Merge pull request #25708 from dvdksn/codex/update-sbx-secret-syntax

docs: update sbx secret scope syntax

Author: dvdksn

content/manuals/ai/sandboxes/agents/claude-code.md

@@ -35,7 +35,7 @@ Claude Code requires either an Anthropic API key or a Claude subscription.
 [stored secrets](../security/credentials.md#stored-secrets):
 
 ```console
-$ sbx secret set -g anthropic
+$ sbx secret set anthropic
 ```
 
 **Claude subscription**: If no API key is set, use the `/login` command inside

content/manuals/ai/sandboxes/agents/codex.md

@@ -38,7 +38,7 @@ To set up authentication ahead of time, choose one of the following methods.
 **OAuth**: Start the OAuth flow on your host with:
 
 ```console
-$ sbx secret set -g openai --oauth
+$ sbx secret set openai --oauth
 ```
 
 This opens a browser window for authentication and stores the resulting tokens
@@ -49,7 +49,7 @@ so browser-based authentication works without any extra setup.
 [stored secrets](../security/credentials.md#stored-secrets):
 
 ```console
-$ sbx secret set -g openai
+$ sbx secret set openai
 ```
 
 See [Credentials](../security/credentials.md) for more details.

content/manuals/ai/sandboxes/agents/copilot.md

@@ -33,7 +33,7 @@ Copilot requires a GitHub token with Copilot access. Store your token using
 [stored secrets](../security/credentials.md#stored-secrets):
 
 ```console
-$ echo "$(gh auth token)" | sbx secret set -g github
+$ echo "$(gh auth token)" | sbx secret set github
 ```
 
 ## Configuration

content/manuals/ai/sandboxes/agents/cursor.md

@@ -35,7 +35,7 @@ Cursor supports two authentication methods: an API key or OAuth.
 [stored secrets](../security/credentials.md#stored-secrets):
 
 ```console
-$ sbx secret set -g cursor
+$ sbx secret set cursor
 ```
 
 **OAuth**: If no API key is set, Cursor prompts you to sign in interactively

content/manuals/ai/sandboxes/agents/docker-agent.md

@@ -26,13 +26,13 @@ Docker Agent supports multiple providers. Store keys for the providers you want
 to use with [stored secrets](../security/credentials.md#stored-secrets):
 
 ```console
-$ sbx secret set -g openai
-$ sbx secret set -g anthropic
-$ sbx secret set -g google
-$ sbx secret set -g xai
-$ sbx secret set -g nebius
-$ sbx secret set -g mistral
-$ sbx secret set -g openrouter
+$ sbx secret set openai
+$ sbx secret set anthropic
+$ sbx secret set google
+$ sbx secret set xai
+$ sbx secret set nebius
+$ sbx secret set mistral
+$ sbx secret set openrouter
 ```
 
 You only need to configure the providers you want to use. Docker Agent detects

content/manuals/ai/sandboxes/agents/droid.md

@@ -37,7 +37,7 @@ your Factory account.
 [stored secrets](../security/credentials.md#stored-secrets):
 
 ```console
-$ sbx secret set -g droid
+$ sbx secret set droid
 ```
 
 **OAuth**: If no API key is set, Droid prompts you to authenticate

content/manuals/ai/sandboxes/agents/gemini.md

@@ -35,7 +35,7 @@ Gemini requires either a Google API key or a Google account with Gemini access.
 [stored secrets](../security/credentials.md#stored-secrets):
 
 ```console
-$ sbx secret set -g google
+$ sbx secret set google
 ```
 
 **Google account**: If no API key is set, Gemini prompts you to sign in

content/manuals/ai/sandboxes/agents/opencode.md

@@ -36,13 +36,13 @@ OpenCode supports multiple providers. Store keys for the providers you want to
 use with [stored secrets](../security/credentials.md#stored-secrets):
 
 ```console
-$ sbx secret set -g openai
-$ sbx secret set -g anthropic
-$ sbx secret set -g google
-$ sbx secret set -g xai
-$ sbx secret set -g groq
-$ sbx secret set -g aws
-$ sbx secret set -g openrouter
+$ sbx secret set openai
+$ sbx secret set anthropic
+$ sbx secret set google
+$ sbx secret set xai
+$ sbx secret set groq
+$ sbx secret set aws
+$ sbx secret set openrouter
 ```
 
 You only need to configure the providers you want to use. OpenCode detects
@@ -57,7 +57,7 @@ OpenCode Zen API keys aren't part of the built-in OpenCode credentials that
 Set the `OPENCODE_API_KEY` environment variable on the host, then store it:
 
 ```console
-$ sbx secret set-custom -g \
+$ sbx secret set-custom \
     --host opencode.ai \
     --env OPENCODE_API_KEY \
     --value "$OPENCODE_API_KEY"
@@ -73,8 +73,8 @@ OpenCode Zen also requires network access to `opencode.ai`:
 $ sbx policy allow network opencode.ai:443
 ```
 
-If you add the custom secret globally with `-g`, recreate existing OpenCode
-sandboxes so the new environment variable is available inside the sandbox.
+If you add a global custom secret, recreate existing OpenCode sandboxes so the
+new environment variable is available inside the sandbox.
 
 ## Configuration
 

content/manuals/ai/sandboxes/agents/shell.md

@@ -38,8 +38,8 @@ before running the sandbox. The proxy injects them into outbound API requests;
 credentials are never stored inside the VM:
 
 ```console
-$ sbx secret set -g anthropic
-$ sbx secret set -g openai
+$ sbx secret set anthropic
+$ sbx secret set openai
 ```
 
 Once inside the shell, you can install agents using their standard methods,

content/manuals/ai/sandboxes/customize/build-an-agent.md

@@ -223,7 +223,7 @@ to look like a real Amp key. Pick a placeholder shape that matches Amp's
 expected format:
 
 ```console
-$ sbx secret set-custom -g \
+$ sbx secret set-custom \
     --host ampcode.com \
     --env AMP_API_KEY \
     --placeholder "sgamp-{rand}" \
@@ -320,7 +320,7 @@ To remove the entry created earlier with `sbx secret set-custom`, pass
 the host to `sbx secret rm`:
 
 ```console
-$ sbx secret rm -g --host ampcode.com
+$ sbx secret rm --host ampcode.com
 ```
 
 The `--host` flag is part of the experimental `set-custom` surface and doesn't appear in `sbx secret rm --help`.