/sandbox-cp
Copy a file OUT of a running sandbox box to the host — host-initiated egress only (docker cp). The reverse, a host→container bind, is impossible by construction.
$ npx -y skills add arbiterForge/codeArbiter --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/sandbox-cp
Context preview
What this command does when you run it.
Copy a file OUT of a running sandbox box to the host — host-initiated egress only (docker cp). The reverse, a host→container bind, is impossible by construction.
Command definition
sandbox-cp.mddescription: Copy a file OUT of a running sandbox box to the host — host-initiated egress only (docker cp). The reverse, a host→container bind, is impossible by construction.
argument-hint: "<sandbox id>:/work/<file> ./dest"
/ca-sandbox:sandbox-cp — copy a file out of the box
The one sanctioned way to get a file out of an isolated box. Copy is **host-initiated egress only**: the host pulls a file from the box via `docker cp`. There is no path for the box to push files to the host, and there is no host→container bind to copy *in* — the mount builder rejects every bind spec, so the reverse direction is impossible by construction, not by policy.
Use it to extract a build artifact, a generated report, or a file you produced while exploring — without ever giving the untrusted code a writable window onto your filesystem.
Flow
1. **Resolve the box** — find the running `ca.sandbox=1` container for the id. STOP if absent. 2. **Copy out** — call `cpOut` in `${CLAUDE_PLUGIN_ROOT}/tools/cp.ts`: `cp <id>:/work/<f> ./dest` over `docker cp`. The source is inside the box; the destination is a host path. 3. **Confirm** — report the host destination the file landed at.
Routes to
`sandbox-lifecycle` (`${CLAUDE_PLUGIN_ROOT}/skills/sandbox-lifecycle/SKILL.md`) — Phase 4 (interact), via the `cpOut` seam in `${CLAUDE_PLUGIN_ROOT}/tools/cp.ts`.
When NOT to use
- Browsing or running things in the box → `/ca-sandbox:sandbox-shell`, `/ca-sandbox:sandbox-exec`.
- Tearing the box down → `/ca-sandbox:sandbox-destroy`.
- No box exists yet → `/ca-sandbox:sandbox`.
Hard gate
- MUST be host-initiated egress (`docker cp` OUT) only. MUST NOT establish a host→container bind to copy
files in — the mount builder rejects every bind, and this command MUST NOT route around it.
- MUST copy only from a running `ca.sandbox=1`-labeled container; MUST NOT mount, create, or modify any
container or volume.
- MUST NOT grant the box write access to a host path under cover of a copy; the only data flow is the
host reading one file out.
Read more
description: Copy a file OUT of a running sandbox box to the host — host-initiated egress only (docker cp). The reverse, a host→container bind, is impossible by construction. argument-hint: "<sandbox id>:/work/<file> ./dest"
/ca-sandbox:sandbox-cp — copy a file out of the box
The one sanctioned way to get a file out of an isolated box. Copy is **host-initiated egress only**: the host pulls a file from the box via `docker cp`. There is no path for the box to push files to the host, and there is no host→container bind to copy *in* — the mount builder rejects every bind spec, so the reverse direction is impossible by construction, not by policy.
Use it to extract a build artifact, a generated report, or a file you produced while exploring — without ever giving the untrusted code a writable window onto your filesystem.
Flow
1. **Resolve the box** — find the running `ca.sandbox=1` container for the id. STOP if absent. 2. **Copy out** — call `cpOut` in `${CLAUDE_PLUGIN_ROOT}/tools/cp.ts`: `cp <id>:/work/<f> ./dest` over `docker cp`. The source is inside the box; the destination is a host path. 3. **Confirm** — report the host destination the file landed at.
Routes to
`sandbox-lifecycle` (`${CLAUDE_PLUGIN_ROOT}/skills/sandbox-lifecycle/SKILL.md`) — Phase 4 (interact), via the `cpOut` seam in `${CLAUDE_PLUGIN_ROOT}/tools/cp.ts`.
When NOT to use
- Browsing or running things in the box → `/ca-sandbox:sandbox-shell`, `/ca-sandbox:sandbox-exec`.
- Tearing the box down → `/ca-sandbox:sandbox-destroy`.
- No box exists yet → `/ca-sandbox:sandbox`.
Hard gate
- MUST be host-initiated egress (`docker cp` OUT) only. MUST NOT establish a host→container bind to copy
files in — the mount builder rejects every bind, and this command MUST NOT route around it.
- MUST copy only from a running `ca.sandbox=1`-labeled container; MUST NOT mount, create, or modify any
container or volume.
- MUST NOT grant the box write access to a host path under cover of a copy; the only data flow is the
host reading one file out.
When you can't trust yourself with your code base, trust Arbiter.
Repo: arbiterForge/codeArbiter
Other commands on codearbiter.
- /add-dep
Vet a new or changed third-party dependency for license, provenance, and supply-chain risk before any install runs.
Open command - /adr-status
Report the health of Architecture Decision Records — aged, unchallenged, supersession candidates, unresolved CONFIRM-NN. Read-only.
Open command - /adr
Author a numbered, dated, user-attributed Architecture Decision Record under .codearbiter/decisions/.
Open command - /arbiter
Exit maintainer dev mode — restore orchestration, remove the dev marker, log the exit.
Open command - /audit
Assemble the governance record for a range — commits, overrides, ADRs, sprint auto-decisions, open questions, checkpoint findings — into one dated audit packet. Read-only.
Open command - /btw
Lightweight Q&A about the project — answer from context and return, no routing, no state change.
Open command