[tikinang]

What Type of Change is this?

• New Page
• Minor Fix
• Minor Improvement
• Major Improvement

Description (required)

Brings the Zerops Box pages in line with the orchestrator and the zbox CLI after the beta feedback round. Do not merge before the matching orchestrator and CLI release is deployed.

Breaking changes readers must know

• Token ports read the token from X-Zerops-Box-Authorization: Bearer <token> (or once from ?token=). The client's own Authorization header now passes through to the app unchanged.
• The API answers env names only: launchContract.envNames on a sandbox and command.envNames on a session, never the values.
• A fork with per-child sizes uses children[] (name, cpus, memoryBytes, diskBytes), which replaces count/names. A body with both is refused.
• S3 export and import credentials are Workspace env names that must end in _accessKeyId / _secretAccessKey.
• PUT /api/rest/sandbox/{id} replaces the name and both TTLs together. zbox set / zbox rename keep what isn't passed.

Pages

• export (new): export to a workspace file (24 h, download) or your own S3 bucket, import from an export, an uploaded file or a bucket key, signed archives, secret-bearing refused, export errors.
• lifecycle: TERMINATING, RESTORING, ARCHIVED and the sandbox operation field. The park --no-memory sync check. Sizes, diskBytes and cold-boot-only resizes (zbox resize, zbox wake --cpus --memory --disk, resizeNeedsColdBoot, diskTooSmall). Per-child fork sizes and restore sizes. The enforced idle and absolute TTLs, retention, and zbox set semantics.
• access: scoped tokens (zbt_, the scope table, forbidden with scope metadata, zbox token), with cautions for the sandbox and base scopes. The full errors table, request limits, idempotency, and exit codes.
• networking: the token-port header, the zbox_session cookie, what is stripped and what passes through, X-Forwarded-*, the bare {port}-{id} host from the project, project ports refusing X-Forwarded-For, router errors.
• secrets: aliases and --secret GUEST=NAME, envNames, sticky secret-bearing, export refusal, the link to the workspace secrets ceiling.
• workspace-settings: the policy secrets ceiling (allowedModes, allowedNames), maxDiskBytes / defaultDiskBytes, what reserves capacity, workspaceFull on export and import.
• workspace-service: restart/stop/resize/move park sandboxes with memory after a sync pass (30 s budget), a reload keeps them running, a resize restarts the VM at once, GiB units.
• monitoring: event types and payloads including OPERATION_FAILED, EXPORTED, ARCHIVED, delivery and metrics retention.
• images: the 512 MiB base-build memory cap and its error, template --disk, template set semantics, soft delete.
• commands: working directory, what wakes and counts as activity, envNames on sessions, what a park does to sessions.
• lineages: how imports form lineages, zbox lineage list --limit --before, export pointer.
• isolation: scoped tokens, credentials on ports, export archives, base build authority.
• getting-started, connectors, overview, faq: CLI flags, GiB units, new concepts and questions (scoped tokens, export), limitations updated.
• sidebars.js gains the export page, and llms*.txt are regenerated.