Connect your agent¶

Run existing Agent CLIs, scripts, and automation through one entry point, without changing the agent. Install the command in the selected executor and configure the provider in the agent itself first. An agent installed on the host does not automatically appear in an image. Replace <agent-command> below with the actual command:

pvisor spawn --safe -- <agent-command>
pvisor status --review last
pvisor apply last --path src

--safe keeps workspace changes staged for review before apply and denies access to .ssh, .gnupg and private-key files within the view. HOME uses a separate private stage; writes are discarded after execution and do not enter the workspace Run Bundle, so do not depend on them to persist login state. See credentials and environment for platform-specific HOME and credential handling.

Network presets match the executable filename and allow its model API destinations on HTTPS port 443; other destinations are denied. Deliver credentials explicitly with --pass-env NAME or let Gateway hold them.

Unknown commands deny outbound access. --overlaynet-allow HOST:PORT grants it explicitly and replaces preset lists. Matching uses the direct executable filename; shell wrappers do not trigger agent-specific adaptation.

Agents without presets¶

Take aider as the example: install it in the selected executor, pick the provider in the agent's own configuration, then explicitly allow its API destination and pass the credential variable (variable names come from the agent's own documentation, such as OPENAI_API_KEY or GEMINI_API_KEY):

pvisor spawn --safe --overlaynet-allow api.openai.com:443 \
  --pass-env OPENAI_API_KEY -- aider
pvisor status --review last
pvisor apply last --path src

Logins, other providers and dependency downloads each need their own allowed destination.

After a run, check the installed controls and observations in the Run Bundle. Supported agent version ranges are not systematically tested; see end-to-end tasks.