Shared agent runtime: curl, jq, find, htop, grep, vi, nano, which, clear, CA certs, and agentfile conventions.
Packages
- curl-8.21.0-bin
- jq-1.8.2-bin
- findutils-4.11.0
- htop-3.5.3
- gnugrep-3.12
- busybox-vi
- nano-9.2
- which-2.25
- ncurses-6.6
- nss-cacert-3.126
Fake SecretSpec values in the agent; swap reals at exec and OpenSSL write.
Packages
- secretGuard-preload-0.1.0
OpenCode harness: CLI, ACP session service, and generated vendor configuration.
Packages
- opencode-1.18.25
- opencode-ai-plugin-1.18.25
Files
- harness/opencode/acp.sh
- .config/opencode/package.json
- .opencode/package.json
- .opencode/plugins/kit-tools.ts
- harness/opencode/opencode-kit-hooks.js
- opencode.json
- .config/opencode/package-lock.json
- .opencode/package-lock.json
- .opencode/tools/slack-send-message.ts
DeepSeek API; DEEPSEEK_API_KEY from secretspec. Harnesses map models.* to vendor config.
Secrets
| Name | Required | Description |
DEEPSEEK_API_KEY |
required |
DeepSeek API key (https://platform.deepseek.com) |
Models
- default deepseek/deepseek-chat
- DeepSeek: DeepSeek Chat
- DeepSeek: DeepSeek Reasoner
Sandbox
- net api.deepseek.com
- net *.deepseek.com
- write /workspace
Slack webhook trigger provider: HMAC v0 auth, event kinds, /webhooks/slack route.
Secrets
| Name | Required | Description |
SLACK_SIGNING_SECRET |
required |
Slack app signing secret used to verify webhook HMAC signatures |
Slack app_mention behavior: react with the eyes emoji via reactions.add.
Secrets
| Name | Required | Description |
SLACK_BOT_TOKEN |
required |
Slack bot OAuth token used by the eyes handler to call reactions.add |
Sandbox
- net slack.com
- net *.slack.com
Slack reply tool slack-send-message (OpenCode custom tool, not MCP).