sbx/picoclaw-kit:20260909-1a87cff00c00c9ab95d5b1e1331bb296e5bf3216

schemaVersion: "2"
kind: sandbox
name: picoclaw
displayName: PicoClaw
description: Tiny, fast personal AI assistant (Go, single static binary) — agent CLI plus a channel gateway, pre-baked at a pinned, SHA256-verified upstream release.
sandbox:
    image: docker.io/sbx/picoclaw-image:latest
    entrypoint:
        - sh
    command:
        default:
            - /home/agent/.local/bin/picoclaw-start.sh
        interactive:
            - /home/agent/.local/bin/picoclaw-start.sh
permissions:
    network:
        allow:
            - api.anthropic.com
            - claude.ai
            - console.anthropic.com
            - platform.claude.com:443
            - '*.telegram.org'
            - '*.discord.com'
            - gateway.discord.gg
            - '*.whatsapp.com'
            - '*.whatsapp.net'
            - '*.slack.com'
ports:
    - container: 18790
      name: gateway
    - container: 18791
      name: webhook
credentials:
    - service: anthropic
      apiKey:
        name: ANTHROPIC_API_KEY
        proxyManaged: true
        inject:
            - domain: api.anthropic.com
              header: x-api-key
              format: '%s'
            - domain: claude.ai
              header: x-api-key
              format: '%s'
            - domain: console.anthropic.com
              header: x-api-key
              format: '%s'
      oauth:
        tokenEndpoint:
            host: platform.claude.com
            path: /v1/oauth/token
        resourceHosts:
            - api.anthropic.com
        sentinels:
            accessToken: sk-ant-oat01-proxy-managed
            refreshToken: sk-ant-ort01-proxy-managed
        credentialFile:
            path: ~/.picoclaw/auth.json
            structure:
                credentials:
                    anthropic:
                        access_token: '{{.AccessToken}}'
                        auth_method: oauth
                        provider: anthropic
                        refresh_token: '{{.RefreshToken}}'
environment:
    variables:
        PICOCLAW_GATEWAY_HOST: 0.0.0.0
        PICOCLAW_HOME: /home/agent/.picoclaw
setup:
    startup:
        - command:
            - sh
            - /home/agent/.local/bin/picoclaw-anthropic-auth.sh
          user: "1000"
          description: Resolve the host's Anthropic credential into config.json at sandbox start
        - command:
            - sh
            - -c
            - curl -fsS -m 2 http://127.0.0.1:18790/health >/dev/null 2>&1 || { mkdir -p /home/agent/.picoclaw; HOME=/home/agent setsid sh -c '/usr/local/bin/picoclaw gateway > /home/agent/.picoclaw/gateway.log 2>&1' & }
          user: "1000"
          description: Start the picoclaw gateway in the background (health at :18790/health)