sbx/shell-credentials:latest

schemaVersion: "3"
displayName: Shell credentials
description: Eight provider credentials for an agentless sandbox, resolved by the sandbox proxy.
version: 1.0.0
kind: mixin
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - api.anthropic.com
                - claude.ai
                - console.anthropic.com
                - api.github.com
                - copilot.github.com
                - github.com
                - raw.githubusercontent.com
                - aiplatform.googleapis.com
                - generativelanguage.googleapis.com
                - oauth2.googleapis.com
                - vertexai.googleapis.com
                - api.mistral.ai
                - api.studio.nebius.com
                - api.tokenfactory.nebius.com
                - api.openai.com
                - openai.com
                - openrouter.ai
                - api.x.ai
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.anthropic.com
                  format: '%s'
                  header: x-api-key
                - domain: claude.ai
                  format: '%s'
                  header: x-api-key
                - domain: console.anthropic.com
                  format: '%s'
                  header: x-api-key
            name: ANTHROPIC_API_KEY
            proxyManaged: true
        phase: runtime
        service: anthropic
      description: Anthropic API key
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.github.com
                  format: Bearer %s
                  header: Authorization
                - domain: copilot.github.com
                  format: Bearer %s
                  header: Authorization
                - domain: github.com
                  format: '%s'
                  header: Authorization
                  username: x-access-token
                - domain: raw.githubusercontent.com
                  format: Bearer %s
                  header: Authorization
            name: GH_TOKEN
        phase: runtime
        service: github
      description: GitHub token for gh, git over HTTPS and the Copilot API
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: aiplatform.googleapis.com
                  format: '%s'
                  header: x-goog-api-key
                - domain: generativelanguage.googleapis.com
                  format: '%s'
                  header: x-goog-api-key
                - domain: oauth2.googleapis.com
                  format: '%s'
                  header: x-goog-api-key
                - domain: vertexai.googleapis.com
                  format: '%s'
                  header: x-goog-api-key
            name: GOOGLE_API_KEY
            proxyManaged: true
        phase: runtime
        service: google
      description: Google AI API key
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.mistral.ai
                  format: Bearer %s
                  header: Authorization
            name: MISTRAL_API_KEY
            proxyManaged: true
        phase: runtime
        service: mistral
      description: Mistral API key
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.studio.nebius.com
                  format: Bearer %s
                  header: Authorization
                - domain: api.tokenfactory.nebius.com
                  format: Bearer %s
                  header: Authorization
            name: NEBIUS_API_KEY
            proxyManaged: true
        phase: runtime
        service: nebius
      description: Nebius API key
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.openai.com
                  format: Bearer %s
                  header: Authorization
                - domain: openai.com
                  format: Bearer %s
                  header: Authorization
            name: OPENAI_API_KEY
            proxyManaged: true
        phase: runtime
        service: openai
      description: OpenAI API key
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: openrouter.ai
                  format: Bearer %s
                  header: Authorization
            name: OPENROUTER_API_KEY
            proxyManaged: true
        phase: runtime
        service: openrouter
      description: OpenRouter API key
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.x.ai
                  format: Bearer %s
                  header: Authorization
            name: XAI_API_KEY
            proxyManaged: true
        phase: runtime
        service: xai
      description: xAI API key