DEV TOOLS Signal 473
Empty sandboxes break developer experience
↗
The setup tax of reinstalling tools and wiring credentials into every fresh sandbox pushes developers to skip isolation and run agents directly on the host. Kits make sandbox configuration reusable and composable, and their credential proxy pattern keeps secrets on the host while still giving the agent functional access to approved services.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
A kit is a spec.yaml that declares what a sandbox needs: tools to install, files to place, environment variables to set, background services to start, and network domains to allow or deny.
Credentials remain on the host while the agent sees a sentinel value, with a proxy injecting the real token only for approved outbound requests, preserving the isolation boundary.
Mixin kits each add one capability to an existing sandbox and stack together, letting teams compose tooling incrementally rather than building a monolithic sandbox image.
THE CLUSTER