olegselajev241/agy-sbx-kit:latest

schemaVersion: "2"
kind: sandbox
name: agy
version: 1.0.0
displayName: Antigravity CLI (agy)
description: Run Google's Antigravity CLI (agy) in YOLO mode inside a Docker Sandbox. First run prints a Google OAuth URL you complete in your local browser; credentials persist across sandbox restarts.
sandbox:
    image: docker/sandbox-templates:shell-docker
    entrypoint:
        - agy
    command:
        default:
            - --dangerously-skip-permissions
            - --mode=accept-edits
        interactive:
            - --dangerously-skip-permissions
            - --mode=accept-edits
permissions:
    network:
        allow:
            - antigravity.google:443
            - antigravity-unleash.goog:443
            - antigravity-cli-auto-updater-974169037036.us-central1.run.app:443
            - storage.googleapis.com:443
            - accounts.google.com:443
            - lh3.googleusercontent.com:443
            - oauth2.googleapis.com:443
            - play.googleapis.com:443
            - www.googleapis.com:443
            - aicode.googleapis.com:443
            - cloudaicompanion.googleapis.com:443
            - cloudcode-pa.googleapis.com:443
            - daily-cloudcode-pa.googleapis.com:443
            - generativelanguage.googleapis.com:443
credentials:
    - service: antigravity
      description: Google OAuth session used by Antigravity CLI
      oauth:
        tokenEndpoint:
            host: oauth2.googleapis.com
            path: /token
        resourceHosts:
            - aicode.googleapis.com
            - cloudaicompanion.googleapis.com
            - cloudcode-pa.googleapis.com
            - daily-cloudcode-pa.googleapis.com
            - generativelanguage.googleapis.com
            - www.googleapis.com
        sentinels:
            accessToken: agy-oauth-access-proxy-managed
            refreshToken: agy-oauth-refresh-proxy-managed
        credentialFile:
            path: ~/.gemini/antigravity-cli/antigravity-oauth-token
            template: '{"token":{"access_token":"{{.AccessToken}}","token_type":"Bearer","refresh_token":"{{.RefreshToken}}","expiry":"9999-12-31T23:59:59Z"},"auth_method":"consumer"}'
environment:
    variables:
        SSH_CONNECTION: sandbox 0 sandbox 0
setup:
    install:
        - command: curl -fsSL https://antigravity.google/cli/install.sh | bash
          user: "1000"
          description: Install the Antigravity CLI (agy) into ~/.local/bin
    files:
        - path: /home/agent/.gemini/antigravity-cli/settings.json
          content: |
            {
              "agentMode": "accept-edits",
              "artifactReviewMode": "always-proceed",
              "fileAccessPolicy": "allow",
              "internetAccessPolicy": "allow",
              "nonWorkspaceFileAccess": "allow",
              "permissions": {
                "allow": [
                  "command(*)",
                  "execute_url(*)",
                  "mcp(*)",
                  "read_file(*)",
                  "read_url(*)",
                  "unsandboxed(*)",
                  "write_file(*)"
                ]
              },
              "toolExecutionPolicy": "always-proceed",
              "trustedWorkspaces": ["${WORKDIR}"]
            }
          mode: "0600"
          onlyIfMissing: true
          description: Seed permissive Antigravity settings for sandboxed operation