jhonasiv/pi-kit:latest

schemaVersion: "2"
kind: sandbox
name: pi
version: 0.1.0
displayName: Pi
description: Minimal reusable environment for running Pi
args:
    customRef:
        default: latest
        description: git ref of the pi-custom package to install
sandbox:
    image: docker.io/jhonasiv/pi:latest
    entrypoint:
        - pi
permissions:
    network:
        allow:
            - opencode.ai:443
            - registry.npmjs.org
            - github.com
            - api.github.com
            - pi.dev
            - download.docker.com
            - docs.docker.com
            - archive.ubuntu.com:80
            - security.ubuntu.com:80
            - sh.rustup.rs:443
            - static.rust-lang.org:443
            - index.crates.io:443
            - static.crates.io:443
volumes:
    - path: /home/agent/.pi/agent
      size: 1g
      mode: "0755"
security: {}
credentials:
    - service: github
      apiKey:
        name: GH_AUTH_TOKEN
        proxyManaged: true
        inject:
            - domain: github.com
              header: ""
              format: ""
environment:
    variables:
        EDITOR: nvim
        PAGER: less -FRX
        VISUAL: nvim
setup:
    install:
        - command: |
            git config --global credential.helper '!f() { echo "username=x-access-token"; echo "password=proxy-managed"; }; f'
        - command: |
            pi install git:github.com/jhonasiv/pi-agent@${{ kit.args.customRef }}
          user: agent
          description: Install pi customizations as a pinned git package
    files:
        - path: /home/agent/.pi/agent/settings.json
          content: |
            {
              "theme": "dark",
              "defaultProvider": "opencode-go",
              "defaultModel": "glm-5.3-flash",
              "defaultProjectTrust": "always",
              "enableInstallTelemetry": false
            }
          onlyIfMissing: true
          description: Seed global pi settings; volume-persisted edits win