sbx/zeroclaw-mixin:latest

schemaVersion: "3"
displayName: ZeroClaw (mixin)
description: ZeroClaw as a mixin — the pinned, digest-verified static binary in an overlay, with the Anthropic credential (API key or claude.ai OAuth), the published gateway port and the hook that resolves the credential into config.toml. Layer it onto a shell base and run `zeroclaw`.
sourceUrl: https://github.com/zeroclaw-labs/zeroclaw
kind: mixin
provides:
    - [email protected]
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - api.anthropic.com
                - claude.ai
                - console.anthropic.com
                - platform.claude.com
                - '*.telegram.org'
                - '*.discord.com'
                - gateway.discord.gg
                - '*.matrix.org'
                - '*.slack.com'
    - type: com.docker.sandbox/port@1
      config:
        container: 42617
        name: gateway
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.anthropic.com
                  format: '%s'
                  header: x-api-key
                - domain: claude.ai
                  format: '%s'
                  header: x-api-key
                - domain: console.anthropic.com
                  format: '%s'
                  header: x-api-key
            name: ANTHROPIC_API_KEY
            proxyManaged: true
        oauth:
            credentialFile:
                path: ~/.claude/.credentials.json
                structure:
                    claudeAiOauth:
                        accessToken: '{{.AccessToken}}'
                        expiresAt: '{{.ExpiresAt}}'
                        refreshToken: '{{.RefreshToken}}'
                        scopes: '{{.Scopes}}'
            resourceHosts:
                - api.anthropic.com
            sentinels:
                accessToken: sk-ant-oat01-proxy-managed
                refreshToken: sk-ant-ort01-proxy-managed
            tokenEndpoint:
                host: platform.claude.com
                path: /v1/oauth/token
        phase: runtime
        service: anthropic
      description: Anthropic API access (API key or claude.ai OAuth)
    - type: com.docker.sandbox/lifecycle@1
      config:
        startup:
            - command:
                - sh
                - /home/agent/.local/bin/zeroclaw-anthropic-key.sh
              description: Resolve the host's Anthropic credential into config.toml at sandbox start
              env:
                - ANTHROPIC_API_KEY
              user: "1000"
    - type: com.docker.sandbox/agent-context@1
      config:
        contentFile: /usr/share/sandbox/kit/zeroclaw-mixin/zeroclaw-mixin-context.md
args:
    version:
        default: 0.8.0
        description: ZeroClaw release to install
        pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
        buildArg: ZEROCLAW_VERSION