[{"data":1,"prerenderedAt":1023},["ShallowReactive",2],{"navigation_docs":3,"-guides-harnesses-give-a-worker-its-login":504,"-guides-harnesses-give-a-worker-its-login-surround":1018},[4,28,51,187,214,469],{"title":5,"path":6,"stem":7,"children":8},"Get started","\u002Fget-started","1.get-started",[9,12,16,20,24],{"title":10,"path":6,"stem":11},"Overview","1.get-started\u002Findex",{"title":13,"path":14,"stem":15},"Why Kraft","\u002Fget-started\u002Fwhy-kraft","1.get-started\u002F0.why-kraft",{"title":17,"path":18,"stem":19},"Install","\u002Fget-started\u002Finstall","1.get-started\u002F1.install",{"title":21,"path":22,"stem":23},"Your first work item","\u002Fget-started\u002Ffirst-work-item","1.get-started\u002F2.first-work-item",{"title":25,"path":26,"stem":27},"FAQ","\u002Fget-started\u002Ffaq","1.get-started\u002F3.faq",{"title":29,"path":30,"stem":31,"children":32},"Concepts","\u002Fconcepts","2.concepts",[33,35,39,43,47],{"title":10,"path":30,"stem":34},"2.concepts\u002Findex",{"title":36,"path":37,"stem":38},"How a work item runs","\u002Fconcepts\u002Fhow-a-work-item-runs","2.concepts\u002F1.how-a-work-item-runs",{"title":40,"path":41,"stem":42},"Caps and budgets","\u002Fconcepts\u002Fcaps-and-budgets","2.concepts\u002F2.caps-and-budgets",{"title":44,"path":45,"stem":46},"Why a permission gate","\u002Fconcepts\u002Fpermission-gate","2.concepts\u002F3.permission-gate",{"title":48,"path":49,"stem":50},"Vocabulary","\u002Fconcepts\u002Fvocabulary","2.concepts\u002F4.vocabulary",{"title":52,"path":53,"stem":54,"children":55},"Guides","\u002Fguides","3.guides",[56,58,96,113,134,183],{"title":10,"path":53,"stem":57},"3.guides\u002Findex",{"title":59,"path":60,"stem":61,"children":62,"page":95},"Day to day","\u002Fguides\u002Fday-to-day","3.guides\u002F1.day-to-day",[63,67,71,75,79,83,87,91],{"title":64,"path":65,"stem":66},"The setup wizard on first start","\u002Fguides\u002Fday-to-day\u002Ffirst-run","3.guides\u002F1.day-to-day\u002F2.first-run",{"title":68,"path":69,"stem":70},"File a work item","\u002Fguides\u002Fday-to-day\u002Ffile-a-work-item","3.guides\u002F1.day-to-day\u002F3.file-a-work-item",{"title":72,"path":73,"stem":74},"Use Kraft from your agent","\u002Fguides\u002Fday-to-day\u002Fagent-integration","3.guides\u002F1.day-to-day\u002F4.agent-integration",{"title":76,"path":77,"stem":78},"Reviewing a change","\u002Fguides\u002Fday-to-day\u002Freview-a-change","3.guides\u002F1.day-to-day\u002F5.review-a-change",{"title":80,"path":81,"stem":82},"Raise a cap on a stopped item","\u002Fguides\u002Fday-to-day\u002Fraise-a-cap","3.guides\u002F1.day-to-day\u002F6.raise-a-cap",{"title":84,"path":85,"stem":86},"Kraft for VS Code","\u002Fguides\u002Fday-to-day\u002Fvscode","3.guides\u002F1.day-to-day\u002F7.vscode",{"title":88,"path":89,"stem":90},"Kraft on a phone","\u002Fguides\u002Fday-to-day\u002Fkraft-on-a-phone","3.guides\u002F1.day-to-day\u002F8.kraft-on-a-phone",{"title":92,"path":93,"stem":94},"Get notified when an item needs you","\u002Fguides\u002Fday-to-day\u002Fnotifications","3.guides\u002F1.day-to-day\u002F9.notifications",false,{"title":97,"path":98,"stem":99,"children":100,"page":95},"Customize and automate","\u002Fguides\u002Fcustomize","3.guides\u002F2.customize",[101,105,109],{"title":102,"path":103,"stem":104},"Write your own chain","\u002Fguides\u002Fcustomize\u002Fwrite-your-own-chain","3.guides\u002F2.customize\u002F1.write-your-own-chain",{"title":106,"path":107,"stem":108},"Add a security review or a gate reviewer","\u002Fguides\u002Fcustomize\u002Fadd-review-agents","3.guides\u002F2.customize\u002F2.add-review-agents",{"title":110,"path":111,"stem":112},"Schedule or webhook work","\u002Fguides\u002Fcustomize\u002Fschedule-and-webhook-work","3.guides\u002F2.customize\u002F3.schedule-and-webhook-work",{"title":114,"path":115,"stem":116,"children":117,"page":95},"Agents and harnesses","\u002Fguides\u002Fharnesses","3.guides\u002F3.harnesses",[118,122,126,130],{"title":119,"path":120,"stem":121},"Switch a task to another harness","\u002Fguides\u002Fharnesses\u002Fswitch-harness","3.guides\u002F3.harnesses\u002F1.switch-harness",{"title":123,"path":124,"stem":125},"Add or override a harness","\u002Fguides\u002Fharnesses\u002Fadding-a-harness","3.guides\u002F3.harnesses\u002F2.adding-a-harness",{"title":127,"path":128,"stem":129},"Build a worker Kit","\u002Fguides\u002Fharnesses\u002Fworker-kit","3.guides\u002F3.harnesses\u002F3.worker-kit",{"title":131,"path":132,"stem":133},"Give a worker its login","\u002Fguides\u002Fharnesses\u002Fgive-a-worker-its-login","3.guides\u002F3.harnesses\u002F4.give-a-worker-its-login",{"title":135,"path":136,"stem":137,"children":138,"page":95},"Run the server","\u002Fguides\u002Frun","3.guides\u002F4.run",[139,143,147,151,155,159,163,167,171,175,179],{"title":140,"path":141,"stem":142},"Remote access","\u002Fguides\u002Frun\u002Fremote-access","3.guides\u002F4.run\u002F01.remote-access",{"title":144,"path":145,"stem":146},"Put a proxy in front of Kraft","\u002Fguides\u002Frun\u002Fput-a-proxy-in-front-of-kraft","3.guides\u002F4.run\u002F02.put-a-proxy-in-front-of-kraft",{"title":148,"path":149,"stem":150},"Restart Kraft without ending running agents","\u002Fguides\u002Frun\u002Frestart-kraft","3.guides\u002F4.run\u002F03.restart-kraft",{"title":152,"path":153,"stem":154},"Back up and restore the database","\u002Fguides\u002Frun\u002Fback-up-and-restore","3.guides\u002F4.run\u002F04.back-up-and-restore",{"title":156,"path":157,"stem":158},"Logs and disk space","\u002Fguides\u002Frun\u002Flogs-and-disk-space","3.guides\u002F4.run\u002F05.logs-and-disk-space",{"title":160,"path":161,"stem":162},"Run Kraft as a service","\u002Fguides\u002Frun\u002Frun-as-a-service","3.guides\u002F4.run\u002F06.run-as-a-service",{"title":164,"path":165,"stem":166},"Upgrade Kraft","\u002Fguides\u002Frun\u002Fupgrade-kraft","3.guides\u002F4.run\u002F07.upgrade-kraft",{"title":168,"path":169,"stem":170},"Upgrade your configuration","\u002Fguides\u002Frun\u002Fupgrade-your-configuration","3.guides\u002F4.run\u002F08.upgrade-your-configuration",{"title":172,"path":173,"stem":174},"Upgrade from 1.4","\u002Fguides\u002Frun\u002Fupgrade-from-1-4","3.guides\u002F4.run\u002F09.upgrade-from-1-4",{"title":176,"path":177,"stem":178},"Upgrade from 0.x or a release candidate","\u002Fguides\u002Frun\u002Fupgrade-from-0-x-or-a-release-candidate","3.guides\u002F4.run\u002F10.upgrade-from-0-x-or-a-release-candidate",{"title":180,"path":181,"stem":182},"Roll back to 1.4","\u002Fguides\u002Frun\u002Froll-back","3.guides\u002F4.run\u002F11.roll-back",{"title":184,"path":185,"stem":186},"Kraft Lite","\u002Fguides\u002Fkraft-lite","3.guides\u002F5.kraft-lite",{"title":188,"path":189,"stem":190,"children":191},"Troubleshooting","\u002Ftroubleshooting","4.troubleshooting",[192,194,198,202,206,210],{"title":10,"path":189,"stem":193},"4.troubleshooting\u002Findex",{"title":195,"path":196,"stem":197},"Why did my item stop?","\u002Ftroubleshooting\u002Fwhy-did-my-item-stop","4.troubleshooting\u002F1.why-did-my-item-stop",{"title":199,"path":200,"stem":201},"Stop reasons in detail","\u002Ftroubleshooting\u002Fstop-reasons-in-detail","4.troubleshooting\u002F2.stop-reasons-in-detail",{"title":203,"path":204,"stem":205},"Starting and reaching Kraft","\u002Ftroubleshooting\u002Fstarting-and-reaching-kraft","4.troubleshooting\u002F3.starting-and-reaching-kraft",{"title":207,"path":208,"stem":209},"Doctor failures","\u002Ftroubleshooting\u002Fdoctor-failures","4.troubleshooting\u002F4.doctor-failures",{"title":211,"path":212,"stem":213},"Sandbox and Kit stops","\u002Ftroubleshooting\u002Fsandbox-and-kit-stops","4.troubleshooting\u002F5.sandbox-and-kit-stops",{"title":215,"path":216,"stem":217,"children":218},"Reference","\u002Freference","5.reference",[219,221,259,281,285,375,393,419,423,427,461,465],{"title":10,"path":216,"stem":220},"5.reference\u002Findex",{"title":222,"path":223,"stem":224,"children":225},"Web UI","\u002Freference\u002Fweb-ui","5.reference\u002F00.web-ui\u002Findex",[226,227,231,235,239,243,247,251,255],{"title":10,"path":223,"stem":224},{"title":228,"path":229,"stem":230},"Sidebar, search, and keyboard","\u002Freference\u002Fweb-ui\u002Fsidebar-search-and-keyboard","5.reference\u002F00.web-ui\u002F0.sidebar-search-and-keyboard",{"title":232,"path":233,"stem":234},"The board","\u002Freference\u002Fweb-ui\u002Fboard","5.reference\u002F00.web-ui\u002F1.board",{"title":236,"path":237,"stem":238},"An item's page","\u002Freference\u002Fweb-ui\u002Fitem-page","5.reference\u002F00.web-ui\u002F2.item-page",{"title":240,"path":241,"stem":242},"Fix loops and test scopes","\u002Freference\u002Fweb-ui\u002Ffix-loops-and-test-scopes","5.reference\u002F00.web-ui\u002F3.fix-loops-and-test-scopes",{"title":244,"path":245,"stem":246},"Config before an item starts","\u002Freference\u002Fweb-ui\u002Fconfig-before-start","5.reference\u002F00.web-ui\u002F4.config-before-start",{"title":248,"path":249,"stem":250},"The review page","\u002Freference\u002Fweb-ui\u002Freview-page","5.reference\u002F00.web-ui\u002F5.review-page",{"title":252,"path":253,"stem":254},"Templates and Settings","\u002Freference\u002Fweb-ui\u002Ftemplates-and-settings","5.reference\u002F00.web-ui\u002F6.templates-and-settings",{"title":256,"path":257,"stem":258},"Analytics","\u002Freference\u002Fweb-ui\u002Fanalytics","5.reference\u002F00.web-ui\u002F7.analytics",{"title":260,"path":261,"stem":262,"children":263},"CLI","\u002Freference\u002Fcli","5.reference\u002F01.cli\u002Findex",[264,265,269,273,277],{"title":10,"path":261,"stem":262},{"title":266,"path":267,"stem":268},"Item verbs","\u002Freference\u002Fcli\u002Fitem","5.reference\u002F01.cli\u002F2.item",{"title":270,"path":271,"stem":272},"View verbs","\u002Freference\u002Fcli\u002Fview","5.reference\u002F01.cli\u002F3.view",{"title":274,"path":275,"stem":276},"Repo verbs","\u002Freference\u002Fcli\u002Frepo","5.reference\u002F01.cli\u002F4.repo",{"title":278,"path":279,"stem":280},"Admin verbs","\u002Freference\u002Fcli\u002Fadmin","5.reference\u002F01.cli\u002F5.admin",{"title":282,"path":283,"stem":284},"Work item statuses","\u002Freference\u002Fstatuses","5.reference\u002F02.statuses",{"title":286,"path":287,"stem":288,"children":289},"Configuration","\u002Freference\u002Fconfiguration","5.reference\u002F03.configuration\u002Findex",[290,291,309,313,317,321,325,329,333,337,371],{"title":10,"path":287,"stem":288},{"title":292,"path":293,"stem":294,"children":295},"repos.yaml","\u002Freference\u002Fconfiguration\u002Frepos","5.reference\u002F03.configuration\u002F02.repos\u002Findex",[296,297,301,305],{"title":10,"path":293,"stem":294},{"title":298,"path":299,"stem":300},"How connect proposes commands","\u002Freference\u002Fconfiguration\u002Frepos\u002Fconnect-proposals","5.reference\u002F03.configuration\u002F02.repos\u002F1.connect-proposals",{"title":302,"path":303,"stem":304},"detectors.yaml","\u002Freference\u002Fconfiguration\u002Frepos\u002Fdetectors","5.reference\u002F03.configuration\u002F02.repos\u002F2.detectors",{"title":306,"path":307,"stem":308},"Workspaces","\u002Freference\u002Fconfiguration\u002Frepos\u002Fworkspaces","5.reference\u002F03.configuration\u002F02.repos\u002F3.workspaces",{"title":310,"path":311,"stem":312},"policy.yaml","\u002Freference\u002Fconfiguration\u002Fpolicy","5.reference\u002F03.configuration\u002F03.policy",{"title":314,"path":315,"stem":316},"Library and chains","\u002Freference\u002Fconfiguration\u002Flibrary-and-chains","5.reference\u002F03.configuration\u002F04.library-and-chains",{"title":318,"path":319,"stem":320},"harnesses.yaml","\u002Freference\u002Fconfiguration\u002Fharnesses-file","5.reference\u002F03.configuration\u002F05.harnesses-file",{"title":322,"path":323,"stem":324},"access.yaml","\u002Freference\u002Fconfiguration\u002Faccess","5.reference\u002F03.configuration\u002F06.access",{"title":326,"path":327,"stem":328},"intake.yaml","\u002Freference\u002Fconfiguration\u002Fintake","5.reference\u002F03.configuration\u002F07.intake",{"title":330,"path":331,"stem":332},"notify.yaml","\u002Freference\u002Fconfiguration\u002Fnotify","5.reference\u002F03.configuration\u002F08.notify",{"title":334,"path":335,"stem":336},"theme.yaml","\u002Freference\u002Fconfiguration\u002Ftheme","5.reference\u002F03.configuration\u002F09.theme",{"title":338,"path":339,"stem":340,"children":341},"Sandboxed workers","\u002Freference\u002Fconfiguration\u002Fsandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002Findex",[342,343,347,351,355,359,363,367],{"title":10,"path":339,"stem":340},{"title":344,"path":345,"stem":346},"Resource limits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fresource-limits","5.reference\u002F03.configuration\u002F10.sandbox\u002F1.resource-limits",{"title":348,"path":349,"stem":350},"Callbacks from a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcallbacks","5.reference\u002F03.configuration\u002F10.sandbox\u002F2.callbacks",{"title":352,"path":353,"stem":354},"Network policy","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fnetwork-policy","5.reference\u002F03.configuration\u002F10.sandbox\u002F3.network-policy",{"title":356,"path":357,"stem":358},"Credentials","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcredentials","5.reference\u002F03.configuration\u002F10.sandbox\u002F4.credentials",{"title":360,"path":361,"stem":362},"Kits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fkits","5.reference\u002F03.configuration\u002F10.sandbox\u002F5.kits",{"title":364,"path":365,"stem":366},"sandbox.yaml","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fsandbox-yaml","5.reference\u002F03.configuration\u002F10.sandbox\u002F6.sandbox-yaml",{"title":368,"path":369,"stem":370},"Git in a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fgit-in-a-sandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002F7.git-in-a-sandbox",{"title":372,"path":373,"stem":374},"Environment variables","\u002Freference\u002Fconfiguration\u002Fenvironment-variables","5.reference\u002F03.configuration\u002F11.environment-variables",{"title":376,"path":377,"stem":378,"children":379},"Chain file keys","\u002Freference\u002Fchain-nodes","5.reference\u002F04.chain-nodes\u002Findex",[380,381,385,389],{"title":10,"path":377,"stem":378},{"title":382,"path":383,"stem":384},"Subprocess tasks","\u002Freference\u002Fchain-nodes\u002Fsubprocess-tasks","5.reference\u002F04.chain-nodes\u002F2.subprocess-tasks",{"title":386,"path":387,"stem":388},"Fix loop and judge","\u002Freference\u002Fchain-nodes\u002Ffix-loop","5.reference\u002F04.chain-nodes\u002F3.fix-loop",{"title":390,"path":391,"stem":392},"Result file","\u002Freference\u002Fchain-nodes\u002Fresult-file","5.reference\u002F04.chain-nodes\u002F4.result-file",{"title":394,"path":395,"stem":396,"children":397},"Agent harnesses","\u002Freference\u002Fharnesses","5.reference\u002F05.harnesses\u002Findex",[398,399,403,407,411,415],{"title":10,"path":395,"stem":396},{"title":400,"path":401,"stem":402},"Unattended runs","\u002Freference\u002Fharnesses\u002Funattended-runs","5.reference\u002F05.harnesses\u002F2.unattended-runs",{"title":404,"path":405,"stem":406},"Agent profiles","\u002Freference\u002Fharnesses\u002Fagent-profiles","5.reference\u002F05.harnesses\u002F3.agent-profiles",{"title":408,"path":409,"stem":410},"Harness definition files","\u002Freference\u002Fharnesses\u002Fharness-files","5.reference\u002F05.harnesses\u002F4.harness-files",{"title":412,"path":413,"stem":414},"Fallback and escalation","\u002Freference\u002Fharnesses\u002Ffallback-and-escalation","5.reference\u002F05.harnesses\u002F5.fallback-and-escalation",{"title":416,"path":417,"stem":418},"Cost reporting","\u002Freference\u002Fharnesses\u002Fcost-reporting","5.reference\u002F05.harnesses\u002F6.cost-reporting",{"title":420,"path":421,"stem":422},"Permission gate","\u002Freference\u002Fpermissions","5.reference\u002F06.permissions",{"title":424,"path":425,"stem":426},"Inbound triggers","\u002Freference\u002Ftriggers","5.reference\u002F07.triggers",{"title":428,"path":429,"stem":430,"children":431},"HTTP API","\u002Freference\u002Fhttp-api","5.reference\u002F08.http-api\u002Findex",[432,433,437,441,445,449,453,457],{"title":10,"path":429,"stem":430},{"title":434,"path":435,"stem":436},"Filing, reading and changing work items","\u002Freference\u002Fhttp-api\u002Fwork-items","5.reference\u002F08.http-api\u002F2.work-items",{"title":438,"path":439,"stem":440},"Gates, run control, ending and retry","\u002Freference\u002Fhttp-api\u002Fgates-run-control-and-ending","5.reference\u002F08.http-api\u002F3.gates-run-control-and-ending",{"title":442,"path":443,"stem":444},"The work item object","\u002Freference\u002Fhttp-api\u002Fwork-item-object","5.reference\u002F08.http-api\u002F4.work-item-object",{"title":446,"path":447,"stem":448},"Budget, events, diff and documents","\u002Freference\u002Fhttp-api\u002Fbudget-and-events","5.reference\u002F08.http-api\u002F5.budget-and-events",{"title":450,"path":451,"stem":452},"Repos, chains, harnesses and the server","\u002Freference\u002Fhttp-api\u002Frepos-chains-harnesses-and-server","5.reference\u002F08.http-api\u002F6.repos-chains-harnesses-and-server",{"title":454,"path":455,"stem":456},"Drafts","\u002Freference\u002Fhttp-api\u002Fdrafts","5.reference\u002F08.http-api\u002F7.drafts",{"title":458,"path":459,"stem":460},"Ops for each draft area","\u002Freference\u002Fhttp-api\u002Fdraft-ops","5.reference\u002F08.http-api\u002F8.draft-ops",{"title":462,"path":463,"stem":464},"MCP tools","\u002Freference\u002Fmcp-tools","5.reference\u002F09.mcp-tools",{"title":466,"path":467,"stem":468},"Events","\u002Freference\u002Fevents","5.reference\u002F10.events",{"title":470,"path":471,"stem":472,"children":473},"Security and project","\u002Fproject","6.project",[474,476,480,484,488,492,496,500],{"title":10,"path":471,"stem":475},"6.project\u002Findex",{"title":477,"path":478,"stem":479},"Security","\u002Fproject\u002Fsecurity","6.project\u002F1.security",{"title":481,"path":482,"stem":483},"Data and privacy","\u002Fproject\u002Fdata-and-privacy","6.project\u002F2.data-and-privacy",{"title":485,"path":486,"stem":487},"What's new in 2.0","\u002Fproject\u002Fwhats-new","6.project\u002F3.whats-new",{"title":489,"path":490,"stem":491},"Status and support","\u002Fproject\u002Fstatus-and-support","6.project\u002F4.status-and-support",{"title":493,"path":494,"stem":495},"Architecture","\u002Fproject\u002Farchitecture","6.project\u002F5.architecture",{"title":497,"path":498,"stem":499},"Source map","\u002Fproject\u002Fsource-map","6.project\u002F6.source-map",{"title":501,"path":502,"stem":503},"Contributing","\u002Fproject\u002Fcontributing","6.project\u002F7.contributing",{"id":505,"title":131,"body":506,"description":1011,"extension":1012,"links":1013,"meta":1014,"navigation":1015,"path":132,"seo":1016,"stem":133,"__hash__":1017},"docs\u002F3.guides\u002F3.harnesses\u002F4.give-a-worker-its-login.md",{"type":507,"value":508,"toc":1004},"minimark",[509,519,532,537,555,559,565,858,862,872,903,956,960,979,983,1000],[510,511,512,513,518],"p",{},"A ",[514,515,517],"a",{"href":516},"\u002Fconcepts\u002Fvocabulary#worker","worker"," runs headless, with nobody to answer a login prompt. Give the agent CLI a worker runs on a login or key it can use without one, and end with a check that the worker reaches it.",[510,520,521,522,524,525,528,529,531],{},"Which agent CLI runs a work item's tasks is a choice made per task in your templates: every shipped task runs on Claude Code, and ",[514,523,119],{"href":120}," moves tasks to another. Kraft calls that CLI a ",[514,526,527],{"href":395},"harness",". Registering Kraft with the agent you type into, so you can drive Kraft from it, is a different job: see ",[514,530,72],{"href":73},".",[533,534,536],"h2",{"id":535},"before-you-start","Before you start",[538,539,540,549,552],"ul",{},[541,542,543,544,548],"li",{},"The harness's CLI is installed and on the ",[545,546,547],"code",{},"PATH"," of the shell that starts Kraft.",[541,550,551],{},"You know which harness the tasks run on. Every shipped task runs on Claude Code.",[541,553,554],{},"If your harness needs an API key, a way to put a variable in the Kraft server's environment (the shell that starts it, or the service's own settings) and to restart the server.",[533,556,558],{"id":557},"_1-find-what-your-harness-needs","1. Find what your harness needs",[510,560,561,562,564],{},"Pick your harness. Only Claude Code needs Kraft registered with it, and its tab says how. The other six need no registration: for each, ",[514,563,400],{"href":401}," says how Kraft enforces a task's tool rules, or refuses the task when the CLI cannot.",[566,567,569,628,664,700,732,766,832],"tabs",{"sync":568},"agent",[570,571,573],"tabs-item",{"label":572},"Claude Code",[538,574,575,598,619],{},[541,576,577,581,582,585,586,589,590,593,594,531],{},[578,579,580],"strong",{},"Registration."," Required. An unsandboxed Claude worker asks Kraft's\npermission gate through the ",[545,583,584],{},"kraft"," MCP server, and Kraft refuses to launch\none when nothing registers it. The plugin, ",[545,587,588],{},"kraft admin init",", or a committed\n",[545,591,592],{},".mcp.json"," each count: see\n",[514,595,597],{"href":596},"\u002Fguides\u002Fday-to-day\u002Fagent-integration#register-kraft-with-your-agent","Register Kraft with your agent",[541,599,600,603,604,607,608,611,612,615,616,531],{},[578,601,602],{},"Login."," Your normal ",[545,605,606],{},"claude"," login works. ",[545,609,610],{},"ANTHROPIC_API_KEY"," and\n",[545,613,614],{},"CLAUDE_CODE_OAUTH_TOKEN"," reach the worker without ",[545,617,618],{},"env_passthrough",[541,620,621,624,625,531],{},[578,622,623],{},"Check."," ",[545,626,627],{},"claude -p \"say hi\"",[570,629,631],{"label":630},"Codex",[538,632,633,657],{},[541,634,635,637,638,641,642,645,646,648,649,652,653,656],{},[578,636,602],{}," Sign in with ",[545,639,640],{},"codex login","; the login under your home directory\nreaches the worker. With an API key, name ",[545,643,644],{},"CODEX_API_KEY"," in\n",[545,647,618],{},", not ",[545,650,651],{},"OPENAI_API_KEY",", which ",[545,654,655],{},"codex exec"," does not send.",[541,658,659,624,661,531],{},[578,660,623],{},[545,662,663],{},"codex exec \"say hi\"",[570,665,667],{"label":666},"Cursor",[538,668,669,688],{},[541,670,671,624,673,676,677,680,681,684,685,687],{},[578,672,602],{},[545,674,675],{},"agent login"," keeps the login in the OS keychain, which a worker\nreaches unless it is ",[514,678,679],{"href":339},"sandboxed",". With an\nAPI key instead, name ",[545,682,683],{},"CURSOR_API_KEY"," in ",[545,686,618],{},". A sandboxed\nworker can only use the key.",[541,689,690,624,692,695,696,699],{},[578,691,623],{},[545,693,694],{},"agent -p --trust -- \"say hi\"",". Run it in a scratch directory:\n",[545,697,698],{},"--trust"," skips Cursor's workspace-trust prompt for the directory you are in.",[570,701,703],{"label":702},"OpenCode",[538,704,705,714,725],{},[541,706,707,710,711,531],{},[578,708,709],{},"Version."," OpenCode 2.0.0 or newer. Kraft refuses to launch an older one,\nincluding npm's 1.x ",[545,712,713],{},"opencode-ai",[541,715,716,718,719,722,723,531],{},[578,717,602],{}," Log in to your provider with ",[545,720,721],{},"opencode auth",". A provider key read\nfrom the environment needs its variable in ",[545,724,618],{},[541,726,727,624,729,531],{},[578,728,623],{},[545,730,731],{},"opencode run -- \"say hi\"",[570,733,735],{"label":734},"Amp",[538,736,737,758],{},[541,738,739,741,742,745,746,748,749,752,753,684,756,531],{},[578,740,602],{}," On a machine where you ran ",[545,743,744],{},"amp login",", do nothing more: the\nlogin lives under your home directory, which a worker keeps. A\n",[514,747,679],{"href":339}," repository never sees it,\nbecause its workers get a home of their own. There, and on any other\nmachine, create an access token (",[545,750,751],{},"sgamp_...",") at ampcode.com\u002Fsettings and\nname ",[545,754,755],{},"AMP_API_KEY",[545,757,618],{},[541,759,760,624,762,765],{},[578,761,623],{},[545,763,764],{},"amp -x \"say hi\"",". Without credentials, Amp prints a device-login\nprompt and waits about five minutes for a browser before it exits 1, so a\nhang on that prompt means the credentials did not reach the worker.",[570,767,769],{"label":768},"Antigravity",[538,770,771,787,807,825],{},[541,772,773,775,776,779,780,783,784,786],{},[578,774,602],{}," On the machine that runs Kraft, run ",[545,777,778],{},"agy"," once in a terminal and\nsign in with your Google account. A headless run never signs in by itself:\nit needs that cached sign-in. The tokens live in the OS keychain and the\nCLI's state under ",[545,781,782],{},"~\u002F.gemini\u002Fantigravity-cli\u002F",", both of which a worker\nkeeps. A ",[514,785,679],{"href":339}," worker reaches\nneither, and Kraft has not run Antigravity in a sandbox.",[541,788,789,792,793,796,797,800,801,645,804,806],{},[578,790,791],{},"Gemini API key."," Instead of the sign-in, set ",[545,794,795],{},"\"modelProvider\": \"gemini\"","\nin ",[545,798,799],{},"~\u002F.gemini\u002Fantigravity-cli\u002Fsettings.json"," and name ",[545,802,803],{},"GEMINI_API_KEY",[545,805,618],{},". This path is untested in Kraft.",[541,808,809,812,813,816,817,820,821,824],{},[578,810,811],{},"Model."," Name a base model and an effort, such as ",[545,814,815],{},"model: gemini-3.8-flash"," with ",[545,818,819],{},"effort: low",", so the dollar caps can price the\nsession. ",[545,822,823],{},"agy models"," lists the models your account has.",[541,826,827,624,829,531],{},[578,828,623],{},[545,830,831],{},"agy -p \"say hi\"",[570,833,835],{"label":834},"Gemini CLI",[538,836,837,847],{},[541,838,839,841,842,645,844,846],{},[578,840,602],{}," A Gemini API key or Gemini Code Assist: name ",[545,843,803],{},[545,845,618],{},". An individual Google account (free, Google AI Pro or\nUltra) does not work: use the Antigravity tab.",[541,848,849,624,851,695,854,857],{},[578,850,623],{},[545,852,853],{},"gemini --skip-trust -p \"say hi\"",[545,855,856],{},"--skip-trust"," trusts the directory you are in for that session.",[533,859,861],{"id":860},"_2-pass-a-key-to-the-worker","2. Pass a key to the worker",[510,863,864,865,684,867,871],{},"Skip this step when your harness's tab needs no variable. A worker's environment is an allowlist: a variable reaches it only when the repo's ",[545,866,618],{},[514,868,869],{"href":293},[545,870,292],{}," names it. To pass a key:",[873,874,875,880,900],"ol",{},[541,876,877,878,531],{},"Name its variable in the repo's ",[545,879,618],{},[541,881,882,883,886,887,890,891,894,895,899],{},"Export it in the shell that starts the Kraft server. ",[578,884,885],{},"Running Kraft as a service?"," The service's environment is fixed when ",[545,888,889],{},"install-service"," writes it, so an ",[545,892,893],{},"export"," in your shell never reaches a worker. Set the variable in the service instead, as ",[514,896,898],{"href":897},"\u002Fguides\u002Frun\u002Frun-as-a-service#give-the-service-an-environment","Give the service an environment"," shows.",[541,901,902],{},"Restart the server.",[904,905,911],"pre",{"className":906,"code":907,"filename":908,"language":909,"meta":910,"style":910},"language-yaml shiki shiki-themes github-light-high-contrast github-light-high-contrast github-dark-high-contrast","repos:\n  - path: \u002Fpath\u002Fto\u002Frepo\n    env_passthrough: [AMP_API_KEY]\n","config\u002Frepos.yaml","yaml","",[545,912,913,926,942],{"__ignoreMap":910},[914,915,918,922],"span",{"class":916,"line":917},"line",1,[914,919,921],{"class":920},"sb7M8","repos",[914,923,925],{"class":924},"s7iLA",":\n",[914,927,929,932,935,938],{"class":916,"line":928},2,[914,930,931],{"class":924},"  - ",[914,933,934],{"class":920},"path",[914,936,937],{"class":924},": ",[914,939,941],{"class":940},"semJd","\u002Fpath\u002Fto\u002Frepo\n",[914,943,945,948,951,953],{"class":916,"line":944},3,[914,946,947],{"class":920},"    env_passthrough",[914,949,950],{"class":924},": [",[914,952,755],{"class":940},[914,954,955],{"class":924},"]\n",[533,957,959],{"id":958},"check-it-worked","Check it worked",[873,961,962,969],{},[541,963,964,965,968],{},"Run your tab's ",[578,966,967],{},"Check"," command by hand, as the same user that runs the Kraft server. It prints an answer and exits, and does not ask you to log in. Under a service this proves only that your shell has the key: it does not prove the service has it, so read item 2.",[541,970,971,972,974,975,978],{},"File a small work item with a task on the harness, as ",[514,973,119],{"href":120}," shows, and read its log with ",[545,976,977],{},"kraft view logs ID",". A login failure shows there as the CLI's own message: Kraft adds no text of its own. Amp's is in its tab.",[533,980,982],{"id":981},"next-steps","Next steps",[538,984,985,990,995],{},[541,986,987,989],{},[514,988,119],{"href":120},": move a chain's tasks onto the harness you gave a login.",[541,991,992,994],{},[514,993,394],{"href":395},": what each harness can and cannot do.",[541,996,997,999],{},[514,998,123],{"href":124},": add an agent CLI Kraft does not ship.",[1001,1002,1003],"style",{},"html pre.shiki code .sb7M8, html code.shiki .sb7M8{--shiki-light:#024C1A;--shiki-default:#024C1A;--shiki-dark:#72F088}html pre.shiki code .s7iLA, html code.shiki .s7iLA{--shiki-light:#0E1116;--shiki-default:#0E1116;--shiki-dark:#F0F3F6}html pre.shiki code .semJd, html code.shiki .semJd{--shiki-light:#032563;--shiki-default:#032563;--shiki-dark:#ADDCFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":910,"searchDepth":928,"depth":928,"links":1005},[1006,1007,1008,1009,1010],{"id":535,"depth":928,"text":536},{"id":557,"depth":928,"text":558},{"id":860,"depth":928,"text":861},{"id":958,"depth":928,"text":959},{"id":981,"depth":928,"text":982},"Give the agent CLI a worker runs on, whether Claude Code, Codex, Cursor, OpenCode, Amp, Antigravity or Gemini CLI, a login it can use headless, and check that the worker reaches it.","md",null,{},true,{"title":131,"description":1011},"M3ukLXEQPPUXLe7go2p95A1sVcVwRdBgy_C8h3oghMk",[1019,1021],{"title":127,"path":128,"stem":129,"description":1020,"children":-1},"Build a Docker Sandbox Kit for Kraft's Claude workers, push it to your registry, and run a repository's sandbox from it, pinned by digest.",{"title":140,"path":141,"stem":142,"description":1022,"children":-1},"Approve or reject a gate from a phone, over Tailscale, a tunnel or a reverse proxy you run, using the same password auth as the local board, get back if Kraft does not restart, and rotate the token.",1791801252066]