diff --git a/README.md b/README.md
index af31595..b12233d 100644
--- a/README.md
+++ b/README.md
@@ -89,9 +89,9 @@ agent asset list                  # list stored assets (--session <id> scopes to
 agent asset get <asset-id> -o shot.png   # show one asset, or download its bytes with -o
 agent asset delete <asset-id>     # delete an asset (it disappears from list/get and its link stops resolving)
 
-agent sandbox variable list       # list sandbox env variable names (values are write-only)
-agent sandbox variable set A=1 B=2     # create/update variables (or --from-file .env/.json)
-agent sandbox variable delete K   # delete a variable
+agent variable list               # list sandbox env variable names (values are write-only)
+agent variable set A=1 B=2        # create/update variables (or --from-file .env/.json)
+agent variable delete K           # delete a variable
 
 agent budget                      # current budget summary
 agent usage                       # usage dashboard for the period
diff --git a/skills/ellipsis/SKILL.md b/skills/ellipsis/SKILL.md
index 6aa3aee..9d8f1b3 100644
--- a/skills/ellipsis/SKILL.md
+++ b/skills/ellipsis/SKILL.md
@@ -78,8 +78,8 @@ sandbox image actually builds, then deploy. The steps below are that flow.
    write-only store; a config receives only the variables it names.
 
    ```sh
-   agent sandbox variable set LINEAR_API_KEY=lin_api_...
-   agent sandbox variable set --from-file .env
+   agent variable set LINEAR_API_KEY=lin_api_...
+   agent variable set --from-file .env
    ```
 
 5. Draft a config and run it from the local file before anything deploys.
@@ -208,7 +208,7 @@ agent config default set <config-id>         # the config a bare start runs (--r
 agent template list                          # browse maintained templates
 agent model list                             # the model ids valid under `claude:`
 agent integration                            # connected GitHub/Slack/Linear/Sentry
-agent sandbox variable set LINEAR_API_KEY=...
+agent variable set LINEAR_API_KEY=...
 agent session start --config-file agents/my_agent.yaml --watch
                                              # prove a config before deploying
 ```
diff --git a/src/cli.tsx b/src/cli.tsx
index ef67cc9..43d89f6 100644
--- a/src/cli.tsx
+++ b/src/cli.tsx
@@ -5,7 +5,7 @@ import { registerMe } from './commands/me'
 import { registerSession } from './commands/session'
 import { registerReview } from './commands/review'
 import { registerConfig } from './commands/config'
-import { registerSandbox } from './commands/sandbox'
+import { registerVariable } from './commands/variable'
 import { registerAsset } from './commands/asset'
 import { registerHook } from './commands/hooks'
 import { registerTemplate } from './commands/template'
@@ -39,7 +39,7 @@ registerMe(program)
 registerSession(program)
 registerReview(program)
 registerConfig(program)
-registerSandbox(program)
+registerVariable(program)
 registerAsset(program)
 registerHook(program)
 registerTemplate(program)
diff --git a/src/commands/sandbox.ts b/src/commands/variable.ts
similarity index 96%
rename from src/commands/sandbox.ts
rename to src/commands/variable.ts
index 126f5d4..a6b35a4 100644
--- a/src/commands/sandbox.ts
+++ b/src/commands/variable.ts
@@ -5,13 +5,9 @@ import { alsoKnownAs, apiRoutes } from '../lib/help'
 import { formatTs, printJson, printTable, runAction } from '../lib/output'
 import type { SandboxVariableInput, SandboxVariableSummary } from '../lib/types'
 
-export function registerSandbox(program: Command): void {
-  const sandbox = program
-    .command('sandbox')
-    .description('Manage what every sandbox this account runs gets')
-
+export function registerVariable(program: Command): void {
   const variable = alsoKnownAs(
-    sandbox
+    program
       .command('variable')
       .description('Manage the env variables injected into every sandbox (values are write-only)'),
     'variables',
diff --git a/src/lib/help.ts b/src/lib/help.ts
index 6373bc9..a3ecdae 100644
--- a/src/lib/help.ts
+++ b/src/lib/help.ts
@@ -20,7 +20,7 @@ function withoutAliases(term: string, cmd: Command): string {
 const TOP_LEVEL_GROUPS: ReadonlyArray<{ title: string; commands: readonly string[] }> = [
   { title: 'Sessions', commands: ['session', 'review'] },
   { title: 'Agents', commands: ['config', 'model', 'template'] },
-  { title: 'Platform', commands: ['sandbox', 'asset', 'hook'] },
+  { title: 'Platform', commands: ['variable', 'asset', 'hook'] },
   { title: 'Integrations', commands: ['integration', 'github', 'slack', 'linear', 'sentry'] },
   { title: 'Spend', commands: ['budget', 'usage', 'analytics'] },
   { title: 'Account', commands: ['login', 'logout', 'me', 'host', 'ping'] },
diff --git a/test/sandbox.test.ts b/test/variable.test.ts
similarity index 98%
rename from test/sandbox.test.ts
rename to test/variable.test.ts
index 265852a..235967c 100644
--- a/test/sandbox.test.ts
+++ b/test/variable.test.ts
@@ -4,7 +4,7 @@ import {
   parseAssignment,
   parseEnvFile,
   parseJsonVars,
-} from '../src/commands/sandbox'
+} from '../src/commands/variable'
 
 describe('parseJsonVars', () => {
   it('parses a flat object of name → value', () => {