Add openhands kit

[ealeyner]

Summary

• Adds a kind: agent kit for OpenHands, an open-source AI software engineering agent
• Installs OpenHands CLI via uv at sandbox creation time
• Wires Anthropic, OpenAI, and Gemini auth through the SBX proxy (serviceDomains + serviceAuth)
• Sets SANDBOX_TYPE=local to avoid Docker-in-Docker (code runs directly in the sandbox container)

Spec choices worth flagging

*.astral.sh wildcard in allowedDomains: The uv install script at astral.sh redirects the binary download to releases.astral.sh. Without the wildcard, the binary fetch gets a 403 from the proxy. serviceDomains is kept narrow (only the three LLM API endpoints) to avoid TLS interception on install-time CDN traffic — same reasoning as the amp kit.

SANDBOX_TYPE=local: OpenHands defaults to spawning a Docker container as its code-execution runtime. Inside a Docker sandbox that requires Docker-in-Docker. The local sandbox type runs code in-process instead. The SBX container is already isolated, so this is safe and avoids a second container layer.

Multi-provider auth: The kit supports Anthropic (default), OpenAI, and Gemini via separate sbx secret set-custom registrations. Each maps to its own serviceDomains entry and serviceAuth rule. Users only need to register the provider they intend to use.

settings.json in files/home/: Pre-seeds the OpenHands config so the agent starts without an interactive setup wizard. Environment variable overrides (LLM_MODEL, SANDBOX_TYPE) take precedence.

Test plan

• sbx kit validate ./openhands/ — passes
• sbx run --kit ./openhands/ openhands — sandbox created, OpenHands 1.15.1 installed and verified with --version
• sbx policy log — confirmed *.astral.sh wildcard resolves the releases.astral.sh block; no unexpected blocked domains during install
• TCK (go test) — CI will run this; requires Docker, not available in this environment

Origin

Designed and tested locally against a Docker SBX sandbox, then adapted to the community kit pattern (dropping credentials: in favour of sbx secret set-custom, following the amp kit).