sbox

A small wrapper around sbx that launches one-off Claude Code sandboxes with sensible defaults:

• host env forwarded (Anthropic + Atlassian creds)
• caffeinate -i wrap on macOS
• --dangerously-skip-permissions, Opus model
• auto git worktree (branch mode)
• acli + bun baked into the template, tips/recaps off

Install

ln -s "$PWD/sbox" /usr/local/bin/sbox
sbox install

sbox install bootstraps a throwaway claude sandbox, runs setup.sh inside (installs acli, bun, disables tips/recaps), and snapshots it as sbox:latest. Re-run sbox install to refresh the baked-in tooling.

Use

cd ~/some/repo
sbox "refactor the auth module to use bcrypt"

# resume the last session in this cwd
sbox --continue

# a second concurrent sandbox in the same repo (different name)
sbox -n review "review the PR in branch feature/xyz"

# different repo, same template
sbox --cwd ~/other/repo "write tests for the billing service"

Default sandbox name is sbox-<basename-of-cwd>. Pass -n <tag> to get sbox-<cwd>-<tag> — useful for running multiple independent sandboxes in the same directory. Re-running with the same name attaches to the existing sandbox.

acli authentication inside the sandbox

Generate an API token at https://id.atlassian.com/manage-profile/security/api-tokens, then add these to your host ~/.zshrc:

export ATLASSIAN_EMAIL="you@example.com"
export ATLASSIAN_API_TOKEN="ATATT3x…"
export ATLASSIAN_SITE="yourcompany.atlassian.net"

The sbox launcher forwards all three into the sandbox alongside ANTHROPIC_*. acli reads the env vars directly and won't prompt.

Port forwarding (sandbox → host)

If you run a dev server inside the sandbox, expose it to the host with sbx ports from a separate host shell (no restart needed):

# same port on both sides — sandbox :3000 reachable at http://localhost:3000
sbx ports sbox-<cwd> --publish 3000

# remap — sandbox :8080 → host :9000
sbx ports sbox-<cwd> --publish 9000:8080

# list exposed ports
sbx ports sbox-<cwd>

# unpublish
sbx ports sbox-<cwd> --unpublish 3000:3000

Sandbox name is whatever sbox derived (sbox-<basename-of-cwd>, plus -<tag> if -n was used). sbx ls will show it.

The server inside the sandbox must bind to 0.0.0.0, not 127.0.0.1 — otherwise the forwarder can't reach it. Common flags: vite --host, next dev -H 0.0.0.0, HOST=0.0.0.0 npm start.