Update from code changes: document port publishing policy

celesto-sdk/cli.mdx

@@ -1,10 +1,10 @@
 ---
 title: Celesto CLI reference
 sidebarTitle: CLI reference
 description: "Use the celesto CLI to authenticate, create computers, run commands, publish ports, and manage sandbox lifecycle from the terminal."
 ---
 
 The `celesto` CLI lets you manage Celesto from your terminal. Use it for one-off sandbox work, scripts, and debugging SDK workflows.
 
 ## Install and sign in
 
@@ -129,7 +129,7 @@
 celesto computer port list einstein
 ```
 
 Unpublish the port when you are done:
 
 ```bash
 celesto computer port unpublish einstein --port 8000
@@ -137,10 +137,12 @@
 
 | Command | Description |
 |---|---|
-| `celesto computer port publish NAME [--port N]` | Expose a port on the public internet. Defaults to `8000` |
+| `celesto computer port publish NAME [--port N]` | Expose an application port (`1024`–`65535`) on the public internet. Defaults to `8000` |
 | `celesto computer port list NAME` | List published ports for a computer |
 | `celesto computer port unpublish NAME [--port N]` | Stop exposing a port. Defaults to `8000` |
 
+A computer can have up to four ports published at a time, and Celesto system ports are reserved for the platform.
+
 ## Auto-resume stopped computers
 
 The `run` and `ssh` commands automatically resume a stopped computer before executing. You can run a command or open a terminal session without calling `start` first.
@@ -170,7 +172,7 @@
 celesto update
 ```
 
 The command upgrades `celesto` using `pip` when it is available, and falls back to `uv` when you installed Celesto with `uv` or are running inside a `uv run` environment.
 
 If neither `pip` nor `uv` is available, the command prints the exact command to run yourself, for example:
 

celesto-sdk/computers.mdx

@@ -1,7 +1,7 @@
 ---
 title: Create and manage sandboxed computers
 sidebarTitle: Sandboxed computers
 description: "Use the Celesto Computers API to create sandboxed computers, select templates, run shell commands, publish ports, and manage the VM lifecycle."
 ---
 
 The Computers API gives your code or agent an isolated Linux computer. You create a computer, run work inside it, and then stop, start, or delete it when your workflow is done.
@@ -21,7 +21,7 @@
 </Steps>
 
 <Note>
   Celesto accepts Nano (1 vCPU, 512 MB), Small (1 vCPU, 1 GB), Standard (2 vCPU, 4 GB), and Large (4 vCPU, 12 GB). Free and Nano plans can create Nano computers. Builder and Growth can create every named size. See [Choose computer size](/celesto-sdk/features/resources).
 </Note>
 
 <View title="Python" icon="python">
@@ -136,7 +136,7 @@
 
 ## Stream command output
 
 Use `run_stream()` when you want to see output as it is produced instead of waiting for the command to finish. It returns an iterator of event dicts that arrive over a server-sent events stream, which is useful for long-running builds, test suites, or agent tool calls that print progress.
 
 ```python stream_command.py
 from celesto import Computer
@@ -179,6 +179,8 @@
 
 Publishing a port gives your computer a public HTTPS URL. Use it when an app, API server, or notebook running inside the computer needs to be reachable from outside the sandbox.
 
+Pick any application port from `1024` through `65535`. A computer can have up to four ports published at a time, and Celesto system ports are reserved for the platform.
+
 ```python publish_port.py
 from celesto import Computer
 
@@ -198,7 +200,7 @@
 
 ## Open a terminal connection
 
 Use `create_terminal_session()` when your application needs an interactive shell against a running computer, for example to power a web terminal in your own product. It calls `POST /computers/{id}/terminals` and returns a short-lived, direct connection to Celesto's fast terminal gateway. Your account must have write access to the computer.
 
 ```python terminal.py
 import websockets
@@ -442,6 +444,8 @@
 
 Publishing a port gives your computer a public HTTPS URL. Use it when an app, API server, or notebook running inside the computer needs to be reachable from outside the sandbox.
 
+Pick any application port from `1024` through `65535`. A computer can have up to four ports published at a time, and Celesto system ports are reserved for the platform.
+
 ```ts publish-port.ts
 import { Computer } from "@celestoai/sdk";
 
@@ -473,7 +477,7 @@
 
 ## Open a terminal connection
 
 Use `createTerminalSession()` when you are building your own interactive terminal against a Celesto computer, for example to power a web terminal in your own product. It calls `POST /computers/{id}/terminals` and returns a short-lived, direct connection to Celesto's fast terminal gateway. Your account must have write access to the computer.
 
 ```ts terminal.ts
 import WebSocket from "ws";
@@ -532,7 +536,7 @@
 </ResponseField>
 
 <ResponseField name="vcpus" type="integer" required>
   Number of virtual CPUs allocated.
 </ResponseField>
 
 <ResponseField name="ram_mb" type="integer" required>

celesto-sdk/features/publish-ports.mdx

@@ -1,10 +1,10 @@
 ---
 title: Publish ports from a sandboxed computer
 sidebarTitle: Publish ports
 description: "Expose a web server, API, notebook, or preview app running inside a Celesto computer through a public HTTPS URL with the SDK or CLI."
 ---
 
 Services inside a Celesto computer are private by default. This isolation is useful for running agents, notebooks, APIs, and preview apps safely, but it also means you need to expose a service before you can open it in a browser or send a webhook to it.
 
 Port publishing creates a public HTTPS URL that forwards traffic to a port inside the computer, so you can preview, test, and share running services without deploying them elsewhere.
 
@@ -19,6 +19,10 @@
 - Receive webhooks during a test run.
 - Inspect a notebook, dashboard, or development server.
 
+## What you can publish
+
+Pick any application port that your service listens on inside the computer, from `1024` through `65535`. A computer can have up to four ports published at a time — unpublish one before adding another once you reach the limit. Celesto system ports are reserved for the platform and cannot be published.
+
 ## Publish a service
 
 The following example starts a simple HTTP server on port `8000`, publishes the port, prints the public URL, lists published ports, and then removes the published port.
@@ -112,7 +116,7 @@
 ```
 
 <Tip>
   For short-lived previews, unpublish the port before deleting the computer.
 </Tip>
 
 ## Troubleshooting