chainloop/sbx-kit-claude repository overview

Absolute path INSIDE the sandbox to a chainloop config.toml to adopt - i.e. where you mounted the host's, which sbx mounts at the SAME absolute path it has on the host. The wrapper copies it to ~/.config/chainloop/config.toml so every later `chainloop` invocation finds it, including the git hooks that persistent mode runs as their own processes (a --config flag would not reach those). Brings the org and the control-plane/CAS/platform endpoints with it, which is what makes this worthwhile for self-hosted. NOTE its [auth] token is your personal login session: short-lived (~days) and your full identity. Prefer chainloopToken for anything unattended.

Chainloop organization. `trace run` mode ONLY - ignored in persistent mode, where the org comes from the repo's .chainloop.yml.

Chainloop project. `trace run` mode ONLY - ignored in persistent mode.

Chainloop org-scoped API token (chainloop organization api-token create). Authenticates the attestation push in BOTH modes; in persistent mode it must have access to the org pinned in the repo's .chainloop.yml. OPTIONAL only because chainloopConfig is the other way to authenticate - supply one or the other, or the wrapper refuses to start. When both are present this one WINS: the CLI prefers an exported CHAINLOOP_TOKEN over a config-file login session and logs "Both user credentials and $CHAINLOOP_TOKEN set. Ignoring user credentials." (app/cli/cmd/root.go).

Chainloop workflow name. `trace run` mode ONLY. Matches the default `chainloop trace init` writes, so both modes land on the same workflow unless you say otherwise.

auto = persistent when the repo is already trace-initialized, else trace run. run = always single-shot (DESTRUCTIVE on a trace-initialized repo: teardown wipes .git/chainloop-trace/ and strips the committed agent hooks). persistent = force persistent.