sbx/paperclip-kit:latest

schemaVersion: "2"
kind: sandbox
name: paperclip
displayName: Paperclip
description: Open-source app for managing AI agents at work — Node.js server + React UI orchestrating a team of agents. Uses a pre-baked image so sandboxes start in seconds.
sandbox:
    image: docker.io/sbx/paperclip-image:latest
    entrypoint:
        - sh
    command:
        default:
            - /home/agent/.local/bin/paperclip-start.sh
        interactive:
            - /home/agent/.local/bin/paperclip-start.sh
permissions:
    network:
        allow:
            - api.anthropic.com
            - claude.ai
            - console.anthropic.com
            - platform.claude.com:443
            - registry.npmjs.org
            - '*.npmjs.org'
            - github.com:443
            - raw.githubusercontent.com:443
            - objects.githubusercontent.com:443
            - paperclip.ing:443
ports:
    - container: 3100
      name: web
credentials:
    - service: anthropic
      apiKey:
        name: ANTHROPIC_API_KEY
        proxyManaged: true
        inject:
            - domain: api.anthropic.com
              header: x-api-key
              format: '%s'
            - domain: claude.ai
              header: x-api-key
              format: '%s'
            - domain: console.anthropic.com
              header: x-api-key
              format: '%s'
      oauth:
        tokenEndpoint:
            host: platform.claude.com
            path: /v1/oauth/token
        resourceHosts:
            - api.anthropic.com
        sentinels:
            accessToken: sk-ant-oat01-proxy-managed
            refreshToken: sk-ant-ort01-proxy-managed
        credentialFile:
            path: ~/.claude/.credentials.json
            structure:
                claudeAiOauth:
                    accessToken: '{{.AccessToken}}'
                    expiresAt: '{{.ExpiresAt}}'
                    refreshToken: '{{.RefreshToken}}'
                    scopes: '{{.Scopes}}'
environment:
    variables:
        HOST: 0.0.0.0
        PAPERCLIP_BIND: lan
        PAPERCLIP_DEPLOYMENT_MODE: authenticated
        PAPERCLIP_HOME: /home/agent/.paperclip
        PAPERCLIP_TELEMETRY_DISABLED: "1"
        SERVE_UI: "true"
setup:
    startup:
        - command:
            - sh
            - /home/agent/.local/bin/paperclip-anthropic-auth.sh
          user: "1000"
          description: Resolve whether Anthropic auth is an API key, a subscription login, or absent, and record it for the entrypoint and `sbx exec` shells