agentSandbox.agent¶
14 options, generated from the kubenix modules — this page cannot drift from the code.
agentSandbox.agent.availableModels¶
The model catalog, PROVIDER-FIRST: provider -> model id -> options.
Model ids are provider-specific namespaces — "goose" runs Bedrock ids
(us.anthropic.…) while "claude-code" (the in-cluster subscription SDK)
and "byoc" (the user's own container) run API ids (claude-sonnet-4-5) —
so the provider is the outer key: a model two providers offer is simply
listed under both, and each provider group marks its own default. A
run only ever receives a model its provider serves — the conversation's
choice when that provider offers it, else that provider's default. The
global default (provider-less contexts, e.g. the deprecated GOOSE_MODEL)
comes from the "goose" group, falling back to the deprecated
agent.model. The agent switches its own model via switch_model; the
UI/management API can also override per-conversation. Rendered to the
agent-host as AGENT_MODELS_JSON.
Type: attribute set of attribute set of (submodule)
Default:
{ }
Example:
{
goose = {
"us.anthropic.claude-sonnet-4-6" = { default = true; hint = "Fast + cheap."; };
"us.anthropic.claude-opus-4-8" = { hint = "Slow + powerful."; };
};
byoc."claude-sonnet-4-5" = { default = true; hint = "The user's own subscription."; };
claude-code."claude-sonnet-4-5" = { default = true; };
}
Declared in: modules/platform.nix
agentSandbox.agent.availableModels.<name>.<name>.default¶
This provider's default model (at most one per provider; else the group's first entry).
Type: boolean
Default:
false
Declared in: modules/platform.nix
agentSandbox.agent.availableModels.<name>.<name>.hint¶
Deployment guidance shown to the agent by the list_models MCP
tool, steering when to pick this model (e.g. fast/cheap vs
slow/powerful). Empty = no hint.
Type: string
Default:
""
Example:
"Fast + cheap — simple edits, config/CI fixes."
Declared in: modules/platform.nix
agentSandbox.agent.builtinSkills¶
Ship the platform's own skills, each only when the capability it documents
is enabled (e.g. scooter-grafana only with broker.grafana.enable). Set false
to supply every skill yourself via skills.
Type: boolean
Default:
true
Declared in: modules/platform.nix
agentSandbox.agent.claudeCode.tokenSecret¶
When agent.provider = "claude-code", the name of the Secret holding the
long-lived subscription OAuth token (claude setup-token) under key token.
Wired to CLAUDE_CODE_OAUTH_TOKEN on the agent-host. Requires the claude CLI in
the image (build .#agent-host-image-claude). Create the Secret out-of-band:
kubectl create secret generic
Type: string
Default:
"agent-claude-code-token"
Declared in: modules/platform.nix
agentSandbox.agent.model¶
DEPRECATED — use availableModels.<id>.default = true instead. When set,
it's added to the offered set (back-compat for existing deploys) and, unless
the goose provider marks its own default, becomes the global default —
taking precedence over any OTHER provider's default marking. For Bedrock,
the cross-region inference-profile id.
Type: null or string
Default:
null
Declared in: modules/platform.nix
agentSandbox.agent.name¶
Display name the agent goes by (AGENT_NAME) — its identity in the UI + prompt.
Type: string
Default:
"Scooter"
Declared in: modules/platform.nix
agentSandbox.agent.provider¶
GOOSE_PROVIDER for the real agent (e.g. aws_bedrock, anthropic).
Type: string
Default:
"aws_bedrock"
Declared in: modules/platform.nix
agentSandbox.agent.region¶
AWS_REGION for the agent process (Bedrock region).
Type: string
Default:
"us-east-1"
Declared in: modules/platform.nix
agentSandbox.agent.remoteAgent.bridgeUrl¶
PUBLIC base URL of the BYOC controller's ingress — what the user's container dials
(/byoc/ws/<session-id> is appended per owner). DERIVED from
byoc.ingress.{host,tls} by default — the module already knows this URL, so asking
deployers to restate it was a copy-paste invariant waiting to drift. Override only
when the public URL is not the ingress host (an external LB/CDN in front). Empty ⇒
the Settings one-liner shows a placeholder host.
Type: string
Default:
"https://${byoc.ingress.host}" when the BYOC ingress is enabled
Example:
"https://byoc.example.com"
Declared in: modules/platform.nix
agentSandbox.agent.remoteAgent.enable¶
Bring-your-own-Claude remote agents (the Settings UI + agent-host mint/status routes).
Defaults to byoc.enable: the controller and the host-side routes are two halves of
ONE feature — enabling the controller without these leaves a Settings page that 404s,
and enabling these without the controller leaves a one-liner that dials nothing. One
knob (agentSandbox.byoc.enable = true) turns on a working whole.
Type: boolean
Default:
config.agentSandbox.byoc.enable
Declared in: modules/platform.nix
agentSandbox.agent.remoteAgent.image¶
The ghcr container image the Settings one-liner tells users to docker run (REMOTE_AGENT_IMAGE).
Type: string
Default:
"ghcr.io/chadac/scooter/remote-agent:latest"
Declared in: modules/platform.nix
agentSandbox.agent.remoteAgent.joinSecret¶
Name of the Secret holding the HS256 signing key (key secret) the agent-host uses to
sign + verify owner-bound join tokens. ONE server-side key (not per-user). Wired to
REMOTE_AGENT_JOIN_SECRET when remoteAgent.enable = true. Create out-of-band:
kubectl create secret generic
Type: string
Default:
"agent-remote-join-secret"
Declared in: modules/platform.nix
agentSandbox.agent.skills¶
Markdown skills injected into the agent as .goosehints (filename -> content). Rendered to a ConfigMap mounted at SKILLS_DIR on the agent-host and read per conversation — edit the ConfigMap to add/change a skill with no image rebuild. Filenames should end in .md.
Type: attribute set of string
Default:
{ }
Example:
{
"project-repo.md" = ''
---
name: project-repo
---
The main repo is github.com/example-org/example-app. Clone it with
`git clone https://github.com/example-org/example-app` to get started.
'';
}
Declared in: modules/platform.nix