docker/sbx-kit-pi-mixin:latest

schemaVersion: "3"
displayName: Pi (mixin)
description: Pi as a mixin — the npm-installed coding agent and the `fd` binary its `find` tool probes for, in an overlay, with the Anthropic credential (API key or claude.ai OAuth). Layer it onto a shell base and run `pi`.
sourceUrl: https://www.npmjs.com/package/@earendil-works/pi-coding-agent
version: 0.86.1
kind: mixin
provides:
    - [email protected]
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - api.anthropic.com
                - registry.npmjs.org
                - platform.claude.com
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.anthropic.com
                  format: '%s'
                  header: x-api-key
            name: ANTHROPIC_API_KEY
            proxyManaged: true
        oauth:
            credentialFile:
                path: ~/.pi/agent/auth.json
                structure:
                    anthropic:
                        access: '{{.AccessToken}}'
                        expires: '{{.ExpiresAt}}'
                        refresh: '{{.RefreshToken}}'
                        type: oauth
            resourceHosts:
                - api.anthropic.com
            sentinels:
                accessToken: sk-ant-oat01-proxy-managed
                refreshToken: sk-ant-ort01-proxy-managed
            tokenEndpoint:
                host: platform.claude.com
                path: /v1/oauth/token
        phase: runtime
        service: anthropic
      description: Anthropic API access (API key or claude.ai OAuth)
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: if [ -n "${HTTP_PROXY:-}" ]; then npm config set proxy="$HTTP_PROXY" https-proxy="${HTTPS_PROXY:-$HTTP_PROXY}"; fi
              description: Point npm at the sandbox proxy in ~/.npmrc so pi's runtime npm use (`pi install npm:...`, `pi update`, startup package fetches) works in exec contexts that do not inherit the proxy environment variables
              env:
                - HTTP_PROXY
                - HTTPS_PROXY
              user: "1000"
    - type: com.docker.sandbox/agent-context@1
      config:
        contentFile: /usr/share/sandbox/kit/pi-mixin/pi-mixin-context.md
args:
    version:
        default: 0.86.1
        description: pi release to install
        pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
        buildArg: PI_VERSION