Skip to main content
The agent gets the freedom that --dangerously-skip-permissions implies, with the blast radius confined to a single-use VM. Each box is an independent rootfs and kernel, and SkillBox ships a noVNC desktop so you can watch it work.

Prerequisites

  • A working BoxLite install (Python boxlite or Node @boxlite-ai/boxlite) and a machine with hardware virtualization — see Installation.
  • Claude Code OAuth token: SkillBox authenticates via the CLAUDE_CODE_OAUTH_TOKEN environment variable.
    • Run claude setup-token on a logged-in Claude Code CLI to generate a long-lived token.
    • Then export it:
    Without this token, SkillBox raises ValueError when entering the async with block (see Troubleshooting).

Quick Example (Minimal Happy Path)

Minimal code: enter a SkillBox, ask a single question, and read the answer. The first call() automatically installs the Claude CLI and its dependencies inside the box (this takes a few minutes), and they are reused afterward.

Python

Node

Multi-turn conversation: call call() repeatedly on the same box. Claude retains context within the same session.

Parameters and Returns

SkillBox(...) Constructor Parameters (Python)

Source: sdks/python/boxlite/skillbox.py. The Node equivalents are listed below.
Node’s SkillBoxOptions uses camelCase field names: skills, oauthToken, name, image, memoryMib, diskSizeGb, guiHttpPort, guiHttpsPort, autoRemove, and so on.

SkillBox Methods

SkillBox inherits from SimpleBox, so it also has the common methods exec(...), copy_in/copy_out(...), start/stop(), and others.

Watching Claude Work in a Browser (noVNC)


Advanced: Manually Installing Claude Code into a SimpleBox

If you need to choose your own base image, authenticate with an API key instead of OAuth, or use the stream-json protocol for fine-grained control, skip SkillBox and install claude into a plain box yourself. Three constraints shape this path, and all three will bite you if you skip them:

Python (API-key mode, non-root)

Point the CLI at any Anthropic-compatible endpoint with environment variables — no OAuth login, which makes this the practical choice for CI and unattended runs.
Verified inside a box on macOS (Apple Silicon) against an Anthropic-compatible endpoint: claude --version reported 2.1.197, the prompt ran as the non-root agent user under --permission-mode bypassPermissions, and the file the agent was asked to create was readable back from inside the box.
Pointing the CLI at a compatible endpoint. Claude Code takes its endpoint from environment variables, so ANTHROPIC_BASE_URL plus ANTHROPIC_AUTH_TOKEN is all it needs to talk to an Anthropic-compatible gateway. That is not true of every agent CLI: Pi and OpenCode ignore those variables and require a provider entry in their own configuration instead.

Python (OAuth mode)

The example below uses node:20-alpine + npm to install and authenticates with an OAuth token instead.

Multi-Turn Conversation: the stream-json Protocol (Low-Level Box.exec)

SkillBox.call() internally implements multi-turn through Claude’s bidirectional stream-json protocol. The key points when implementing it yourself:
  • Start: claude --input-format stream-json --output-format stream-json --verbose (add --dangerously-skip-permissions for agent mode).
  • Write: write one line of JSON to execution.stdin(): {"type":"user","message":{"role":"user","content":...},"session_id":...}.
  • Read: read chunks (not lines) from execution.stdout(); buffer them yourself, split on \n, and json.loads line by line until you receive {"type":"result"}.
  • Multi-turn: take the session_id from the response and carry it into the next message.
For complete, runnable multi-turn / interactive examples, see the repository files examples/python/06_ai_agents/chat_with_claude.py and examples/node/claude_in_boxlite.js.

Troubleshooting (Symptoms and Real Errors)