Shared agent runtime: curl, jq, find, htop, grep, vi, nano, which, clear, CA certs, and agentfile conventions.
Packages
- curl-8.21.0-bin
- jq-1.8.2-bin
- findutils-4.11.0
- htop-3.5.3
- gnugrep-3.12
- busybox-vi
- nano-9.2
- which-2.25
- ncurses-6.6
- nss-cacert-3.126
Fake SecretSpec values in the agent; swap reals at exec and OpenSSL write.
Packages
- secretGuard-preload-0.1.0
Interactive bash for rig shell PTY.
Git CLI and base VCS conventions.
Git with SSH; GIT_SSH_PRIVATE_KEY from secretspec.
Secrets
| Name | Required | Description |
GIT_SSH_PRIVATE_KEY |
required |
PEM/OpenSSH private key for git over SSH |
Packages
- git-minimal-2.55.0
- openssh-10.5p1
Files
- AGENTS.md
- bin/kit-ssh-setup
Sandbox
- net github.com
- net gitlab.com
- write /workspace
- write /tmp/kit-ssh-*
OpenCode harness: CLI, ACP session service, and generated vendor configuration.
Packages
- opencode-1.18.25
- opencode-ai-plugin-1.18.25
Files
- harness/opencode/acp.sh
- .config/opencode/package.json
- .opencode/package.json
- harness/opencode/opencode-kit-hooks.js
- opencode.json
- .config/opencode/package-lock.json
- .opencode/package-lock.json
DeepSeek API; DEEPSEEK_API_KEY from secretspec. Harnesses map models.* to vendor config.
Secrets
| Name | Required | Description |
DEEPSEEK_API_KEY |
required |
DeepSeek API key (https://platform.deepseek.com) |
Models
- default deepseek/deepseek-chat
- DeepSeek: DeepSeek Chat
- DeepSeek: DeepSeek Reasoner
Sandbox
- net api.deepseek.com
- net *.deepseek.com
- write /workspace
OpenRouter provider (OpenAI-compatible); OPENROUTER_API_KEY from secretspec.
Secrets
| Name | Required | Description |
OPENROUTER_API_KEY |
required |
OpenRouter API key (https://openrouter.ai/keys) |
Models
- OpenRouter: DeepSeek Chat (OpenRouter)
- OpenRouter: DeepSeek Reasoner (OpenRouter)
- OpenRouter: DeepSeek V4 Flash (OpenRouter)
- OpenRouter: GPT-6 Astra (OpenRouter)
- OpenRouter: Ox Alpha (OpenRouter)
Sandbox
- net openrouter.ai
- net *.openrouter.ai
- write /workspace
Chromium with slim GStreamer deps; en-US locales only, no Vulkan validation layer.
agent-browser CLI plus skills extracted from `agent-browser skills get --full`.
Skills
- agentcore
- core
- dogfood
- electron
- slack
- vercel-sandbox
Secrets
| Name | Required | Description |
AGENT_BROWSER_ALLOWED_DOMAINS |
optional |
Comma-separated domain patterns for agent-browser navigation |
Sandbox
- net slopkit.dev
- net *.slopkit.dev
- write /workspace
- write /home/agent
Node.js, Bun, and JS/TS tooling: node, npm, npx, bun, pnpm, yarn, tsc, eslint, prettier.
Packages
- nodejs-24.19.0
- bun-1.3.13
- pnpm-11.22.0
- yarn-1.22.22
- typescript-5.9.3
- eslint-10.9.0
- prettier-3.9.6
Sandbox
- net registry.npmjs.org
- net registry.yarnpkg.com
- net nodejs.org
- net bun.sh
- net github.com
- net *.githubusercontent.com
- net cdn.jsdelivr.net
- net unpkg.com
- write /workspace
- write /home/agent
Rust toolchain: rustc, cargo, clippy, rustfmt.
Packages
- rustc-wrapper-1.97.1
- cargo-1.97.1
- clippy-1.97.1
- rustfmt-1.97.1
Sandbox
- net crates.io
- net static.crates.io
- net index.crates.io
- net static.rust-lang.org
- net github.com
- net *.githubusercontent.com
- write /workspace
- write /home/agent
Python 3, pip, and Poetry.
Packages
- python3-3.14.7
- python3.14-poetry-2.4.1
Sandbox
- net pypi.org
- net files.pythonhosted.org
- net pythonhosted.org
- net github.com
- net *.githubusercontent.com
- write /workspace
- write /home/agent
Go toolchain and gopls language server.
Sandbox
- net proxy.golang.org
- net sum.golang.org
- net storage.googleapis.com
- net go.dev
- net github.com
- net *.githubusercontent.com
- write /workspace
- write /home/agent
Kubernetes CLI tooling: kubectl, helm, kustomize, k9s.
Secrets
| Name | Required | Description |
KUBECONFIG_CONTENT |
optional |
Kubeconfig YAML written to $HOME/.kube/config by bin/kit-kubeconfig-setup |
KUBE_NAMESPACE |
optional |
Default namespace for kubectl |
Packages
- kubectl-1.36.3
- kubernetes-helm-4.2.4
- kustomize-5.8.1
- k9s-0.51.0
Files
- AGENTS.md
- bin/kit-kubeconfig-setup
Sandbox
- net dl.k8s.io
- net k8s.io
- net storage.googleapis.com
- net registry.k8s.io
- net get.helm.sh
- net charts.helm.sh
- net github.com
- net *.githubusercontent.com
- net ghcr.io
- write /workspace
- write /home/agent
Forge and VCS CLIs: GitHub CLI, GitLab CLI, and Jujutsu.
Secrets
| Name | Required | Description |
GH_TOKEN |
optional |
GitHub token for gh (repo, workflow scopes) |
GITHUB_TOKEN |
optional |
GitHub token fallback read by gh |
GITLAB_HOST |
optional |
GitLab host for glab (default gitlab.com) |
GITLAB_TOKEN |
optional |
GitLab personal access token for glab (api scope) |
Packages
- gh-2.98.0
- glab-1.114.0
- jujutsu-0.44.0
Sandbox
- net github.com
- net api.github.com
- net codeload.github.com
- net *.githubusercontent.com
- net gitlab.com
- net *.gitlab.com
- write /workspace
- write /home/agent
Container clients: docker CLI and podman.
Secrets
| Name | Required | Description |
DOCKER_AUTH_CONFIG |
optional |
Docker config.json content with registry auth, written by bin/kit-docker-setup |
Packages
- docker-29.7.2
- podman-5.8.6
Files
- AGENTS.md
- bin/kit-docker-setup
Sandbox
- net registry-1.docker.io
- net auth.docker.io
- net production.cloudflare.docker.com
- net registry.k8s.io
- net quay.io
- net ghcr.io
- net gcr.io
- net podman.io
- write /workspace
- write /home/agent
Secret management CLIs: sops, age, vals.
Secrets
| Name | Required | Description |
SOPS_AGE_KEY |
optional |
age private key content for sops (SOPS_AGE_KEY) |
SOPS_AGE_KEY_FILE |
optional |
Path to an age private key file for sops (SOPS_AGE_KEY_FILE) |
Packages
- sops-3.13.3
- age-1.3.1
- vals-0.46.0
General Unix CLI utilities: ripgrep, yq, sqlite, rsync, wget, tree, archives, openssl, imagemagick, less, tmux, direnv, starship, perl.
Packages
- ripgrep-15.2.0
- yq-go-4.53.3
- sqlite-3.53.3-bin
- rsync-3.5.0
- wget-1.25.0
- tree-2.3.2
- unzip-6.0
- zip-3.0
- pv-1.11.0
- file-5.48
- openssl-3.6.3-bin
- xz-5.8.3-bin
- zstd-1.5.7-bin
- bzip2-1.0.8-bin
- gzip-1.14
- gnutar-1.35
- imagemagick-7.1.2-29
- less-704
- tmux-3.7c
- direnv-2.37.1
- starship-1.26.0
- perl-5.42.3
Sandbox
- net github.com
- net codeload.github.com
- net *.githubusercontent.com
- write /workspace
- write /home/agent
Build toolchain and linters: GNU make, gcc, pkg-config, shellcheck, shfmt.
Packages
- gnumake-4.4.1
- gcc-wrapper-15.3.0
- pkg-config-wrapper-0.29.2
- shellcheck-0.11.0-bin
- shfmt-3.14.0
Sandbox
- write /workspace
- write /home/agent
Android platform tools: adb and fastboot.
Sandbox
- net dl.google.com
- net dl-ssl.google.com
- net maven.google.com
- net developer.android.com
- write /workspace
- write /home/agent