docs: add porter sandbox logs command reference

mint.json

@@ -159,7 +159,8 @@
                 "standard/cli/command-reference/porter-job",
                 "standard/cli/command-reference/porter-datastore-connect",
                 "standard/cli/command-reference/porter-env",
-                "standard/cli/command-reference/porter-target"
+                "standard/cli/command-reference/porter-target",
+                "standard/cli/command-reference/porter-sandbox"
               ]
             }
           ]

standard/cli/command-reference/porter-sandbox.mdx

@@ -0,0 +1,59 @@
+---
+title: 'porter sandbox'
+description: "Fetch logs from Porter sandboxes with kubectl-style flags for lookback, line count, severity filtering, and timestamp formatting"
+---
+
+`porter sandbox` contains commands for managing sandboxes on a Porter cluster.
+
+## Prerequisites
+
+- You've logged in to the Porter CLI after running [porter auth login](/standard/cli/command-reference/porter-auth)
+- You're connected to the correct project by running [porter config set-project](/standard/cli/command-reference/porter-config)
+- You're connected to the correct cluster by running [porter config set-cluster](/standard/cli/command-reference/porter-config)
+
+---
+
+## `porter sandbox logs`
+
+Fetches and prints recent log lines from a sandbox. Each line renders as `<RFC3339-timestamp> [<level>] <text>`, with level-colored brackets when stdout is a TTY (red for `error`, yellow for `warning`, default for `info`).
+
+**Usage:**
+```bash
+porter sandbox logs <sandbox-id> [flags]
+```
+
+**Options:**
+
+| Flag | Description |
+|------|-------------|
+| `--since <duration>` | Lookback window as a Go duration (e.g. `30m`, `1h30m`). Defaults to `1h`. |
+| `--limit <n>` | Maximum number of log lines to return. Server cap is `5000`; `0` uses the server default. Defaults to `500`. |
+| `--tail <n>` | Alias for `--limit` (kubectl style). When `> 0`, overrides `--limit`. |
+| `--level <level>` | Client-side severity filter: `info`, `warning`, or `error`. Empty (default) returns all levels. |
+| `--no-timestamps` | Suppress the leading RFC3339 timestamp on each line. |
+
+<CodeGroup>
+```bash Default (last 1h, 500 lines)
+porter sandbox logs abc123
+```
+
+```bash Last 15 minutes, 100 lines
+porter sandbox logs abc123 --since 15m --tail 100
+```
+
+```bash Errors only, no timestamps
+porter sandbox logs abc123 --level error --no-timestamps
+```
+
+```bash Pipe to grep
+porter sandbox logs abc123 --tail 200 | grep -i 'panic\|fatal'
+```
+</CodeGroup>
+
+<Info>
+`--tail` wins when both `--limit` and `--tail` are set to different non-zero values. A warning is printed to stderr in that case.
+</Info>
+
+<Tip>
+Invalid values for `--since`, `--level`, `--limit`, or `--tail` exit with status code `2` (usage error), consistent with the other `porter sandbox` subcommands.
+</Tip>