add sandbox PoC

.github/workflows/sandbox-agent.yml

@@ -0,0 +1,37 @@
+name: Sandbox Agent
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - sandbox/**
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./sandbox
+          push: true
+          tags: ghcr.io/bunnyway/sandbox-agent:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.4.12/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
   "vcs": {
     "enabled": true,
     "clientKind": "git",
@@ -15,7 +15,7 @@
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": true,
+      "preset": "recommended",
       "suspicious": {
         "noExplicitAny": "off"
       },

package.json

@@ -23,7 +23,7 @@
     "release": "changeset publish"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.12",
+    "@biomejs/biome": "2.5.0",
     "@changesets/changelog-github": "^0.6.0",
     "@changesets/cli": "^2.30.0",
     "@types/bun": "latest",

packages/cli/README.md

@@ -787,6 +787,134 @@ Open the Edge Scripts documentation in your browser.
 bunny scripts docs
 ```
 
+### `bunny sandbox`
+
+Manage on-demand cloud sandbox environments backed by Bunny Magic Containers. Each sandbox is a fully isolated Ubuntu container with Node.js, Bun, Python, and Claude Code pre-installed. A 10 GB persistent volume is mounted at `/workplace`, your default working directory.
+
+Sandbox credentials (app ID, hostname, SSH endpoint, agent token) are stored in `~/.config/bunnynet.json` so you can reconnect without re-creating.
+
+#### `bunny sandbox create`
+
+Create and start a new sandbox. Waits for the container's SSH port to become reachable before returning.
+
+```bash
+# Create a sandbox with the default name "sandbox"
+bunny sandbox create
+
+# Create a named sandbox
+bunny sandbox create my-sandbox
+
+# Create in a specific region
+bunny sandbox create my-sandbox --region NY
+```
+
+| Flag       | Description                                        | Default |
+| ---------- | -------------------------------------------------- | ------- |
+| `--region` | Region ID to deploy in (e.g. `AMS`, `NY`, `LA`, …) | `AMS`   |
+
+Once ready, the output shows the app ID, public HTTPS hostname, and SSH address.
+
+#### `bunny sandbox list`
+
+List all sandboxes saved in your local config.
+
+```bash
+bunny sandbox list
+bunny sandbox ls          # alias
+```
+
+Columns: Name, App ID, Hostname, SSH.
+
+#### `bunny sandbox delete`
+
+Delete a sandbox and permanently destroy the underlying Magic Containers app.
+
+```bash
+bunny sandbox delete my-sandbox
+
+# Skip the confirmation prompt
+bunny sandbox delete my-sandbox --force
+bunny sandbox rm my-sandbox -f   # alias
+```
+
+| Flag      | Alias | Description              | Default |
+| --------- | ----- | ------------------------ | ------- |
+| `--force` | `-f`  | Skip confirmation prompt | `false` |
+
+#### `bunny sandbox exec`
+
+Run a shell command inside a sandbox over SSH. Defaults to `/workplace` as the working directory.
+
+```bash
+# Run a command
+bunny sandbox exec my-sandbox ls -la
+
+# Run in a different directory
+bunny sandbox exec my-sandbox --cwd /tmp env
+
+# Pipe-friendly: exit code is propagated
+bunny sandbox exec my-sandbox -- cat /etc/os-release
+```
+
+| Flag    | Description                          | Default      |
+| ------- | ------------------------------------ | ------------ |
+| `--cwd` | Working directory inside the sandbox | `/workplace` |
+
+#### `bunny sandbox ssh`
+
+Open a full interactive SSH session. Drops you into a bash shell at `/workplace`. Type `exit` or press Ctrl-D to close.
+
+```bash
+bunny sandbox ssh my-sandbox
+```
+
+#### `bunny sandbox url`
+
+Manage public CDN endpoints for ports running inside a sandbox. Useful for exposing a dev server or API to the internet.
+
+##### `bunny sandbox url add`
+
+Expose a container port as a public HTTPS endpoint. Waits until the URL is provisioned and prints it.
+
+```bash
+# Expose port 3000 (endpoint named "port-3000")
+bunny sandbox url add my-sandbox 3000
+
+# Custom endpoint name
+bunny sandbox url add my-sandbox 8080 --label my-api
+```
+
+| Flag      | Description                   | Default       |
+| --------- | ----------------------------- | ------------- |
+| `--label` | Display name for the endpoint | `port-<port>` |
+
+##### `bunny sandbox url list`
+
+List all user-created endpoints for a sandbox (built-in `api` and `ssh` endpoints are hidden).
+
+```bash
+bunny sandbox url list my-sandbox
+bunny sandbox url ls my-sandbox    # alias
+```
+
+Columns: ID, Name, Type, Port, URL.
+
+##### `bunny sandbox url delete`
+
+Delete a public endpoint by name.
+
+```bash
+bunny sandbox url delete my-sandbox port-3000
+
+# Skip confirmation
+bunny sandbox url delete my-sandbox my-api --force
+bunny sandbox url rm my-sandbox my-api -f   # alias
+```
+
+| Flag      | Alias | Description              | Default |
+| --------- | ----- | ------------------------ | ------- |
+| `--force` | `-f`  | Skip confirmation prompt | `false` |
+
 ### `bunny api`
 
 Make a raw authenticated HTTP request to any bunny.net API endpoint. Auth is handled automatically via your configured API key.

packages/cli/src/cli.ts

@@ -12,6 +12,7 @@ import { dnsNamespace } from "./commands/dns/index.ts";
 import { docsCommand } from "./commands/docs.ts";
 import { openCommand } from "./commands/open.ts";
 import { registriesNamespace } from "./commands/registries/index.ts";
+import { sandboxNamespace } from "./commands/sandbox/index.ts";
 import { scriptsNamespace } from "./commands/scripts/index.ts";
 import { whoamiCommand } from "./commands/whoami.ts";
 import { bunny } from "./core/colors.ts";
@@ -35,6 +36,7 @@ const experimentalCommands: CommandModule[] = [
   appsNamespace,
   registriesNamespace,
   dnsNamespace,
+  sandboxNamespace,
 ];
 
 let instance = yargs(hideBin(process.argv))