michaelirwin244/podium-reporter:latest

schemaVersion: "3"
displayName: Podium reporter
description: Installs and configures the podium-reporter Claude Code plugin so every session in this sandbox reports to a Podium fleet console on the host, with the report token proxy-managed instead of stored in the sandbox.
version: 0.1.0
kind: mixin
capabilities:
    - type: com.docker.sandbox/network-policy@2
      config:
        runtime:
            allow:
                - hosts:
                    - ${{ kit.args.serverHost }}:${{ kit.args.serverPort }}
                    - localhost:${{ kit.args.serverPort }}
                  methods:
                    - GET
                    - POST
                    - PUT
                  paths:
                    - /api/fleet/**
    - type: com.docker.sandbox/credential@1
      config:
        apiKey:
            inject:
                - domain: ${{ kit.args.serverHost }}
                  format: '%s'
                  header: X-Podium-Token
                - domain: localhost
                  format: '%s'
                  header: X-Podium-Token
            name: PODIUM_API_TOKEN
            proxyManaged: true
        phase: runtime
        service: podium-token
      description: Podium report token
    - type: com.docker.sandbox/lifecycle@1
      config:
        startup:
            - command:
                - sh
                - -c
                - |
                  set -e
                  export PATH="$HOME/.local/bin:$HOME/.claude/local:$PATH"
                  claude plugin install podium-reporter --marketplace eengelking/skills -s user -y || true
              description: Install the podium-reporter plugin (runs every boot; idempotent)
              user: agent
            - command:
                - sh
                - -c
                - |
                  set -e
                  export PATH="$HOME/.local/bin:$HOME/.claude/local:$PATH"
                  # serverUrl/userName are set here, not via `plugin install --config`:
                  # install is a no-op when the plugin is already present, so its
                  # --config values are skipped and the plugin falls back to its
                  # 127.0.0.1 default. `configure` applies on every boot.
                  printf '{"serverUrl":"%s","userName":"%s","token":"%s"}' \
                    "http://${{ kit.args.serverHost }}:${{ kit.args.serverPort }}" \
                    "${{ kit.args.userName }}" \
                    "${PODIUM_API_TOKEN:-}" \
                    | claude plugin configure podium-reporter@eengelking-marketplace --values-stdin
              description: Point the plugin at the Podium server and store the proxy-managed placeholder token
              env:
                - PODIUM_API_TOKEN
              user: agent
    - type: com.docker.sandbox/agent-context@1
      config:
        content: |
            ## Podium fleet console reporting

            This sandbox reports its Claude Code sessions to a Podium fleet console at
            `http://${{ kit.args.serverHost }}:${{ kit.args.serverPort }}/#/` via the
            `podium-reporter` plugin, already installed and configured.

            Authentication is proxy-managed: the plugin's token option holds a
            placeholder (`$PODIUM_API_TOKEN`), which the sandbox's egress proxy swaps
            for the real value only on requests to the Podium server above. The real
            token is never present in this sandbox. Never print the placeholder as if
            it were useful, and never ask the user for the real token.
args:
    serverHost:
        default: host.docker.internal
        description: Hostname of the Podium server to report to. The default reaches a Podium server bound on the sandbox host machine (the server must bind an interface the sandbox's gateway can reach, not 127.0.0.1 alone — see this kit's README).
    serverPort:
        default: "4317"
        description: Port the Podium server listens on.
        pattern: ^[0-9]+$
    userName:
        default: ""
        description: The name this sandbox's token was made for in Podium Admin. Leave empty to report with the server's shared admin secret instead of a per-person token.