tar.gz

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/.gitignore

@@ -294,3 +294,7 @@ obj/
 # fast-sandbox pinned source checkout (materialized by
 # manifests/release/build-fast-sandbox.sh from manifests/third-party/fast-sandbox.commit)
 .fast-sandbox/
+
+# Test-only localhost certificate pair for the egress OSEP-0025 resolver stub
+# (fixtures/README.md documents regeneration; these certify nothing).
+!components/egress/tests/resolver/fixtures/*.pem

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: opensandbox-cli
-Version: 1.2.0
+Version: 1.2.1
 Summary: OpenSandbox CLI - Command-line interface for managing sandboxes
 Project-URL: Homepage, https://open-sandbox.ai
 Project-URL: Repository, https://github.com/opensandbox-group/OpenSandbox
@@ -224,7 +224,7 @@ Classifier: Topic :: Software Development :: Libraries
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Requires-Dist: click<9.0,>=8.1.0
-Requires-Dist: opensandbox<2.0.0,>=1.2.0
+Requires-Dist: opensandbox<2.0.0,>=1.2.1
 Requires-Dist: pyyaml<7.0,>=6.0
 Requires-Dist: rich<14.0,>=13.0.0
 Requires-Dist: tomli>=2.0.0; python_version < '3.11'
@@ -436,7 +436,8 @@ osb sandbox create -f sandbox-request.json -o json
 Templates are golden-image builds; the build runs asynchronously, so poll `template get` until the status phase is `Succeeded`. Template management requires a Kubernetes-backed runtime.
 
 ```bash
-osb template create --image python:3.12 --publish s3://bucket/publish -o json
+osb template create --image python:3.12 --publish s3://bucket/publish --format native -o json
+osb template create --image python:3.12 --publish oci://registry.example.com/sandbox/templates --format overlaybd -o json
 osb template get <template-id> -o json
 osb template list -o json
 osb template delete <template-id> -o json
@@ -452,11 +453,14 @@ osb template create -f template-request.json -o json
 {
   "image": "python:3.12",
   "publish": "s3://bucket/publish",
+  "format": "native",
   "resourceLimits": { "cpu": "1", "memory": "512Mi" },
   "readiness": { "probe": "tcp://127.0.0.1:44772", "warmupSeconds": 60 }
 }
 ```
 
+OCI targets must name a repository without a tag or digest. Use `overlaybd` (the default) for OCI and explicitly select `native` for S3. The builder returns an immutable OCI reference in `status.manifestRef`; `sandbox create --template` uses that reference automatically. See [OCI template setup](../docs/guides/oci-templates.md) for Registry Secrets and runtime prerequisites.
+
 ### Manage snapshots
 
 Snapshots capture a sandbox's state and can back new sandboxes.
@@ -512,7 +516,7 @@ osb command logs <sandbox-id> <execution-id> -o json
 
 Background start errors or a stream ending before startup confirmation make the CLI exit non-zero without success metadata. After a successful start, use `command status` and `command logs` to check the process's eventual result.
 
-By default the payload after `--` is joined into one shell command string, so pipelines, redirection, and `$VAR` expansion work as in a terminal. Add `--argv` to pass the arguments to the executable as a literal argv list (no shell) when values such as `$HOME`, quotes, embedded spaces, or empty strings must reach the process unchanged. `--argv` needs a sandbox image whose execd accepts argv requests:
+By default each payload word after `--` is quoted as a single shell token and the tokens are joined into one shell command line that the sandbox's shell runs. Shell syntax such as pipelines or redirection must therefore ride inside an explicit word (`-- sh -c 'echo hi > /tmp/x'`); an unquoted `$VAR` is expanded by your own terminal before the CLI sees it, while a quoted one reaches the sandbox shell literally. Add `--argv` to pass the arguments to the executable as a literal argv list (no shell) when values such as `$HOME`, quotes, embedded spaces, or empty strings must reach the process unchanged. `--argv` needs a sandbox image whose execd accepts argv requests:
 
 ```bash
 osb command run <sandbox-id> -o raw --argv -- python3 -c "import sys; print(sys.argv[1:])" "a b" '$HOME' "x'y" ""
@@ -734,7 +738,8 @@ api_key = "your-api-key"
 domain = "localhost:8080"
 protocol = "http"
 request_timeout = 30
-use_server_proxy = false
+# use_server_proxy is deprecated (maintenance mode); prefer the ingress gateway for data-plane traffic.
+# use_server_proxy = false
 
 [output]
 color = true

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/README.md

@@ -202,7 +202,8 @@ osb sandbox create -f sandbox-request.json -o json
 Templates are golden-image builds; the build runs asynchronously, so poll `template get` until the status phase is `Succeeded`. Template management requires a Kubernetes-backed runtime.
 
 ```bash
-osb template create --image python:3.12 --publish s3://bucket/publish -o json
+osb template create --image python:3.12 --publish s3://bucket/publish --format native -o json
+osb template create --image python:3.12 --publish oci://registry.example.com/sandbox/templates --format overlaybd -o json
 osb template get <template-id> -o json
 osb template list -o json
 osb template delete <template-id> -o json
@@ -218,11 +219,14 @@ osb template create -f template-request.json -o json
 {
   "image": "python:3.12",
   "publish": "s3://bucket/publish",
+  "format": "native",
   "resourceLimits": { "cpu": "1", "memory": "512Mi" },
   "readiness": { "probe": "tcp://127.0.0.1:44772", "warmupSeconds": 60 }
 }
 ```
 
+OCI targets must name a repository without a tag or digest. Use `overlaybd` (the default) for OCI and explicitly select `native` for S3. The builder returns an immutable OCI reference in `status.manifestRef`; `sandbox create --template` uses that reference automatically. See [OCI template setup](../docs/guides/oci-templates.md) for Registry Secrets and runtime prerequisites.
+
 ### Manage snapshots
 
 Snapshots capture a sandbox's state and can back new sandboxes.
@@ -278,7 +282,7 @@ osb command logs <sandbox-id> <execution-id> -o json
 
 Background start errors or a stream ending before startup confirmation make the CLI exit non-zero without success metadata. After a successful start, use `command status` and `command logs` to check the process's eventual result.
 
-By default the payload after `--` is joined into one shell command string, so pipelines, redirection, and `$VAR` expansion work as in a terminal. Add `--argv` to pass the arguments to the executable as a literal argv list (no shell) when values such as `$HOME`, quotes, embedded spaces, or empty strings must reach the process unchanged. `--argv` needs a sandbox image whose execd accepts argv requests:
+By default each payload word after `--` is quoted as a single shell token and the tokens are joined into one shell command line that the sandbox's shell runs. Shell syntax such as pipelines or redirection must therefore ride inside an explicit word (`-- sh -c 'echo hi > /tmp/x'`); an unquoted `$VAR` is expanded by your own terminal before the CLI sees it, while a quoted one reaches the sandbox shell literally. Add `--argv` to pass the arguments to the executable as a literal argv list (no shell) when values such as `$HOME`, quotes, embedded spaces, or empty strings must reach the process unchanged. `--argv` needs a sandbox image whose execd accepts argv requests:
 
 ```bash
 osb command run <sandbox-id> -o raw --argv -- python3 -c "import sys; print(sys.argv[1:])" "a b" '$HOME' "x'y" ""
@@ -500,7 +504,8 @@ api_key = "your-api-key"
 domain = "localhost:8080"
 protocol = "http"
 request_timeout = 30
-use_server_proxy = false
+# use_server_proxy is deprecated (maintenance mode); prefer the ingress gateway for data-plane traffic.
+# use_server_proxy = false
 
 [output]
 color = true

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/pyproject.toml

@@ -44,7 +44,7 @@ classifiers = [
 dependencies = [
     # `command run --argv` passes a list to commands.run; the SDK accepts a
     # list there from 0.1.17. Release the CLI only after that SDK is published.
-    "opensandbox>=1.2.0,<2.0.0",
+    "opensandbox>=1.2.1,<2.0.0",
     "click>=8.1.0,<9.0",
     "rich>=13.0.0,<14.0",
     "pyyaml>=6.0,<7.0",

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/src/opensandbox_cli/commands/command.py

@@ -147,9 +147,12 @@ def _handle_execution_error(
     help="Run a command in a sandbox. Use `--` before the sandbox command payload.",
     epilog=(
         "Separator rule: use `--` before the sandbox command payload.\n\n"
-        "By default the payload is joined into one shell command string. Add "
-        "`--argv` to pass the arguments to the executable as-is (no shell), so "
-        "literal `$HOME`, quotes, and empty strings are preserved; this needs a "
+        "By default each payload word is quoted as a single shell token and "
+        "the tokens are joined into one shell command line, so shell syntax "
+        "such as redirects or pipes must ride inside an explicit word "
+        "(for example: -- sh -c 'echo hi > /tmp/x'). Add `--argv` to pass "
+        "the arguments to the executable as-is (no shell), so literal "
+        "`$HOME`, quotes, and empty strings are preserved; this needs a "
         "sandbox image whose execd accepts argv requests."
     ),
 )

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/src/opensandbox_cli/commands/config_cmd.py

@@ -26,7 +26,7 @@ from tomlkit.exceptions import ParseError
 from tomlkit.items import InlineTable, Table
 
 from opensandbox_cli.client import ClientContext
-from opensandbox_cli.config import init_config_file, resolve_config
+from opensandbox_cli.config import STRING_KEYS, init_config_file, resolve_config
 from opensandbox_cli.utils import handle_errors, output_option, prepare_output
 
 
@@ -53,7 +53,8 @@ def config_init(obj: ClientContext, force: bool, output_format: str | None) -> N
         path = init_config_file(obj.config_path, force=force)
         output.success(f"Config file created: {path}")
     except FileExistsError as exc:
-        output.warning(str(exc))
+        output.error(str(exc))
+        raise click.exceptions.Exit(1) from None
 
 
 _SENSITIVE_CONFIG_KEYS = {
@@ -166,7 +167,7 @@ def config_set(
     if not isinstance(table, (Table, InlineTable, OutOfOrderTableProxy)):
         raise click.ClickException(f"Cannot set {key}: '{section}' is not a TOML table.")
 
-    table[field] = _parse_toml_value(value)
+    table[field] = value if key in STRING_KEYS else _parse_toml_value(value)
     path.write_text(tomlkit.dumps(document), encoding="utf-8")
 
     obj.output.success(f"Set {key} = {value}")

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/src/opensandbox_cli/commands/egress.py

@@ -26,7 +26,7 @@ from opensandbox_cli.utils import handle_errors, output_option, prepare_output
 def _parse_rule(value: str) -> NetworkRule:
     """Parse ACTION=TARGET into a NetworkRule."""
     action, sep, target = value.partition("=")
-    if not sep:
+    if not sep or not target.strip():
         raise click.BadParameter(
             f"Invalid rule '{value}'. Use ACTION=TARGET, for example allow=pypi.org."
         )

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/src/opensandbox_cli/commands/sandbox.py

@@ -1015,12 +1015,20 @@ def _parse_metric_stream_line(line: str) -> tuple[SandboxMetrics | None, str | N
     if not payload:
         return None, None
 
-    decoded: Any = json.loads(payload)
+    try:
+        decoded: Any = json.loads(payload)
+    except json.JSONDecodeError:
+        return None, "Metrics stream error: invalid JSON"
+
     if isinstance(decoded, dict) and decoded.get("error"):
         return None, f"Metrics stream error: {decoded['error']}"
-    if isinstance(decoded, dict) and "cpu_used_pct" in decoded:
-        return MetricsModelConverter.to_sandbox_metrics(Metrics.from_dict(decoded)), None
-    return SandboxMetrics.model_validate(decoded), None
+
+    try:
+        if isinstance(decoded, dict) and "cpu_used_pct" in decoded:
+            return MetricsModelConverter.to_sandbox_metrics(Metrics.from_dict(decoded)), None
+        return SandboxMetrics.model_validate(decoded), None
+    except (KeyError, TypeError, ValueError, ValidationError) as exc:
+        return None, f"Metrics stream error: {exc}"
 
 
 def _describe_create_timeout(

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/src/opensandbox_cli/commands/template.py

@@ -55,7 +55,7 @@ def template_group(ctx: click.Context) -> None:
     "--publish",
     "-p",
     default=None,
-    help="S3-compatible publish target for the built artifacts (e.g. s3://bucket/publish). Required unless --file is used.",
+    help="Publish target: s3://bucket/publish (native) or oci://registry/repository (overlaybd, no tag or digest). Required unless --file is used.",
 )
 @click.option(
     "--file",
@@ -233,6 +233,9 @@ def template_get(obj, template_id: str, output_format: str | None) -> None:
     status_val = d.get("status")
     if isinstance(status_val, dict):
         d["status"] = status_val.get("phase", str(status_val))
+        # model_dump uses the field name; accept the wire alias too.
+        manifest_ref = status_val.get("manifest_ref", status_val.get("manifestRef"))
+        d["manifest_ref"] = manifest_ref
         if status_val.get("message"):
             d["status_message"] = status_val["message"]
     readiness_val = d.get("readiness")

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/src/opensandbox_cli/commands/terminal.py

@@ -259,9 +259,12 @@ async def _connect_and_stream(
     stdout_write: WriteFn,
     get_size: SizeFn,
     error_write: WriteFn | None = None,
+    on_connected: Callable[[], None] | None = None,
 ) -> tuple[int | None, list[str]]:
     """Connect to the PTY WebSocket, drive the relay loop, handle resize."""
     async with websockets.connect(ws_url, additional_headers=headers or None) as ws:
+        if on_connected is not None:
+            on_connected()
         # websockets forbids concurrent sends: stdin frames and SIGWINCH
         # resize frames share one lock, and fire-and-forget resize tasks get
         # their results consumed so failures never surface as task warnings.
@@ -364,6 +367,12 @@ def terminal(
     exit_code: int | None = None
     errors: list[str] = []
     teardown = False
+    connected = False
+
+    def mark_connected() -> None:
+        nonlocal connected
+        connected = True
+
     try:
         with _raw_mode(stdin_fd):
             exit_code, errors = asyncio.run(
@@ -374,6 +383,7 @@ def terminal(
                     stdout_write=stdout_write,
                     get_size=get_size,
                     error_write=report_error,
+                    on_connected=mark_connected,
                 )
             )
         teardown = exit_code is not None or bool(errors)
@@ -385,9 +395,10 @@ def terminal(
         raise click.ClickException(f"Terminal connection failed: {exc}") from exc
     finally:
         # Clean exit tears the session down, as does a reported failure (e.g.
-        # START_FAILED: the shell never ran, so there is nothing to preserve).
-        # A lost connection on a live shell is the one case worth keeping.
-        if teardown:
+        # START_FAILED: the shell never ran, so there is nothing to preserve)
+        # or a WebSocket that never opened (the shell starts on the first
+        # one). A lost connection on a live shell is the one case worth keeping.
+        if teardown or not connected:
             _delete_pty_session(http_base, headers, session_id, timeout=timeout)
 
     if exit_code is None:

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/src/opensandbox_cli/config.py

@@ -28,6 +28,8 @@ import sys
 from pathlib import Path
 from typing import Any
 
+import click
+
 if sys.version_info >= (3, 11):
     import tomllib
 else:
@@ -49,6 +51,7 @@ DEFAULT_CONFIG_TEMPLATE = """\
 # domain = "localhost:8080"
 # protocol = "http"
 # request_timeout = 30
+# use_server_proxy is deprecated (maintenance mode); prefer the ingress gateway for data-plane traffic.
 # use_server_proxy = false
 
 [output]
@@ -64,14 +67,38 @@ def load_config_file(config_path: Path | None = None) -> dict[str, Any]:
     """Load and parse the TOML config file.
 
     Returns an empty dict if the file doesn't exist or tomllib is unavailable.
+    Raises ``click.ClickException`` if the file cannot be read or parsed.
     """
     path = config_path or DEFAULT_CONFIG_PATH
-    if not path.exists():
-        return {}
     if tomllib is None:
         return {}
-    with open(path, "rb") as f:
-        return tomllib.load(f)
+    # Open directly instead of checking path.exists() first: exists() raises
+    # PermissionError for a path under a directory that cannot be searched.
+    try:
+        with open(path, "rb") as f:
+            return tomllib.load(f)
+    except (FileNotFoundError, NotADirectoryError):
+        return {}
+    except OSError as exc:
+        raise click.ClickException(f"Cannot read config file {path}: {exc}") from exc
+    except (tomllib.TOMLDecodeError, UnicodeDecodeError) as exc:
+        raise click.ClickException(
+            f"Config file is not valid TOML ({path}): {exc}"
+        ) from exc
+
+
+# Config-file keys resolve_config reads as text. `config set` stores their
+# values verbatim: inferring a TOML number would rewrite an API key such as
+# "007123" as 7123.
+STRING_KEYS = frozenset(
+    {
+        "connection.api_key",
+        "connection.domain",
+        "connection.protocol",
+        "defaults.image",
+        "defaults.timeout",
+    }
+)
 
 
 def resolve_config(
@@ -92,10 +119,15 @@ def resolve_config(
     declared type.
 
     Keys returned:
-      - api_key, domain, protocol, request_timeout (int seconds), use_server_proxy (bool)
+      - api_key, domain, protocol, request_timeout (int seconds), use_server_proxy (bool; deprecated)
       - default_image, default_timeout (str like "10m")
     """
     file_cfg = load_config_file(config_path)
+    for section in ("connection", "output", "defaults"):
+        if section in file_cfg and not isinstance(file_cfg[section], dict):
+            raise click.ClickException(
+                f"Config section '{section}' must be a TOML table (use [{section}])."
+            )
     conn = file_cfg.get("connection", {})
     output_cfg = file_cfg.get("output", {})
     defaults = file_cfg.get("defaults", {})
@@ -111,10 +143,11 @@ def resolve_config(
         or os.getenv("OPEN_SANDBOX_PROTOCOL")
         or _str_or_none(conn.get("protocol"))
         or "http",
-        "request_timeout": cli_timeout
-        or _int_or_none(os.getenv("OPEN_SANDBOX_REQUEST_TIMEOUT"))
-        or _int_or_none(conn.get("request_timeout"))
-        or 30,
+        "request_timeout": _request_timeout_seconds(
+            cli_timeout,
+            _int_or_none(os.getenv("OPEN_SANDBOX_REQUEST_TIMEOUT")),
+            _int_or_none(conn.get("request_timeout")),
+        ),
         "use_server_proxy": _coalesce(
             cli_use_server_proxy,
             _bool_or_none(os.getenv("OPEN_SANDBOX_USE_SERVER_PROXY")),
@@ -139,6 +172,26 @@ def init_config_file(config_path: Path | None = None, *, force: bool = False) ->
     return path
 
 
+def _request_timeout_seconds(*candidates: int | None) -> int:
+    """Return the first explicit request timeout, in seconds.
+
+    ``None`` means that source did not set a timeout. Zero and negative values
+    are explicit and invalid: they must not fall through to a later source or
+    the 30 second default. ``--request-timeout 0`` used to be ignored because
+    ``0`` is falsy.
+    """
+    for value in candidates:
+        if value is None:
+            continue
+        if value <= 0:
+            raise click.ClickException(
+                "Request timeout must be a positive number of seconds, "
+                f"got {value}."
+            )
+        return value
+    return 30
+
+
 def _int_or_none(value: Any) -> int | None:
     """Coerce a configured value to ``int``, or ``None`` when it is not numeric."""
     if value is None or isinstance(value, bool):

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/src/opensandbox_cli/main.py

@@ -36,7 +36,7 @@ from opensandbox_cli.commands.skills import skills_group
 from opensandbox_cli.commands.snapshot import snapshot_group
 from opensandbox_cli.commands.template import template_group
 from opensandbox_cli.commands.terminal import terminal
-from opensandbox_cli.config import resolve_config
+from opensandbox_cli.config import _request_timeout_seconds, resolve_config
 
 BANNER = r"""[bold cyan]
    ____                   _____                 _ _
@@ -104,7 +104,10 @@ class BannerGroup(click.Group):
 @click.option(
     "--use-server-proxy/--no-use-server-proxy",
     default=None,
-    help="Route execd and endpoint traffic through the sandbox server proxy.",
+    help=(
+        "DEPRECATED: the server proxy is in maintenance mode (security/bugfix only); "
+        "route data-plane traffic through the ingress gateway instead."
+    ),
 )
 @click.option("--config", "config_path", type=click.Path(exists=False, path_type=Path), default=None, help="Config file path.")
 @click.option("-v", "--verbose", is_flag=True, default=False, help="Enable verbose/debug output.")
@@ -141,7 +144,7 @@ def cli(
             "api_key": api_key,
             "domain": domain,
             "protocol": protocol or "http",
-            "request_timeout": request_timeout or 30,
+            "request_timeout": _request_timeout_seconds(request_timeout),
             "use_server_proxy": use_server_proxy if use_server_proxy is not None else False,
             "color": True,
             "default_image": None,
@@ -158,6 +161,14 @@ def cli(
         )
     resolved["color"] = not no_color and resolved.get("color", True)
 
+    if ctx.invoked_subcommand != "config" and resolved.get("use_server_proxy"):
+        click.echo(
+            "Warning: connection.use_server_proxy is deprecated: the server proxy "
+            "data path is in maintenance mode (security and bug fixes only); route "
+            "data-plane traffic through the ingress gateway instead.",
+            err=True,
+        )
+
     effective_config_path = config_path or Path.home() / ".opensandbox" / "config.toml"
     ctx.obj = ClientContext(
         resolved_config=resolved,

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/src/opensandbox_cli/output.py

@@ -32,6 +32,7 @@ except ImportError:  # pragma: no cover
 from pydantic import BaseModel
 from rich import box
 from rich.console import Console
+from rich.markup import escape
 from rich.panel import Panel
 from rich.status import Status
 from rich.table import Table
@@ -116,7 +117,7 @@ class OutputFormatter:
             return
         if self.color:
             console = self._err_console if stderr else self.console
-            console.print(f"  [bold {style}]{icon} {msg}[/]")
+            console.print(f"  [bold {style}]{icon} {escape(msg)}[/]")
         else:
             click.echo(f"{plain}: {msg}", err=stderr)
 
@@ -143,7 +144,7 @@ class OutputFormatter:
             self._err_console.print(f"  [bold red]{title}[/]")
             self._err_console.print(f"  [dim]{'─' * (len(title) + 2)}[/]")
             for line in msg.splitlines():
-                self._err_console.print(f"  {line}")
+                self._err_console.print(f"  {escape(line)}")
             self._err_console.print()
         else:
             click.echo(f"ERROR [{title}]: {msg}", err=True)
@@ -152,7 +153,7 @@ class OutputFormatter:
     def spinner(self, msg: str) -> Generator[Status, None, None]:
         """Context manager that shows a spinner while work is in progress."""
         if self.color and self.fmt == "table":
-            with self._err_console.status(f"[bold cyan]⏳ {msg}[/]", spinner="dots") as status:
+            with self._err_console.status(f"[bold cyan]⏳ {escape(msg)}[/]", spinner="dots") as status:
                 yield status
         else:
             yield None  # type: ignore[arg-type]
@@ -161,7 +162,7 @@ class OutputFormatter:
         """Print content inside a styled panel."""
         if self.color:
             self.console.print(Panel(
-                content,
+                Text(content),
                 title=title,
                 title_align="left",
                 border_style=style,
@@ -187,7 +188,7 @@ class OutputFormatter:
             self.console.print(f"  [bold green]✓ {title}[/]")
             self.console.print(f"  [dim]{'─' * (len(title) + 2)}[/]")
             for k, v in data.items():
-                self.console.print(f"  [bold]{k}:[/] [cyan]{v}[/]")
+                self.console.print(f"  [bold]{escape(str(k))}:[/] [cyan]{escape(str(v))}[/]")
             self.console.print()
         else:
             click.echo(f"--- {title} ---")
@@ -316,10 +317,11 @@ class OutputFormatter:
         for row in rows:
             cells: list[Text | str] = []
             for col in columns:
-                val = str(row.get(col, "-"))
+                raw = row.get(col)
+                val = "-" if raw is None else str(raw)
                 if col in _STATUS_COLUMNS:
                     cells.append(_style_value(col, val))
                 else:
-                    cells.append(val)
+                    cells.append(Text(val))
             table.add_row(*cells)
         self.console.print(table)

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/src/opensandbox_cli/skills/opensandbox-sandbox-lifecycle.md

@@ -140,7 +140,8 @@ If the user does not specify an image, recommend one that matches the runtime th
 Templates are golden-image builds. The build is asynchronous: `template create` returns a template in `Pending`; poll `template get` until the phase is `Succeeded` (or `Failed`).
 
 ```bash
-osb template create --image python:3.12 --publish s3://bucket/publish -o json
+osb template create --image python:3.12 --publish s3://bucket/publish --format native -o json
+osb template create --image python:3.12 --publish oci://registry.example.com/sandbox/templates --format overlaybd -o json
 osb template create -f template-request.json -o json
 osb template get <template-id> -o json
 osb template list -o json
@@ -149,6 +150,8 @@ osb template delete <template-id> -o json
 
 Useful `template create` options: `--resource cpu=1 memory=512Mi disk=2Gi`, `--entrypoint` (repeat per argv item), `--env KEY=VALUE`, `--metadata KEY=VALUE`, `--format native|overlaybd`, `--readiness-probe tcp://127.0.0.1:44772`, `--warmup-seconds 60`. `-f <request-file>` reads the full request as public `CreateTemplateRequest` JSON (camelCase: `image`, `publish`, `resourceLimits`, `entrypoint`, `env`, `metadata`, `format`, `readiness.probe`, `readiness.warmupSeconds`), mutually exclusive with those flags.
 
+OCI publication requires a repository-only target without a tag or digest, `overlaybd` format, and a server-configured `.dockerconfigjson` Secret (`kubernetes.template_oci_publish_secret`). Sandbox creation also requires an OCI-enabled Fast Sandbox pool and the OverlayBD node daemon. S3 publication uses `native`. Wait for `Succeeded` before creating a sandbox; the server uses the immutable OCI manifest reference for OCI templates.
+
 Create a sandbox from a succeeded template:
 
 ```bash
@@ -320,7 +323,7 @@ osb sandbox health <sandbox-id> -o json
 Build a template, wait for it, and create from it:
 
 ```bash
-osb template create --image python:3.12 --publish s3://bucket/publish -o json
+osb template create --image python:3.12 --publish s3://bucket/publish --format native -o json
 osb template get <template-id> -o json
 osb sandbox create --template <template-id> --timeout 30m -o json
 osb sandbox health <sandbox-id> -o json

{opensandbox_cli-1.2.0 → opensandbox_cli-1.2.1}/src/opensandbox_cli/utils.py

@@ -86,12 +86,9 @@ class DurationType(click.ParamType):
             return value
         try:
             return parse_duration(value)
-        except click.BadParameter:
-            self.fail(
-                f"Invalid duration '{value}'. Use format like 10m, 1h30m, 90s.",
-                param,
-                ctx,
-            )
+        except click.BadParameter as exc:
+            # Keep the specific reason (empty, malformed, out of range).
+            self.fail(exc.format_message(), param, ctx)
 
 
 DURATION = DurationType()
@@ -205,7 +202,7 @@ def handle_errors(fn):  # type: ignore[no-untyped-def]
                     output.error_panel(str(exc), title="Sandbox Error")
                 else:
                     output.error_panel(
-                        f"{str(exc)}\n\n[dim]Type: {type(exc).__qualname__}[/]",
+                        f"{exc}\n\nType: {type(exc).__qualname__}",
                         title=type(exc).__name__,
                     )
             else: