docker/sbx-kit-claude-mixin:1.0.0

schemaVersion: "3"
displayName: Claude Code (mixin)
description: Anthropic's Claude Code as a mixin — the native install in an overlay, with the `anthropic` credential (API key or Claude subscription) resolved by the sandbox proxy, the session-state volumes, and the hooks the agent needs. Layer it onto a shell base and run `claude`.
version: 1.0.0
kind: mixin
provides:
    - claude
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - api.anthropic.com
                - console.anthropic.com
                - claude.ai
                - mcp-proxy.anthropic.com
                - platform.claude.com
                - downloads.claude.ai
                - claude.com
                - code.claude.com
                - bridge.claudeusercontent.com
                - archive.ubuntu.com
                - security.ubuntu.com
                - ports.ubuntu.com
                - download.docker.com
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.anthropic.com
                  format: '%s'
                  header: x-api-key
                - domain: console.anthropic.com
                  format: '%s'
                  header: x-api-key
                - domain: claude.ai
                  format: '%s'
                  header: x-api-key
                - domain: mcp-proxy.anthropic.com
                  format: '%s'
                  header: x-api-key
            name: ANTHROPIC_API_KEY
        oauth:
            credentialFile:
                path: ~/.claude/.credentials.json
                structure:
                    claudeAiOauth:
                        accessToken: '{{.AccessToken}}'
                        expiresAt: '{{.ExpiresAt}}'
                        refreshToken: '{{.RefreshToken}}'
                        scopes: '{{.Scopes}}'
                    primaryApiKey: '{{.PrimaryApiKey}}'
            sentinels:
                accessToken: sk-ant-oat01-proxy-managed
                refreshToken: sk-ant-ort01-proxy-managed
            tokenEndpoint:
                host: platform.claude.com
                path: /v1/oauth/token
        phase: runtime
        service: anthropic
      description: Anthropic API access (console API key or Claude subscription)
    - type: com.docker.sandbox/volume@1
      config:
        path: /home/agent/.claude/projects
        size: 2g
      description: Conversation transcripts; grows without bound, so it gets the headroom
    - type: com.docker.sandbox/volume@1
      config:
        path: /home/agent/.claude/sessions
        size: 512m
      description: Per-session state JSON; load-bearing for `claude -c`
    - type: com.docker.sandbox/volume@1
      config:
        path: /home/agent/.claude/todos
        size: 512m
      description: TodoWrite state
    - type: com.docker.sandbox/volume@1
      config:
        path: /home/agent/.claude/shell-snapshots
        size: 512m
      description: Bash state across sessions — one snapshot per shell session
    - type: com.docker.sandbox/volume@1
      config:
        path: /home/agent/.claude/statsig
        size: 512m
      description: Local feature-flag cache; the telemetry switch suppresses event reporting, not these gate lookups
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: |
                set -e
                ws="${WORKSPACE_DIR:-/}"
                esc=$(printf '%s' "$ws" | sed 's/\\/\\\\/g; s/"/\\"/g; s/\t/\\t/g; s/\r/\\r/g')
                projects="\"/\": { \"hasTrustDialogAccepted\": true }"
                [ "$ws" = "/" ] || projects="$projects, \"$esc\": { \"hasTrustDialogAccepted\": true }"
                printf '%s\n' "{
                  \"bypassPermissionsModeAccepted\": true,
                  \"hasCompletedOnboarding\": true,
                  \"projects\": { $projects }
                }" > /home/agent/.claude.json
                chown agent:agent /home/agent/.claude.json
              description: Seed Claude bypass/trust flags (root; overwrites any base-shipped file)
              env:
                - WORKSPACE_DIR
              user: "0"
            - command: |
                set -e
                mkdir -p /home/agent/.claude
                HELPER=''
                if [ "${SBX_CRED_ANTHROPIC_MODE:-none}" != none ]; then
                  HELPER='  "apiKeyHelper": "echo proxy-managed",
                '
                fi
                printf '%s' "{
                  \"themeId\": 1,
                  \"alwaysThinkingEnabled\": true,
                ${HELPER}  \"permissions\": { \"defaultMode\": \"bypassPermissions\" },
                  \"bypassPermissionsModeAccepted\": true,
                  \"skipDangerousModePermissionPrompt\": true
                }
                " > /home/agent/.claude/settings.json
              description: Seed Claude settings.json from SBX_CRED_ANTHROPIC_MODE
              env:
                - SBX_CRED_ANTHROPIC_MODE
              user: agent
            - command: |
                set -e
                [ -n "$MCP_GATEWAY_URL" ] || exit 0
                export PATH="$HOME/.local/bin:$HOME/.claude/local:$PATH"
                claude mcp add mcp-gateway "$MCP_GATEWAY_URL" \
                  --transport http \
                  --scope user \
                  --header "Authorization: Bearer $MCP_SENTINEL_TOKEN_NAME" || true
              description: Register the sandbox MCP gateway with claude (install-time, race-free)
              env:
                - MCP_GATEWAY_URL
                - MCP_SENTINEL_TOKEN_NAME
              user: agent
        startup:
            - command:
                - sh
                - -c
                - chown -R agent:agent /home/agent/.claude/projects /home/agent/.claude/sessions /home/agent/.claude/todos /home/agent/.claude/shell-snapshots /home/agent/.claude/statsig 2>/dev/null || true
              description: Re-own claude session-state volume mount roots to agent (block-volume mkfs trap)
              user: "0"
            - background: true
              command:
                - sh
                - -c
                - '{ command -v apt-get && apt-get update -qq -y || true; } >/dev/null 2>&1 </dev/null'
              description: Update apt package cache in background
              user: root
            - command:
                - sh
                - -c
                - |
                  set -e
                  [ -n "$MCP_GATEWAY_URL" ] || exit 0
                  export PATH="$HOME/.local/bin:$HOME/.claude/local:$PATH"
                  claude mcp add mcp-gateway "$MCP_GATEWAY_URL" \
                    --transport http \
                    --scope user \
                    --header "Authorization: Bearer $MCP_SENTINEL_TOKEN_NAME" || true
              description: Register the sandbox MCP gateway with claude (startup fallback)
              env:
                - MCP_GATEWAY_URL
                - MCP_SENTINEL_TOKEN_NAME
              user: agent
    - type: com.docker.sandbox/agent-context@1
      config:
        contentFile: /usr/share/sandbox/kit/claude-mixin/claude-mixin-context.md
args:
    version:
        default: ""
        description: Claude Code release to install (empty, `stable`, `latest`, or an exact version)
        pattern: ^$|^stable$|^latest$|^[0-9]+\.[0-9]+\.[0-9]+$
        buildArg: CLAUDE_CODE_VERSION