docs(sandbox): document Claude Code auth, add sandbox skill reference

[jamie-at-bunny]

No description provided.

[bogdan-at-bunny]

@codex review

[changeset-bot]

⚠️ No Changeset found

Latest commit: 172fff5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[greptile-apps]

Greptile Summary

This PR documents Claude Code authentication inside Bunny sandboxes, fixes two pre-existing inaccuracies in the README (removes the non-existent "public HTTPS hostname" from create output and the list columns table), and adds a new skills/bunny-cli/references/sandbox.md reference covering all sandbox subcommands.

• README.md: Adds a Claude Code credentials section, corrects create output description, removes hostname column from list, and contains a duplicate --env-file .env example (two consecutive identical lines under different comments).
• SKILL.md: Expands the skill description to include sandboxes and adds a quick-start snippet, but the snippet uses -e ANTHROPIC_API_KEY=sk-ant-... which contradicts the --env-file recommendation elsewhere and leaks the key into shell history.
• references/sandbox.md: Comprehensive new reference with accurate command shapes, flag tables, and consistent --env-file security guidance.

Confidence Score: 4/5

Safe to merge after addressing the SKILL.md example that passes the Anthropic API key as a CLI argument, which writes it to shell history.

The SKILL.md quick-start snippet uses -e ANTHROPIC_API_KEY=sk-ant-... — a command-line argument that lands in shell history — while every other part of this PR explicitly steers users toward --env-file to avoid exactly that. An LLM consuming the skill may reproduce the less-safe pattern. Everything else in the PR is accurate and well-structured.

skills/bunny-cli/SKILL.md — the quick-start example contradicts the security guidance in sandbox.md

Important Files Changed

Filename	Overview
packages/cli/README.md	Updates sandbox section: fixes "public HTTPS hostname" output claim, clarifies Claude Code auth setup, and removes hostname from list columns. Contains a duplicate --env-file .env example that adds noise without differentiation.
skills/bunny-cli/SKILL.md	Adds sandbox commands to skill description and adds a quick-start snippet using -e ANTHROPIC_API_KEY=sk-ant-..., which contradicts the --env-file recommendation in the companion sandbox.md and would leave the key in shell history.
skills/bunny-cli/references/sandbox.md	New reference document covering all sandbox subcommands with accurate output descriptions, correct CLAUDE_CONFIG_DIR pinning note, and consistent --env-file guidance for Anthropic credentials.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[bunny sandbox create] -->|--env-file .env| B[ANTHROPIC_API_KEY baked into container]
    A -->|no key provided| C[Container starts without credentials]
    B --> D[Claude Code ready immediately]
    C --> E[ssh into sandbox]
    E --> F[run claude interactively]
    F --> G[Login writes to /workplace/.claude\nvia CLAUDE_CONFIG_DIR]
    D --> H[Credentials survive restarts and redeploys]
    G --> H

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[bunny sandbox create] -->|--env-file .env| B[ANTHROPIC_API_KEY baked into container]
    A -->|no key provided| C[Container starts without credentials]
    B --> D[Claude Code ready immediately]
    C --> E[ssh into sandbox]
    E --> F[run claude interactively]
    F --> G[Login writes to /workplace/.claude\nvia CLAUDE_CONFIG_DIR]
    D --> H[Credentials survive restarts and redeploys]
    G --> H

Loading

_{Reviews (2): Last reviewed commit: "docs(sandbox): note default config path ..." | Re-trigger Greptile}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 18fd57ace7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".