pi-kit

A Docker Sandboxes (sbx) kit for running pi with provider credentials kept on the host.

Adds OpenAI support to the upstream Pi kit:

• OpenAI API key via OPENAI_API_KEY
• ChatGPT Plus/Pro OAuth for Pi's openai-codex provider
• Anthropic API key via ANTHROPIC_API_KEY
• Pi, OpenSpec, and the stable Rust toolchain with rustfmt and clippy
• pi-docparser, pdftotext, and LibreOffice for document processing

Quick start

Allow this publisher once:

sbx settings set kit.allowedSources '["docker.io/","ghcr.io/rocknitive/"]'

Run Pi for a project directory:

sbx run ghcr.io/rocknitive/pi-kit:latest ~/my-project

sbx run defaults the workspace to the current directory:

cd ~/my-project
sbx run ghcr.io/rocknitive/pi-kit:latest

Authentication

ChatGPT Plus/Pro OAuth:

sbx secret set openai --oauth

OpenAI API key:

echo "$OPENAI_API_KEY" | sbx secret set openai

Anthropic API key:

echo "$ANTHROPIC_API_KEY" | sbx secret set anthropic

Recreate the sandbox after changing credentials; sbx wires credential bindings at create time.

Rebuild and recreate existing sandboxes after changing the image or kit; existing sandboxes keep their original image.

Do not run /login inside the sandbox for managed credentials.

Optional shell helper

Add to ~/.zshrc:

sbx-pi() {
  sbx run ghcr.io/rocknitive/pi-kit:latest
}

Add to ~/.config/fish/config.fish:

function sbx-pi
    sbx run ghcr.io/rocknitive/pi-kit:latest
end

Usage:

cd ~/my-project
sbx-pi

Development

See Local development for building and testing changes locally.

License

MIT. See LICENSE.