sbx/gstack-kit:20260828-2121f50cbf929602a6f0305feed51acb3f872980

schemaVersion: "2"
kind: sandbox
name: gstack
displayName: gstack (Claude Code + Garry's Stack)
description: 'Claude Code with the gstack skill pack pre-installed: opinionated slash commands (/ship, /review, /qa, /browse, ...) plus a headless-Chromium browse daemon. Uses a pre-baked image so sandboxes start in seconds.'
sandbox:
    image: docker.io/sbx/gstack-image:latest
    entrypoint:
        - claude
agentInstructions:
    filename: CLAUDE.md
    content: |
        # gstack

        This sandbox has gstack pre-installed: Garry Tan's Claude Code skill
        pack. Use the slash commands for the full AI engineering workflow:

        /office-hours, /plan-ceo-review, /plan-eng-review, /plan-design-review,
        /design-consultation, /review, /ship, /land-and-deploy, /canary,
        /benchmark, /browse, /qa, /qa-only, /design-review,
        /setup-browser-cookies, /setup-deploy, /retro, /investigate,
        /document-release, /codex, /cso, /autoplan, /careful, /freeze, /guard,
        /unfreeze, /gstack-upgrade

        Use the /browse skill for all web browsing — it drives a local headless
        Chromium daemon (loopback only, auto-started on first use).
permissions:
    network:
        allow:
            - api.anthropic.com
            - claude.ai
            - console.anthropic.com
            - platform.claude.com:443
            - downloads.claude.ai:443
            - claude.com:443
            - github.com:443
            - raw.githubusercontent.com:443
            - registry.npmjs.org
            - '*.npmjs.org'
            - huggingface.co:443
            - '*.huggingface.co:443'
credentials:
    - service: anthropic
      apiKey:
        name: ANTHROPIC_API_KEY
        proxyManaged: true
        inject:
            - domain: api.anthropic.com
              header: x-api-key
              format: '%s'
            - domain: claude.ai
              header: x-api-key
              format: '%s'
            - domain: console.anthropic.com
              header: x-api-key
              format: '%s'
      oauth:
        tokenEndpoint:
            host: platform.claude.com
            path: /v1/oauth/token
        sentinels:
            accessToken: sk-ant-oat01-proxy-managed
            refreshToken: sk-ant-ort01-proxy-managed
        credentialFile:
            path: ~/.claude/.credentials.json
            structure:
                claudeAiOauth:
                    accessToken: '{{.AccessToken}}'
                    expiresAt: '{{.ExpiresAt}}'
                    refreshToken: '{{.RefreshToken}}'
                    scopes: '{{.Scopes}}'
environment:
    variables:
        GSTACK_PLAN_TUNE_HOOKS: "no"
        PLAYWRIGHT_BROWSERS_PATH: /opt/playwright-browsers