Four VM recipes in JSON. Each recipe command finds rzv and runs rzv orca <step>. The plugin ships no code or binaries; Orca shows it as declarative. All logic is in the rzv CLI, whose source is public.

• The commit you selected in Orca, as a Git bundle made on your machine. Uncommitted changes stay on your machine.
• Your Git remotes, with any user name or password removed from http(s) URLs, and your user.name and user.email.
• Nothing else: no Git token, no SSH agent (agent forwarding is off), no Runzivo credential and no home directory.

Pushing from the sandbox needs credentials you set up inside it, such as gh auth login there.

Run Claude Code, Codex or other tools inside the sandbox and sign in to them there with your own accounts. Their credentials live in the sandbox and are deleted with it. Runzivo bills only the compute.

Sleep keeps the sandbox's whole disk: your checkout in /workspace, your home directory with tool sign-ins and settings, and packages you installed. Running processes end. A sign-in you leave in the sandbox stays until you sign out, the sandbox expires or you delete it, so sign out first if you don't want it kept.

OpenCode and Codex save their sign-in files (auth.json) so only your sandbox user can read them (mode 600). Other tools are not verified. While the sandbox runs, anyone with sandboxes:write in the Runzivo workspace has shell access to it and can read those files.

Orca connects with system OpenSSH through the config rzv writes in ~/.ssh/rzv/<sandbox>.conf (included from ~/.ssh/config):

• A user certificate valid for 15 minutes, renewed before each connection.
• Strict host verification against the Runzivo host CA for that one sandbox.
• No passwords, no agent or X11 forwarding.
• The connection runs through rzv sandboxes ssh --stdio, an authenticated relay; the sandbox has no public SSH port.

Every call uses your rzv sign-in (or RZV_API_KEY) and Runzivo's workspace roles: you can only create or reach sandboxes in workspaces where you have sandboxes:write. The plugin stores nothing but the sandbox id, workspace id and profile name in Orca's workspace data.

A failed create deletes the sandbox it made. Deleting the Orca workspace deletes the sandbox and its SSH config. A sandbox Orca lost track of still expires at the end of its lifetime; rzv orca status lists them.

Back to the README.