CelestoAI · aniketmaurya · Sep 11, 2026 · Sep 11, 2026
diff --git a/cloud/cli.mdx b/cloud/cli.mdx
@@ -1,10 +1,10 @@
 ---
 title: "Celesto CLI reference"
 sidebarTitle: "CLI reference"
 description: "Use the celesto CLI to authenticate, create computers, run commands, publish ports, and manage sandbox lifecycle from the terminal."
 ---

 The `celesto` CLI lets you manage Celesto from your terminal. Use it for one-off sandbox work, scripts, and debugging SDK workflows.

 ## Install and sign in

@@ -84,7 +84,7 @@
 
 | Command | Description |
 |---|---|
-| `celesto computer create [--template ID] [--cpus N] [--memory MB] [--disk-size-mb MB] [--no-internet]` | Create a computer. Pass `--no-internet` to turn off outbound internet access. |
+| `celesto computer create [--template ID] [--cpus N] [--memory MB] [--disk-size-mb MB] [--no-internet]` | Create a computer. Pass `--no-internet` to turn off outbound internet access (requires `celesto` `0.0.13` or later). |
 | `celesto computer templates` | List templates with preinstalled tools |
 | `celesto computer list [--status STATUS] [--template ID] [--project ID] [--limit N]` | List matching computers |
 | `celesto computer get NAME` | Get one computer by name or ID |
@@ -132,7 +132,7 @@
 celesto computer port list einstein
 ```

 Unpublish the port when you are done:

 ```bash
 celesto computer port unpublish einstein --port 8000
@@ -144,7 +144,7 @@
 | `celesto computer port list NAME` | List published ports for a computer |
 | `celesto computer port unpublish NAME [--port N]` | Stop exposing a port. Defaults to `8000` |

 A computer can have up to four ports published at a time, and Celesto system ports are reserved for the platform.

 ## Auto-resume stopped computers

@@ -175,7 +175,7 @@
 celesto update
 ```

 The command upgrades `celesto` using `pip` when it is available, and falls back to `uv` when you installed Celesto with `uv` or are running inside a `uv run` environment.

 If neither `pip` nor `uv` is available, the command prints the exact command to run yourself, for example:


diff --git a/cloud/computers.mdx b/cloud/computers.mdx
@@ -1,7 +1,7 @@
 ---
 title: "Create and manage sandboxed computers"
 sidebarTitle: "Sandboxed computers"
 description: "Use the Celesto Computers API to create sandboxed computers, select templates, run shell commands, publish ports, and manage the VM lifecycle."
 ---

 The Computers API gives your code or agent an isolated Linux computer. You create a computer, run work inside it, and then stop, start, or delete it when your workflow is done.
@@ -21,7 +21,7 @@
 </Steps>

 <Note>
  Celesto accepts Nano (1 vCPU, 512 MB), Small (1 vCPU, 1 GB), Standard (2 vCPU, 4 GB), and Large (4 vCPU, 12 GB). Free and Nano plans can create Nano computers. Builder and Growth can create every named size. See [Choose computer size](/cloud/features/resources).
 </Note>

 <View title="Python" icon="python">
@@ -84,7 +84,7 @@
 </ParamField>
 
 <ParamField body="network_policy" type="object" default='{"mode": "open"}'>
-  Outbound internet setting, fixed when you create the computer. Use `{"mode": "off"}` to create an offline computer. Offline computers use the default home storage rather than `persistent_home=True`.
+  Outbound internet setting, fixed when you create the computer. Use `{"mode": "off"}` to create an offline computer. Offline computers use the default home storage and cannot be combined with `persistent_home=True`. Requires Celesto SDK `0.0.13` or later.
 </ParamField>
 
 See [Network Control](/cloud/features/network-control) for Python, TypeScript, CLI, and OpenAI Agents examples.
@@ -160,7 +160,7 @@

 ## Stream command output

 Use `run_stream()` when you want to see output as it is produced instead of waiting for the command to finish. It returns an iterator of event dicts that arrive over a server-sent events stream, which is useful for long-running builds, test suites, or agent tool calls that print progress.

 ```python stream_command.py
 from celesto import Computer
@@ -203,7 +203,7 @@

 Publishing a port gives your computer a public HTTPS URL. Use it when an app, API server, or notebook running inside the computer needs to be reachable from outside the sandbox.

 Pick any application port from `1024` through `65535`. A computer can have up to four ports published at a time, and Celesto system ports are reserved for the platform.

 ```python publish_port.py
 from celesto import Computer
@@ -224,7 +224,7 @@

 ## Open a terminal connection

 Use `create_terminal_session()` when your application needs an interactive shell against a running computer, for example to power a web terminal in your own product. It calls `POST /computers/{id}/terminals` and returns a short-lived, direct connection to Celesto's fast terminal gateway. Your account must have write access to the computer.

 ```python terminal.py
 import websockets
@@ -344,6 +344,12 @@
   Keep `/home/ohm` across stop and restore. Set this at create time when you plan to reuse the computer across sessions. This setting cannot be changed after the computer is created.
 </ParamField>
 
+<ParamField body="networkPolicy" type="object" default='{ mode: "open" }'>
+  Outbound internet setting, fixed when you create the computer. Use `{ mode: "off" }` to create an offline computer. Offline computers use the default home storage and cannot be combined with `persistentHome: true`. Requires `@celestoai/sdk` `0.1.5` or later.
+</ParamField>
+
+See [Network Control](/cloud/features/network-control) for Python, TypeScript, CLI, and OpenAI Agents examples.
+
 ## Create a computer with a persistent home
 
 Computers are ephemeral by default. Pass `persistentHome: true` to keep `/home/ohm` across stop and restore:
@@ -485,7 +491,7 @@

 Publishing a port gives your computer a public HTTPS URL. Use it when an app, API server, or notebook running inside the computer needs to be reachable from outside the sandbox.

 Pick any application port from `1024` through `65535`. A computer can have up to four ports published at a time, and Celesto system ports are reserved for the platform.

 ```ts publish-port.ts
 import { Computer } from "@celestoai/sdk";
@@ -518,7 +524,7 @@

 ## Open a terminal connection

 Use `createTerminalSession()` when you are building your own interactive terminal against a Celesto computer, for example to power a web terminal in your own product. It calls `POST /computers/{id}/terminals` and returns a short-lived, direct connection to Celesto's fast terminal gateway. Your account must have write access to the computer.

 ```ts terminal.ts
 import WebSocket from "ws";
@@ -577,7 +583,7 @@
 </ResponseField>

 <ResponseField name="vcpus" type="integer" required>
  Number of virtual CPUs allocated.
 </ResponseField>

 <ResponseField name="ram_mb" type="integer" required>

diff --git a/cloud/features/network-control.mdx b/cloud/features/network-control.mdx
@@ -4,10 +4,14 @@
 description: "Choose whether an agent computer can connect to the internet, while keeping commands and terminal sessions available for your agent workflow."
 ---
 
-You can decide whether a new Celesto computer can reach the internet. Turn internet access off for work that uses only the computer's files and installed tools. The computer can still run commands and provide a terminal for your agent.
+You can decide whether a new Celesto computer can reach the internet. Turn internet access off when you want the computer to work only from files and tools already on disk, for example when an agent runs untrusted code, processes sensitive input that must not leave the sandbox, or reproduces a build with no outside package fetches. The computer can still run commands and provide a terminal for your agent.
 
 Set the choice when you create a computer. It stays with that computer across stop, start, and restore, so create a new computer when a task needs a different setting.
 
+<Note>
+  Network Control requires Celesto SDK **0.0.13** or later for Python and **0.1.5** or later for TypeScript. The `--no-internet` CLI flag ships in the same Python release.
+</Note>
+
 ## Choose an internet setting
 
 | Setting | What your computer can do |
@@ -15,7 +19,7 @@
 | `open` | Connect to the internet. This is the default. |
 | `off` | Run commands and use terminal sessions with outbound internet access turned off. |

 Network Control currently supports these two settings. Domain and IP allowlists are not available.

 ## Create an offline computer

@@ -138,7 +142,7 @@
 asyncio.run(main())
 ```
 
-When you reuse a computer with `computer_id`, the requested policy must match that computer's saved setting. Omit `network_policy` when you want to reuse the computer's existing setting. For a complete agent workflow, see [Sandbox an OpenAI agent with Celesto or SmolVM](/cloud/openai-agents).
+When you reuse a computer with `computer_id`, the requested policy must match that computer's saved setting. If it does not, the session fails closed: `client.create()` raises `RuntimeError` and does not start the computer, so an agent that expected an offline sandbox never runs against an online one. Omit `network_policy` when you want to accept whatever setting the existing computer was created with. For a complete agent workflow, see [Sandbox an OpenAI agent with Celesto or SmolVM](/cloud/openai-agents).
 
 ## Related pages
 

diff --git a/cloud/openai-agents.mdx b/cloud/openai-agents.mdx
@@ -1,13 +1,13 @@
 ---
 title: "Sandbox an OpenAI agent with Celesto or SmolVM"
 description: "Give an OpenAI agent its own sandboxed computer. Use a hosted Celesto computer or a local SmolVM as the workspace for a SandboxAgent."
 ---

 The Celesto SDK ships with two ready-made sandbox providers for the [OpenAI Agents SDK](https://openai.github.io/openai-agents-python/). With one of them plugged in, an OpenAI `SandboxAgent` can read files, run shell commands, and create artifacts in an isolated computer instead of on your laptop or server.

 You get to pick where that computer lives:

 - **Hosted Celesto computer** for cloud runs you can share, persist, and resume from any machine.
 - **Local SmolVM sandbox** for fast, private runs that stay on your own hardware.

 Both options expose the exact same OpenAI primitives (`SandboxAgent`, `SandboxRunConfig`, `Runner`), so you can swap providers without changing the rest of your agent code.
@@ -16,7 +16,7 @@

 Reach for these integrations when you want an OpenAI agent to:

 - Run untrusted or model-generated commands without touching your machine.
 - Inspect, edit, or build files in a clean, throwaway workspace.
 - Pause a session, save it, and resume it later from a different process.

@@ -24,19 +24,19 @@

 ## Installation

 Install the Celesto SDK with the `openai-agents` extra. This pulls in the OpenAI Agents SDK and SmolVM alongside Celesto:

 ```bash
 pip install "celesto[openai-agents]"
 ```

 <Note>
  The hosted provider needs a Celesto API key. Set `CELESTO_API_KEY` or pass `api_key=` when you create the client. The SmolVM provider runs locally and does not need an API key.
 </Note>

 ## Hosted Celesto sandboxes

 Use `CelestoSandboxClient` when you want OpenAI to spin up a fresh Celesto computer for the agent's session. The client creates the computer on `create()`, runs every shell command and file operation against it, and tears it down on `delete()`.

 <Steps>
  <Step title="Import the provider and OpenAI primitives">
@@ -94,7 +94,7 @@
 Pass a `CelestoSandboxClientOptions` to control how the computer is created. Every field is optional. Omit a field to inherit the template's default.

 <Note>
  CPU and memory must match a named Celesto size. Free and Nano plans use Nano (1 vCPU, 512 MB). Builder and Growth can also use Small (1 vCPU, 1 GB), Standard (2 vCPU, 4 GB), and Large (4 vCPU, 12 GB). See [Choose computer size](/cloud/features/resources).
 </Note>

 <ParamField body="template_id" type="string" default="scratch">
@@ -122,11 +122,11 @@
 </ParamField>

 <ParamField body="computer_id" type="string">
  Reuse an existing Celesto computer instead of creating a new one. When set, the session attaches to that computer and starts it if needed.
 </ParamField>
 
 <ParamField body="network_policy" type="object" default='{"mode": "open"}'>
-  Outbound internet setting for a newly created computer. Use `{"mode": "off"}` to create an offline computer. When you reuse `computer_id`, the requested setting must match that computer.
+  Outbound internet setting for a newly created computer. Use `{"mode": "off"}` to create an offline computer. When you reuse `computer_id`, the requested setting must match that computer's saved policy; if it does not, `client.create()` raises `RuntimeError` and does not start the computer. Requires Celesto SDK `0.0.13` or later.
 </ParamField>
 
 <ParamField body="delete_on_close" type="boolean">
@@ -248,7 +248,7 @@

 ### Read and write files in the sandbox

 `SandboxAgent` operations call `read()` and `write()` on the session. The Celesto and SmolVM providers map those calls to the underlying computer or VM:

 ```python
 from pathlib import Path
@@ -279,7 +279,7 @@

 <AccordionGroup>
  <Accordion title="ImportError: OpenAI Agents support is not installed">
    The integration is an optional extra. Install it with `pip install "celesto[openai-agents]"`. This adds the `openai-agents` and `smolvm` packages alongside Celesto.
  </Accordion>
  <Accordion title="The agent can't find files I expected">
    Files written through `session.write()` land inside the sandbox workspace, not on your host. Use `session.read()` or `session.persist_workspace()` to pull them out.