The way sbx kits work is confusing

[toby-griffiths]

I very much welcome the idea of kits for configuring sandboxes, however I'm finding myself rather frustrated attempting to get things working as I think they should, so thought it might be helpful to feed back to help improve user experience.

1. Kit network policies don't seem to work. I've allowed access to github.com:443 both in a kits/network kit, and in a kits/plugins kit to alow me to install plugins via kits during creation, however I get the error that no policy allows access to github.com; (see also clarification on network policy with kit #140);
2. If running claude plugins install … during creation install reports that the marketplace is not available;
3. Trying to use startup:, rather than install: to install the plugins during creation it reports "Registering 20 startup command(s) (will run on every container start)...", however then running the sandbox does NOT install any of the plugins requested (& no error output), but just jumps straight into the Claude session, with no plugins installed;
4. It seems that kits are now consolidated before being run, rather than being run in the order defined, so it's not possible to allow network access, install some plugins, then revoke the network access; I believe this has changed since previous versions?;
5. Installing Claude pluigns during creation, using install seems to install the plugins (after globally allowing github.com:443 access, as above), but then when I run the sandbox the plugins are not showing as installed;
6. Finally got plugin installed & working by creating the sandbox first (without kits), then running the kits on the created sandbox (sbx kit add …), and then finally running the sandbox;

Hoping this feedback helps make things a little simpler. Happy to break this down into separate tickets if it helps?