Shared agent runtime: curl, jq, find, htop, grep, vi, nano, which, clear, CA certs, and agentfile conventions.
Packages
- curl-8.21.0-bin
- jq-1.8.2-bin
- findutils-4.11.0
- htop-3.5.3
- gnugrep-3.12
- busybox-vi
- nano-9.2
- which-2.25
- ncurses-6.6
- nss-cacert-3.126
Fake SecretSpec values in the agent; swap reals at exec and OpenSSL write.
Packages
- secretGuard-preload-0.1.0
Interactive bash for rig shell PTY.
Git CLI and base VCS conventions.
Git with SSH; GIT_SSH_PRIVATE_KEY from secretspec.
Secrets
| Name | Required | Description |
GIT_SSH_PRIVATE_KEY |
required |
PEM/OpenSSH private key for git over SSH |
Packages
- git-minimal-2.55.0
- openssh-10.5p1
Files
- AGENTS.md
- bin/kit-ssh-setup
Sandbox
- net github.com
- net gitlab.com
- write /workspace
- write /tmp/kit-ssh-*
pstack unslop — cut AI tells from writing (fetchFromGitHub pin).
OpenCode harness: CLI, ACP session service, and generated vendor configuration.
Packages
- opencode-1.18.25
- opencode-ai-plugin-1.18.25
Files
- harness/opencode/acp.sh
- .config/opencode/package.json
- .opencode/package.json
- harness/opencode/hook-meta.mjs
- harness/opencode/opencode-kit-hooks.js
- opencode.json
- .config/opencode/package-lock.json
- .opencode/package-lock.json
DeepSeek API; DEEPSEEK_API_KEY from secretspec. Harnesses map models.* to vendor config.
Secrets
| Name | Required | Description |
DEEPSEEK_API_KEY |
required |
DeepSeek API key (https://platform.deepseek.com) |
Models
- default deepseek/deepseek-chat
- DeepSeek: DeepSeek Chat
- DeepSeek: DeepSeek Reasoner
Sandbox
- net api.deepseek.com
- net *.deepseek.com
- write /workspace