[{"data":1,"prerenderedAt":2627},["ShallowReactive",2],{"navigation_docs":3,"-project-security":520,"-project-security-surround":2622},[4,28,51,191,222,485],{"title":5,"path":6,"stem":7,"children":8},"Get started","\u002Fget-started","1.get-started",[9,12,16,20,24],{"title":10,"path":6,"stem":11},"Overview","1.get-started\u002Findex",{"title":13,"path":14,"stem":15},"Why Kraft","\u002Fget-started\u002Fwhy-kraft","1.get-started\u002F0.why-kraft",{"title":17,"path":18,"stem":19},"Install","\u002Fget-started\u002Finstall","1.get-started\u002F1.install",{"title":21,"path":22,"stem":23},"Your first work item","\u002Fget-started\u002Ffirst-work-item","1.get-started\u002F2.first-work-item",{"title":25,"path":26,"stem":27},"FAQ","\u002Fget-started\u002Ffaq","1.get-started\u002F3.faq",{"title":29,"path":30,"stem":31,"children":32},"Concepts","\u002Fconcepts","2.concepts",[33,35,39,43,47],{"title":10,"path":30,"stem":34},"2.concepts\u002Findex",{"title":36,"path":37,"stem":38},"How a work item runs","\u002Fconcepts\u002Fhow-a-work-item-runs","2.concepts\u002F1.how-a-work-item-runs",{"title":40,"path":41,"stem":42},"Caps and budgets","\u002Fconcepts\u002Fcaps-and-budgets","2.concepts\u002F2.caps-and-budgets",{"title":44,"path":45,"stem":46},"Why a permission gate","\u002Fconcepts\u002Fpermission-gate","2.concepts\u002F3.permission-gate",{"title":48,"path":49,"stem":50},"Vocabulary","\u002Fconcepts\u002Fvocabulary","2.concepts\u002F4.vocabulary",{"title":52,"path":53,"stem":54,"children":55},"Guides","\u002Fguides","3.guides",[56,58,96,117,138,187],{"title":10,"path":53,"stem":57},"3.guides\u002Findex",{"title":59,"path":60,"stem":61,"children":62,"page":95},"Day to day","\u002Fguides\u002Fday-to-day","3.guides\u002F1.day-to-day",[63,67,71,75,79,83,87,91],{"title":64,"path":65,"stem":66},"The setup wizard on first start","\u002Fguides\u002Fday-to-day\u002Ffirst-run","3.guides\u002F1.day-to-day\u002F2.first-run",{"title":68,"path":69,"stem":70},"File a work item","\u002Fguides\u002Fday-to-day\u002Ffile-a-work-item","3.guides\u002F1.day-to-day\u002F3.file-a-work-item",{"title":72,"path":73,"stem":74},"Use Kraft from your agent","\u002Fguides\u002Fday-to-day\u002Fagent-integration","3.guides\u002F1.day-to-day\u002F4.agent-integration",{"title":76,"path":77,"stem":78},"Reviewing a change","\u002Fguides\u002Fday-to-day\u002Freview-a-change","3.guides\u002F1.day-to-day\u002F5.review-a-change",{"title":80,"path":81,"stem":82},"Raise a cap on a stopped item","\u002Fguides\u002Fday-to-day\u002Fraise-a-cap","3.guides\u002F1.day-to-day\u002F6.raise-a-cap",{"title":84,"path":85,"stem":86},"Kraft for VS Code","\u002Fguides\u002Fday-to-day\u002Fvscode","3.guides\u002F1.day-to-day\u002F7.vscode",{"title":88,"path":89,"stem":90},"Kraft on a phone","\u002Fguides\u002Fday-to-day\u002Fkraft-on-a-phone","3.guides\u002F1.day-to-day\u002F8.kraft-on-a-phone",{"title":92,"path":93,"stem":94},"Get notified when an item needs you","\u002Fguides\u002Fday-to-day\u002Fnotifications","3.guides\u002F1.day-to-day\u002F9.notifications",false,{"title":97,"path":98,"stem":99,"children":100,"page":95},"Customize and automate","\u002Fguides\u002Fcustomize","3.guides\u002F2.customize",[101,105,109,113],{"title":102,"path":103,"stem":104},"Write your own chain","\u002Fguides\u002Fcustomize\u002Fwrite-your-own-chain","3.guides\u002F2.customize\u002F1.write-your-own-chain",{"title":106,"path":107,"stem":108},"Add a security review or a gate reviewer","\u002Fguides\u002Fcustomize\u002Fadd-review-agents","3.guides\u002F2.customize\u002F2.add-review-agents",{"title":110,"path":111,"stem":112},"Schedule or webhook work","\u002Fguides\u002Fcustomize\u002Fschedule-and-webhook-work","3.guides\u002F2.customize\u002F3.schedule-and-webhook-work",{"title":114,"path":115,"stem":116},"Share chains with add-ons","\u002Fguides\u002Fcustomize\u002Fshare-chains-with-addons","3.guides\u002F2.customize\u002F4.share-chains-with-addons",{"title":118,"path":119,"stem":120,"children":121,"page":95},"Agents and harnesses","\u002Fguides\u002Fharnesses","3.guides\u002F3.harnesses",[122,126,130,134],{"title":123,"path":124,"stem":125},"Switch a task to another harness","\u002Fguides\u002Fharnesses\u002Fswitch-harness","3.guides\u002F3.harnesses\u002F1.switch-harness",{"title":127,"path":128,"stem":129},"Add or override a harness","\u002Fguides\u002Fharnesses\u002Fadding-a-harness","3.guides\u002F3.harnesses\u002F2.adding-a-harness",{"title":131,"path":132,"stem":133},"Build a worker Kit","\u002Fguides\u002Fharnesses\u002Fworker-kit","3.guides\u002F3.harnesses\u002F3.worker-kit",{"title":135,"path":136,"stem":137},"Give a worker its login","\u002Fguides\u002Fharnesses\u002Fgive-a-worker-its-login","3.guides\u002F3.harnesses\u002F4.give-a-worker-its-login",{"title":139,"path":140,"stem":141,"children":142,"page":95},"Run the server","\u002Fguides\u002Frun","3.guides\u002F4.run",[143,147,151,155,159,163,167,171,175,179,183],{"title":144,"path":145,"stem":146},"Remote access","\u002Fguides\u002Frun\u002Fremote-access","3.guides\u002F4.run\u002F01.remote-access",{"title":148,"path":149,"stem":150},"Put a proxy in front of Kraft","\u002Fguides\u002Frun\u002Fput-a-proxy-in-front-of-kraft","3.guides\u002F4.run\u002F02.put-a-proxy-in-front-of-kraft",{"title":152,"path":153,"stem":154},"Restart Kraft without ending running agents","\u002Fguides\u002Frun\u002Frestart-kraft","3.guides\u002F4.run\u002F03.restart-kraft",{"title":156,"path":157,"stem":158},"Back up and restore the database","\u002Fguides\u002Frun\u002Fback-up-and-restore","3.guides\u002F4.run\u002F04.back-up-and-restore",{"title":160,"path":161,"stem":162},"Logs and disk space","\u002Fguides\u002Frun\u002Flogs-and-disk-space","3.guides\u002F4.run\u002F05.logs-and-disk-space",{"title":164,"path":165,"stem":166},"Run Kraft as a service","\u002Fguides\u002Frun\u002Frun-as-a-service","3.guides\u002F4.run\u002F06.run-as-a-service",{"title":168,"path":169,"stem":170},"Upgrade Kraft","\u002Fguides\u002Frun\u002Fupgrade-kraft","3.guides\u002F4.run\u002F07.upgrade-kraft",{"title":172,"path":173,"stem":174},"Upgrade your configuration","\u002Fguides\u002Frun\u002Fupgrade-your-configuration","3.guides\u002F4.run\u002F08.upgrade-your-configuration",{"title":176,"path":177,"stem":178},"Upgrade from 1.4","\u002Fguides\u002Frun\u002Fupgrade-from-1-4","3.guides\u002F4.run\u002F09.upgrade-from-1-4",{"title":180,"path":181,"stem":182},"Upgrade from 0.x or a release candidate","\u002Fguides\u002Frun\u002Fupgrade-from-0-x-or-a-release-candidate","3.guides\u002F4.run\u002F10.upgrade-from-0-x-or-a-release-candidate",{"title":184,"path":185,"stem":186},"Roll back to 1.4","\u002Fguides\u002Frun\u002Froll-back","3.guides\u002F4.run\u002F11.roll-back",{"title":188,"path":189,"stem":190},"Kraft Lite","\u002Fguides\u002Fkraft-lite","3.guides\u002F5.kraft-lite",{"title":192,"path":193,"stem":194,"children":195},"Troubleshooting","\u002Ftroubleshooting","4.troubleshooting",[196,198,202,206,210,214,218],{"title":10,"path":193,"stem":197},"4.troubleshooting\u002Findex",{"title":199,"path":200,"stem":201},"Why did my item stop?","\u002Ftroubleshooting\u002Fwhy-did-my-item-stop","4.troubleshooting\u002F1.why-did-my-item-stop",{"title":203,"path":204,"stem":205},"Stop reasons in detail","\u002Ftroubleshooting\u002Fstop-reasons-in-detail","4.troubleshooting\u002F2.stop-reasons-in-detail",{"title":207,"path":208,"stem":209},"Starting and reaching Kraft","\u002Ftroubleshooting\u002Fstarting-and-reaching-kraft","4.troubleshooting\u002F3.starting-and-reaching-kraft",{"title":211,"path":212,"stem":213},"Doctor failures","\u002Ftroubleshooting\u002Fdoctor-failures","4.troubleshooting\u002F4.doctor-failures",{"title":215,"path":216,"stem":217},"Sandbox and Kit stops","\u002Ftroubleshooting\u002Fsandbox-and-kit-stops","4.troubleshooting\u002F5.sandbox-and-kit-stops",{"title":219,"path":220,"stem":221},"Add-on problems","\u002Ftroubleshooting\u002Faddon-problems","4.troubleshooting\u002F6.addon-problems",{"title":223,"path":224,"stem":225,"children":226},"Reference","\u002Freference","5.reference",[227,229,267,289,293,391,409,435,439,443,477,481],{"title":10,"path":224,"stem":228},"5.reference\u002Findex",{"title":230,"path":231,"stem":232,"children":233},"Web UI","\u002Freference\u002Fweb-ui","5.reference\u002F00.web-ui\u002Findex",[234,235,239,243,247,251,255,259,263],{"title":10,"path":231,"stem":232},{"title":236,"path":237,"stem":238},"Sidebar, search, and keyboard","\u002Freference\u002Fweb-ui\u002Fsidebar-search-and-keyboard","5.reference\u002F00.web-ui\u002F0.sidebar-search-and-keyboard",{"title":240,"path":241,"stem":242},"The board","\u002Freference\u002Fweb-ui\u002Fboard","5.reference\u002F00.web-ui\u002F1.board",{"title":244,"path":245,"stem":246},"An item's page","\u002Freference\u002Fweb-ui\u002Fitem-page","5.reference\u002F00.web-ui\u002F2.item-page",{"title":248,"path":249,"stem":250},"Fix loops and test scopes","\u002Freference\u002Fweb-ui\u002Ffix-loops-and-test-scopes","5.reference\u002F00.web-ui\u002F3.fix-loops-and-test-scopes",{"title":252,"path":253,"stem":254},"Config before an item starts","\u002Freference\u002Fweb-ui\u002Fconfig-before-start","5.reference\u002F00.web-ui\u002F4.config-before-start",{"title":256,"path":257,"stem":258},"The review page","\u002Freference\u002Fweb-ui\u002Freview-page","5.reference\u002F00.web-ui\u002F5.review-page",{"title":260,"path":261,"stem":262},"Templates and Settings","\u002Freference\u002Fweb-ui\u002Ftemplates-and-settings","5.reference\u002F00.web-ui\u002F6.templates-and-settings",{"title":264,"path":265,"stem":266},"Analytics","\u002Freference\u002Fweb-ui\u002Fanalytics","5.reference\u002F00.web-ui\u002F7.analytics",{"title":268,"path":269,"stem":270,"children":271},"CLI","\u002Freference\u002Fcli","5.reference\u002F01.cli\u002Findex",[272,273,277,281,285],{"title":10,"path":269,"stem":270},{"title":274,"path":275,"stem":276},"Item verbs","\u002Freference\u002Fcli\u002Fitem","5.reference\u002F01.cli\u002F2.item",{"title":278,"path":279,"stem":280},"View verbs","\u002Freference\u002Fcli\u002Fview","5.reference\u002F01.cli\u002F3.view",{"title":282,"path":283,"stem":284},"Repo verbs","\u002Freference\u002Fcli\u002Frepo","5.reference\u002F01.cli\u002F4.repo",{"title":286,"path":287,"stem":288},"Admin verbs","\u002Freference\u002Fcli\u002Fadmin","5.reference\u002F01.cli\u002F5.admin",{"title":290,"path":291,"stem":292},"Work item statuses","\u002Freference\u002Fstatuses","5.reference\u002F02.statuses",{"title":294,"path":295,"stem":296,"children":297},"Configuration","\u002Freference\u002Fconfiguration","5.reference\u002F03.configuration\u002Findex",[298,299,317,321,325,329,333,337,341,345,379,383,387],{"title":10,"path":295,"stem":296},{"title":300,"path":301,"stem":302,"children":303},"repos.yaml","\u002Freference\u002Fconfiguration\u002Frepos","5.reference\u002F03.configuration\u002F02.repos\u002Findex",[304,305,309,313],{"title":10,"path":301,"stem":302},{"title":306,"path":307,"stem":308},"How connect proposes commands","\u002Freference\u002Fconfiguration\u002Frepos\u002Fconnect-proposals","5.reference\u002F03.configuration\u002F02.repos\u002F1.connect-proposals",{"title":310,"path":311,"stem":312},"detectors.yaml","\u002Freference\u002Fconfiguration\u002Frepos\u002Fdetectors","5.reference\u002F03.configuration\u002F02.repos\u002F2.detectors",{"title":314,"path":315,"stem":316},"Workspaces","\u002Freference\u002Fconfiguration\u002Frepos\u002Fworkspaces","5.reference\u002F03.configuration\u002F02.repos\u002F3.workspaces",{"title":318,"path":319,"stem":320},"policy.yaml","\u002Freference\u002Fconfiguration\u002Fpolicy","5.reference\u002F03.configuration\u002F03.policy",{"title":322,"path":323,"stem":324},"Library and chains","\u002Freference\u002Fconfiguration\u002Flibrary-and-chains","5.reference\u002F03.configuration\u002F04.library-and-chains",{"title":326,"path":327,"stem":328},"harnesses.yaml","\u002Freference\u002Fconfiguration\u002Fharnesses-file","5.reference\u002F03.configuration\u002F05.harnesses-file",{"title":330,"path":331,"stem":332},"access.yaml","\u002Freference\u002Fconfiguration\u002Faccess","5.reference\u002F03.configuration\u002F06.access",{"title":334,"path":335,"stem":336},"intake.yaml","\u002Freference\u002Fconfiguration\u002Fintake","5.reference\u002F03.configuration\u002F07.intake",{"title":338,"path":339,"stem":340},"notify.yaml","\u002Freference\u002Fconfiguration\u002Fnotify","5.reference\u002F03.configuration\u002F08.notify",{"title":342,"path":343,"stem":344},"theme.yaml","\u002Freference\u002Fconfiguration\u002Ftheme","5.reference\u002F03.configuration\u002F09.theme",{"title":346,"path":347,"stem":348,"children":349},"Sandboxed workers","\u002Freference\u002Fconfiguration\u002Fsandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002Findex",[350,351,355,359,363,367,371,375],{"title":10,"path":347,"stem":348},{"title":352,"path":353,"stem":354},"Resource limits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fresource-limits","5.reference\u002F03.configuration\u002F10.sandbox\u002F1.resource-limits",{"title":356,"path":357,"stem":358},"Callbacks from a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcallbacks","5.reference\u002F03.configuration\u002F10.sandbox\u002F2.callbacks",{"title":360,"path":361,"stem":362},"Network policy","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fnetwork-policy","5.reference\u002F03.configuration\u002F10.sandbox\u002F3.network-policy",{"title":364,"path":365,"stem":366},"Credentials","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcredentials","5.reference\u002F03.configuration\u002F10.sandbox\u002F4.credentials",{"title":368,"path":369,"stem":370},"Kits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fkits","5.reference\u002F03.configuration\u002F10.sandbox\u002F5.kits",{"title":372,"path":373,"stem":374},"sandbox.yaml","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fsandbox-yaml","5.reference\u002F03.configuration\u002F10.sandbox\u002F6.sandbox-yaml",{"title":376,"path":377,"stem":378},"Git in a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fgit-in-a-sandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002F7.git-in-a-sandbox",{"title":380,"path":381,"stem":382},"Environment variables","\u002Freference\u002Fconfiguration\u002Fenvironment-variables","5.reference\u002F03.configuration\u002F11.environment-variables",{"title":384,"path":385,"stem":386},"Add-ons and collections","\u002Freference\u002Fconfiguration\u002Faddons","5.reference\u002F03.configuration\u002F12.addons",{"title":388,"path":389,"stem":390},"Repo libraries","\u002Freference\u002Fconfiguration\u002Frepo-libraries","5.reference\u002F03.configuration\u002F13.repo-libraries",{"title":392,"path":393,"stem":394,"children":395},"Chain file keys","\u002Freference\u002Fchain-nodes","5.reference\u002F04.chain-nodes\u002Findex",[396,397,401,405],{"title":10,"path":393,"stem":394},{"title":398,"path":399,"stem":400},"Subprocess tasks","\u002Freference\u002Fchain-nodes\u002Fsubprocess-tasks","5.reference\u002F04.chain-nodes\u002F2.subprocess-tasks",{"title":402,"path":403,"stem":404},"Fix loop and judge","\u002Freference\u002Fchain-nodes\u002Ffix-loop","5.reference\u002F04.chain-nodes\u002F3.fix-loop",{"title":406,"path":407,"stem":408},"Result file","\u002Freference\u002Fchain-nodes\u002Fresult-file","5.reference\u002F04.chain-nodes\u002F4.result-file",{"title":410,"path":411,"stem":412,"children":413},"Agent harnesses","\u002Freference\u002Fharnesses","5.reference\u002F05.harnesses\u002Findex",[414,415,419,423,427,431],{"title":10,"path":411,"stem":412},{"title":416,"path":417,"stem":418},"Unattended runs","\u002Freference\u002Fharnesses\u002Funattended-runs","5.reference\u002F05.harnesses\u002F2.unattended-runs",{"title":420,"path":421,"stem":422},"Agent profiles","\u002Freference\u002Fharnesses\u002Fagent-profiles","5.reference\u002F05.harnesses\u002F3.agent-profiles",{"title":424,"path":425,"stem":426},"Harness definition files","\u002Freference\u002Fharnesses\u002Fharness-files","5.reference\u002F05.harnesses\u002F4.harness-files",{"title":428,"path":429,"stem":430},"Fallback and escalation","\u002Freference\u002Fharnesses\u002Ffallback-and-escalation","5.reference\u002F05.harnesses\u002F5.fallback-and-escalation",{"title":432,"path":433,"stem":434},"Cost reporting","\u002Freference\u002Fharnesses\u002Fcost-reporting","5.reference\u002F05.harnesses\u002F6.cost-reporting",{"title":436,"path":437,"stem":438},"Permission gate","\u002Freference\u002Fpermissions","5.reference\u002F06.permissions",{"title":440,"path":441,"stem":442},"Inbound triggers","\u002Freference\u002Ftriggers","5.reference\u002F07.triggers",{"title":444,"path":445,"stem":446,"children":447},"HTTP API","\u002Freference\u002Fhttp-api","5.reference\u002F08.http-api\u002Findex",[448,449,453,457,461,465,469,473],{"title":10,"path":445,"stem":446},{"title":450,"path":451,"stem":452},"Filing, reading and changing work items","\u002Freference\u002Fhttp-api\u002Fwork-items","5.reference\u002F08.http-api\u002F2.work-items",{"title":454,"path":455,"stem":456},"Gates, run control, ending and retry","\u002Freference\u002Fhttp-api\u002Fgates-run-control-and-ending","5.reference\u002F08.http-api\u002F3.gates-run-control-and-ending",{"title":458,"path":459,"stem":460},"The work item object","\u002Freference\u002Fhttp-api\u002Fwork-item-object","5.reference\u002F08.http-api\u002F4.work-item-object",{"title":462,"path":463,"stem":464},"Budget, events, diff and documents","\u002Freference\u002Fhttp-api\u002Fbudget-and-events","5.reference\u002F08.http-api\u002F5.budget-and-events",{"title":466,"path":467,"stem":468},"Repos, chains, harnesses and the server","\u002Freference\u002Fhttp-api\u002Frepos-chains-harnesses-and-server","5.reference\u002F08.http-api\u002F6.repos-chains-harnesses-and-server",{"title":470,"path":471,"stem":472},"Drafts","\u002Freference\u002Fhttp-api\u002Fdrafts","5.reference\u002F08.http-api\u002F7.drafts",{"title":474,"path":475,"stem":476},"Ops for each draft area","\u002Freference\u002Fhttp-api\u002Fdraft-ops","5.reference\u002F08.http-api\u002F8.draft-ops",{"title":478,"path":479,"stem":480},"MCP tools","\u002Freference\u002Fmcp-tools","5.reference\u002F09.mcp-tools",{"title":482,"path":483,"stem":484},"Events","\u002Freference\u002Fevents","5.reference\u002F10.events",{"title":486,"path":487,"stem":488,"children":489},"Security and project","\u002Fproject","6.project",[490,492,496,500,504,508,512,516],{"title":10,"path":487,"stem":491},"6.project\u002Findex",{"title":493,"path":494,"stem":495},"Security","\u002Fproject\u002Fsecurity","6.project\u002F1.security",{"title":497,"path":498,"stem":499},"Data and privacy","\u002Fproject\u002Fdata-and-privacy","6.project\u002F2.data-and-privacy",{"title":501,"path":502,"stem":503},"What's new in 2.0","\u002Fproject\u002Fwhats-new","6.project\u002F3.whats-new",{"title":505,"path":506,"stem":507},"Status and support","\u002Fproject\u002Fstatus-and-support","6.project\u002F4.status-and-support",{"title":509,"path":510,"stem":511},"Architecture","\u002Fproject\u002Farchitecture","6.project\u002F5.architecture",{"title":513,"path":514,"stem":515},"Source map","\u002Fproject\u002Fsource-map","6.project\u002F6.source-map",{"title":517,"path":518,"stem":519},"Contributing","\u002Fproject\u002Fcontributing","6.project\u002F7.contributing",{"id":521,"title":493,"body":522,"description":2615,"extension":2616,"links":2617,"meta":2618,"navigation":2619,"path":494,"seo":2620,"stem":495,"__hash__":2621},"docs\u002F6.project\u002F1.security.md",{"type":523,"value":524,"toc":2590},"minimark",[525,545,553,558,561,686,690,693,1014,1018,1024,1157,1162,1165,1168,1193,1212,1215,1218,1221,1306,1309,1385,1390,1393,1491,1494,1504,1516,1523,1557,1565,1578,1594,1597,1603,1609,1626,1631,1646,1652,1667,1670,1673,1690,1712,1721,1728,1754,1764,1778,1781,1796,1806,1809,1812,1823,1826,1829,1832,1838,1858,1861,1872,1877,1911,1916,1942,1967,1970,1973,1978,1992,2007,2023,2026,2114,2117,2124,2130,2195,2201,2216,2221,2239,2249,2266,2284,2306,2309,2319,2388,2391,2394,2407,2427,2458,2471,2474,2490,2542,2545,2564,2568],[526,527,528,529,534,535,539,540,544],"p",{},"Kraft runs coding agents on your machine, in git ",[530,531,533],"a",{"href":532},"\u002Fconcepts\u002Fvocabulary#worktree","worktrees"," of your\nrepositories. Without a ",[530,536,538],{"href":537},"\u002Fconcepts\u002Fvocabulary#sandbox","sandbox",", an agent runs as your user and can do\nwhatever you can. Kraft binds to ",[541,542,543],"code",{},"127.0.0.1",", and on that address its API\nneeds no login, so any local process can drive it.",[526,546,547,548,552],{},"To report a vulnerability, see\n",[530,549,551],{"href":550},"#reporting-a-vulnerability","Reporting a vulnerability",".",[554,555,557],"h2",{"id":556},"run-it-safely","Run it safely",[526,559,560],{},"These settings matter most. Each one is a line here and a link to the page that\nexplains it.",[562,563,564,574,606,614,632,647,664],"ol",{},[565,566,567,573],"li",{},[568,569,570,571,552],"strong",{},"Run each repository's agents in a ",[530,572,538],{"href":347},"\nWithout one, an agent has your SSH agent, your logins and your home\ndirectory.",[565,575,576,583,584,588,589,592,593,597,598,600,601,603,604,552],{},[568,577,578,579,582],{},"Give the sandbox a ",[541,580,581],{},"network:"," policy."," A launch into a sandbox without\none is refused, whatever the harness, because that sandbox's network is not\nrestricted and the ",[530,585,587],{"href":586},"\u002Fconcepts\u002Fvocabulary#worker","worker"," has no channel to\nKraft. ",[541,590,591],{},"unrestricted_network: true"," on the sandbox accepts that knowingly:\nthe launch runs and gates are not enforced. Cursor\n",[530,594,596],{"href":595},"\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fnetwork-policy#clients-that-ignore-the-proxy","ignores a proxy",",\nso ",[541,599,581],{}," refuses it: it runs in a sandbox only with\n",[541,602,591],{}," and without a tool policy. See\n",[530,605,360],{"href":361},[565,607,608,611,612,552],{},[568,609,610],{},"Keep Kraft on loopback."," To reach the board from another device, set an\naccess password first and use Tailscale: ",[530,613,144],{"href":145},[565,615,616,619,620,622,623,627,628,552],{},[568,617,618],{},"Protect your default branch with a required review"," from someone other\nthan the account Kraft uses. A sandboxed worker under the ",[541,621,581],{}," policy\nof step 2 cannot approve its own ",[530,624,626],{"href":625},"\u002Fconcepts\u002Fvocabulary#gate","gate","; an\nunsandboxed one can. See ",[530,629,631],{"href":630},"#agents-and-gates","Agents and gates",[565,633,634,637,638,642,643,552],{},[568,635,636],{},"Do not point Kraft at content you do not trust:"," a repository, a\ntrigger source or a ",[530,639,641],{"href":640},"\u002Fconcepts\u002Fvocabulary#beads","beads"," queue. A sandbox does\nnot cover Kraft's own push from the host, where the repository's pre-push\nhook runs as you. See ",[530,644,646],{"href":645},"#prompt-injection","Prompt injection",[565,648,649,659,660,552],{},[568,650,651,652,655,656,552],{},"Give CI and webhook senders the ",[541,653,654],{},"trigger-token",", never the ",[541,657,658],{},"mcp-token","\nSee ",[530,661,663],{"href":662},"#the-bearer-token","The bearer token",[565,665,666,681,682,552],{},[568,667,668,669,673,674,677,678],{},"Review a ",[530,670,672],{"href":671},"\u002Fconcepts\u002Fvocabulary#harness-profile","harness profile","'s ",[541,675,676],{},"executable"," and a repository's\n",[541,679,680],{},"setup_command"," after anyone else has had access to Settings. See\n",[530,683,685],{"href":684},"#files-and-settings","Files and settings",[554,687,689],{"id":688},"default-posture","Default posture",[526,691,692],{},"This is what a fresh install does before you change any setting.",[694,695,696,712],"table",{},[697,698,699],"thead",{},[700,701,702,706,709],"tr",{},[703,704,705],"th",{},"Area",[703,707,708],{},"What a fresh install does",[703,710,711],{},"Tighten it",[713,714,715,734,762,797,817,849,870,891,909,927,967,985,998],"tbody",{},[700,716,717,721,728],{},[718,719,720],"td",{},"Sandbox",[718,722,723,724,727],{},"None. No repository sets ",[541,725,726],{},"sandbox:",", so every agent runs directly on your machine, as your user.",[718,729,730,731,733],{},"Set ",[541,732,726],{}," on a repository.",[700,735,736,739,759],{},[718,737,738],{},"Files and logins",[718,740,741,742,745,746,750,751,754,755,758],{},"A worker reads anything your user can: ",[541,743,744],{},"~\u002F.ssh",", your ",[530,747,749],{"href":748},"\u002Fconcepts\u002Fvocabulary#forge","forge"," CLI's login, your agent's login, and ",[541,752,753],{},"$KRAFT_HOME",", including the ",[530,756,757],{"href":662},"bearer token",". It can push with your SSH agent.",[718,760,761],{},"Run it in a sandbox.",[700,763,764,767,785],{},[718,765,766],{},"Worker environment",[718,768,769,770,773,774,777,778,773,781,784],{},"An allowlist, but it includes ",[541,771,772],{},"HOME"," and ",[541,775,776],{},"SSH_AUTH_SOCK"," and passes ",[541,779,780],{},"ANTHROPIC_API_KEY",[541,782,783],{},"CLAUDE_CODE_OAUTH_TOKEN"," through.",[718,786,787,789,790,793,794,796],{},[530,788,380],{"href":381}," lists it; a sandbox ",[541,791,792],{},"credentials"," entry, which needs ",[541,795,581],{},", keeps a variable out of the container.",[700,798,799,802,811],{},[718,800,801],{},"Network",[718,803,804,805,807,808,810],{},"Without a sandbox, a worker reaches any host your machine can. A sandbox without a ",[541,806,581],{}," policy is refused unless it sets ",[541,809,591],{},", which leaves egress open.",[718,812,813,814,816],{},"Add ",[541,815,581],{}," to the sandbox.",[700,818,819,822,840],{},[718,820,821],{},"Claude Code",[718,823,824,825,828,829,832,833,836,837,552],{},"Shipped chains run it with ",[541,826,827],{},"--permission-mode auto"," and no tool list. Its own classifier decides most calls. A call that reaches Kraft's permission gate is allowed, because no ",[541,830,831],{},"allowed_tools"," is set, except ",[541,834,835],{},"Monitor"," and your ",[541,838,839],{},"deny_tools",[718,841,730,842,773,844,846,847,552],{},[541,843,831],{},[541,845,839],{},": ",[530,848,436],{"href":437},[700,850,851,854,865],{},[718,852,853],{},"Gemini and Antigravity",[718,855,856,857,860,861,864],{},"Never reach the gate. Gemini runs with ",[541,858,859],{},"--approval-mode yolo"," and Antigravity with ",[541,862,863],{},"--dangerously-skip-permissions",", so every call is approved. Neither can enforce a tool list, so a launch with one is refused.",[718,866,867,869],{},[530,868,416],{"href":417}," has the flags.",[700,871,872,875,887],{},[718,873,874],{},"OpenCode and Amp",[718,876,877,878,881,882,773,884,886],{},"Never reach the gate. OpenCode runs with ",[541,879,880],{},"--auto"," and Amp asks for no approvals. Both enforce ",[541,883,839],{},[541,885,831],{}," through rules Kraft writes at launch.",[718,888,889,552],{},[530,890,416],{"href":417},[700,892,893,896,905],{},[718,894,895],{},"Codex and Cursor",[718,897,898,899,901,902,904],{},"They reach the gate through a pre-tool hook, installed only when the task's policy has something to enforce. With no ",[541,900,831],{},", the gate gives no opinion, so the CLI's own mode decides every call outside ",[541,903,839],{}," and the grants.",[718,906,907,552],{},[530,908,436],{"href":437},[700,910,911,914,923],{},[718,912,913],{},"Codex and Cursor, when Kraft cannot answer",[718,915,916,917,919,920,922],{},"The CLI's own mode decides, unless the task holds ",[541,918,831],{},": then the hook denies. In a sandbox under ",[541,921,581],{},", the hook denies on any failure.",[718,924,925,552],{},[530,926,436],{"href":437},[700,928,929,935,957],{},[718,930,931],{},[530,932,934],{"href":933},"\u002Fconcepts\u002Fvocabulary#escalation-turn","Escalation turns",[718,936,937,938,941,942,773,945,948,949,953,954,552],{},"They hold the ",[541,939,940],{},"git-commit",", ",[541,943,944],{},"git-rebase",[541,946,947],{},"git-push"," ",[530,950,952],{"href":951},"\u002Fconcepts\u002Fvocabulary#grant","grants",", which the permission gate allows. They can push their item's branch, including with ",[541,955,956],{},"--force-with-lease",[718,958,959,962,963,552],{},[541,960,961],{},"defaults.escalation_grants: []"," removes the gate's allow only. See ",[530,964,966],{"href":965},"#escalation-turns-can-force-push","Escalation turns can force-push",[700,968,969,972,978],{},[718,970,971],{},"Local API",[718,973,974,975,977],{},"While Kraft is bound to ",[541,976,543],{},", a request from this machine needs no password or token. Any local process or user can file, start and approve work.",[718,979,980,981,552],{},"Not possible on loopback. See ",[530,982,984],{"href":983},"#out-of-scope","Out of scope",[700,986,987,990,995],{},[718,988,989],{},"Gates",[718,991,992,993,552],{},"Most shipped gates wait for you. See ",[530,994,631],{"href":630},[718,996,997],{},"Require a review on your forge.",[700,999,1000,1003,1008],{},[718,1001,1002],{},"An agent deciding its own gates",[718,1004,1005,1006,552],{},"An unsandboxed worker can. See ",[530,1007,631],{"href":630},[718,1009,1010,1011,1013],{},"Sandbox it with a ",[541,1012,581],{}," policy, and require a review.",[554,1015,1017],{"id":1016},"threat-model","Threat model",[526,1019,1020,1021,1023],{},"Kraft runs on your machine, binds ",[541,1022,543],{}," by default, and edits your\nrepositories through git worktrees using whatever coding agent you have\nconfigured. Six threats shape it:",[694,1025,1026,1039],{},[697,1027,1028],{},[700,1029,1030,1033,1036],{},[703,1031,1032],{},"Threat",[703,1034,1035],{},"What stops it",[703,1037,1038],{},"Section",[713,1040,1041,1059,1079,1095,1107,1121,1142],{},[700,1042,1043,1046,1053],{},[718,1044,1045],{},"A web page in your browser",[718,1047,1048,1049,1052],{},"A loopback bind that checks the ",[541,1050,1051],{},"Host",", no framing, and no images fetched from other sites",[718,1054,1055],{},[530,1056,1058],{"href":1057},"#network-and-browser","Network and browser",[700,1060,1061,1064,1071],{},[718,1062,1063],{},"Another machine on your network",[718,1065,1066,1067,1070],{},"A loopback bind by default; a password, ",[541,1068,1069],{},"allowed_hosts"," and a login throttle when you expose it",[718,1072,1073,941,1075],{},[530,1074,1058],{"href":1057},[530,1076,1078],{"href":1077},"#login","Login",[700,1080,1081,1084,1087],{},[718,1082,1083],{},"An agent acting beyond its own work item",[718,1085,1086],{},"Refused item verbs, a sandbox, and a network policy",[718,1088,1089,941,1091],{},[530,1090,631],{"href":630},[530,1092,1094],{"href":1093},"#workers-and-the-sandbox","Workers and the sandbox",[700,1096,1097,1100,1103],{},[718,1098,1099],{},"A repository's content or settings",[718,1101,1102],{},"Search reads only regular files inside the repository; Settings need the password only off loopback",[718,1104,1105],{},[530,1106,685],{"href":684},[700,1108,1109,1112,1115],{},[718,1110,1111],{},"An add-on you installed, or its next update",[718,1113,1114],{},"A review before anything is written, limits and never permissions, no commands, and a version pinned per work item",[718,1116,1117],{},[530,1118,1120],{"href":1119},"#kraft-add-ons","Kraft add-ons",[700,1122,1123,1130,1137],{},[718,1124,1125,1126,1129],{},"A repository's own ",[541,1127,1128],{},".kraft\u002F"," library",[718,1131,1132,1133,1136],{},"The same limits and review, read from the commit ",[541,1134,1135],{},"origin"," names, and loaded only after a person accepts it",[718,1138,1139],{},[530,1140,388],{"href":1141},"#repo-libraries",[700,1143,1144,1147,1153],{},[718,1145,1146],{},"Text an agent reads that steers it",[718,1148,1149,1150,1152],{},"Nothing filters it. A sandbox with a ",[541,1151,581],{}," policy, a tool policy and the gates limit the damage",[718,1154,1155],{},[530,1156,646],{"href":645},[526,1158,1159,1160,552],{},"What Kraft does not try to protect against is under ",[530,1161,984],{"href":983},[554,1163,646],{"id":1164},"prompt-injection",[526,1166,1167],{},"Everything a worker reads is input to the agent, and text in it can steer\nthe agent. That includes:",[1169,1170,1171,1174,1190],"ul",{},[565,1172,1173],{},"the repository's files, including ones other people wrote;",[565,1175,1176,1177,1181,1182,1185,1186,1189],{},"a ",[530,1178,1180],{"href":1179},"\u002Fconcepts\u002Fvocabulary#work-item","work item","'s title and description, whether a person typed it, a\n",[530,1183,1184],{"href":441},"trigger"," posted it or\n",[530,1187,1188],{"href":335},"auto-intake"," copied it from a bead;",[565,1191,1192],{},"review comments on the merge request, which the feedback loop asks the\nagent to address.",[526,1194,1195,1196,1198,1199,1201,1202,941,1204,1206,1207,1211],{},"Kraft does not filter or sanitize any of it. What limits the damage is what\nlimits any other agent mistake: a\n",[530,1197,538],{"href":347}," with a ",[541,1200,581],{},"\npolicy, a tool policy (",[541,1203,831],{},[541,1205,839],{},"), and the gates, where a\nperson reads the change before it merges. Under the\n",[530,1208,1210],{"href":1209},"#default-posture","default posture",", an injected instruction runs with your\nuser's access.",[526,1213,1214],{},"Do not point Kraft at a repository, a trigger source or a bead\nqueue whose content you do not trust. A sandbox limits what the agent can do,\nbut not what runs as you on the host: Kraft pushes the branch from the host,\nand the repository's own pre-push hook runs then.",[554,1216,984],{"id":1217},"out-of-scope",[526,1219,1220],{},"Kraft does not try to protect against these:",[694,1222,1223,1233],{},[697,1224,1225],{},[700,1226,1227,1230],{},[703,1228,1229],{},"Not protected",[703,1231,1232],{},"Why",[713,1234,1235,1251,1261,1271,1282,1290],{},[700,1236,1237,1240],{},[718,1238,1239],{},"Other users and processes on the same machine",[718,1241,1242,1243,1246,1247,1250],{},"The loopback API has no login, so anyone who can open a connection to it can drive Kraft. ",[541,1244,1245],{},"$KRAFT_HOME\u002Frun"," itself is ",[541,1248,1249],{},"0700",", so other users cannot read the databases and logs in it.",[700,1252,1253,1256],{},[718,1254,1255],{},"An agent running without a sandbox",[718,1257,1258,1259,552],{},"It has your user's access. See ",[530,1260,689],{"href":1209},[700,1262,1263,1266],{},[718,1264,1265],{},"The agent CLI and its provider",[718,1267,1268,1269,552],{},"Kraft runs the CLI you installed. What that CLI sends to its model provider, and what the provider keeps, is between you and the provider. See ",[530,1270,497],{"href":498},[700,1272,1273,1276],{},[718,1274,1275],{},"A repository's own commands",[718,1277,1278,1279,1281],{},"Its ",[541,1280,680],{}," and test commands run with the worker's access, and a pre-push hook runs as you when Kraft pushes the branch.",[700,1283,1284,1287],{},[718,1285,1286],{},"Anyone who has your password or the bearer token",[718,1288,1289],{},"Either one grants full control.",[700,1291,1292,1295],{},[718,1293,1294],{},"The machine and the forge",[718,1296,1297,1298,1301,1302,1305],{},"A compromised OS, container runtime, ",[541,1299,1300],{},"gh"," or ",[541,1303,1304],{},"glab"," login, or git remote is outside what Kraft can check.",[554,1307,1058],{"id":1308},"network-and-browser",[1169,1310,1311,1323,1335,1349,1365],{},[565,1312,1313,948,1316,1319,1320,1322],{},[568,1314,1315],{},"Loopback by default.",[541,1317,1318],{},"kraft admin start"," refuses to bind a non-loopback\naddress without a password set in ",[541,1321,330],{},". There is no way to expose\nthe API or UI on a LAN or the internet without opting in.",[565,1324,1325,1327,1328,1331,1332,552],{},[530,1326,144],{"href":145}," is the recommended way to\nreach the board from a phone or another machine: bind the machine's\nTailscale address. A bare ",[541,1329,1330],{},"--host 0.0.0.0"," also listens on your LAN, and a\nCloudflare Quick Tunnel is the public internet, guarded by the password and\na ",[530,1333,1334],{"href":1077},"login throttle",[565,1336,1337,1340,1341,1344,1345,1348],{},[568,1338,1339],{},"No framing by another site."," Every response carries\n",[541,1342,1343],{},"Content-Security-Policy: frame-ancestors 'self'"," and\n",[541,1346,1347],{},"X-Frame-Options: SAMEORIGIN",". Your browser refuses to show the board inside\na frame on any other site. Without this, a page could hide the board under\nits own content and turn your click into Resume or Approve (clickjacking).\nThat matters most on a loopback bind, where the board needs no login.",[565,1350,1351,948,1354,773,1357,1360,1361,552],{},[568,1352,1353],{},"The API docs pages load nothing unpinned.",[541,1355,1356],{},"\u002Fdocs",[541,1358,1359],{},"\u002Fredoc"," need no\nlogin. Their scripts come from a CDN, each pinned to one release and\nchecked by hash. Their policy lets an image load only from Kraft itself or\ninline, so no other site learns your Kraft's address from them. See\n",[530,1362,1364],{"href":1363},"\u002Freference\u002Fhttp-api#the-schema","The schema",[565,1366,1367,1370,1371,1374,1375,1378,1379,1382,1383,582],{},[568,1368,1369],{},"A document cannot make your browser fetch another site."," Specs, plans,\nnotes, review threads and gate pages are Markdown a worker can write. An\nimage in them shows only when it comes from the board's own address or is\ninline (",[541,1372,1373],{},"data:","). Any other image shows as a link, ",[541,1376,1377],{},"image: host\u002Fpath",", and\nyour browser fetches it only if you click.",[1380,1381],"br",{},"Otherwise a sandboxed worker could put data in an image's URL and have your\nbrowser send it out, past the worker's ",[541,1384,581],{},[1386,1387,1389],"h3",{"id":1388},"host-allowlist","Host allowlist",[526,1391,1392],{},"The rules differ by bind:",[1169,1394,1395,1418,1448,1458,1468,1478],{},[565,1396,1397,1400,1401,941,1403,773,1406,1409,1410,1413,1414,1417],{},[568,1398,1399],{},"A loopback bind"," answers only to ",[541,1402,543],{},[541,1404,1405],{},"localhost",[541,1407,1408],{},"[::1]",", so a\nweb page cannot reach it under another name. A trailing dot\n(",[541,1411,1412],{},"localhost.",") or a longer spelling of ",[541,1415,1416],{},"::1"," is the same name, and is\naccepted too.",[565,1419,1420,1423,1424,1426,1427,1429,1430,1432,1433,941,1436,1439,1440,1443,1444,1447],{},[568,1421,1422],{},"A non-loopback bind"," checks the ",[541,1425,1051],{}," header against ",[541,1428,1069],{}," in\n",[541,1431,330],{}," for every request that carries ",[541,1434,1435],{},"Sec-Fetch-Site",[541,1437,1438],{},"Origin",",\n",[541,1441,1442],{},"Referer"," or a page ",[541,1445,1446],{},"Accept",". That covers every page load and login: a\npassword alone does not authorize an arbitrary hostname.",[565,1449,1450,1451,1453,1454,1457],{},"Each entry is kept in the form the ",[541,1452,1051],{}," is compared in: lowercase, with\nno scheme, port or trailing dot. A wildcard is refused when you save it,\nand ",[541,1455,1456],{},"kraft admin doctor"," names one already in the file.",[565,1459,1460,1461,941,1463,773,1465,1467],{},"This machine's own ",[541,1462,543],{},[541,1464,1405],{},[541,1466,1408],{}," always pass, since\na browser sends them only when it is on this machine.",[565,1469,1470,1471,1474,1475,552],{},"A request with none of those headers, as the CLI, MCP and ",[541,1472,1473],{},"curl"," send,\nneeds no entry. It still needs the password for anything but the\nunauthenticated routes such as ",[541,1476,1477],{},"\u002Fapi\u002Fhealth",[565,1479,1480,1481,1484,1485,1487,1488,1490],{},"The board's live event connection, the ",[541,1482,1483],{},"\u002Fapi\u002Fws\u002Fevents"," WebSocket,\nfollows the same ",[541,1486,1051],{}," rules, and refuses an ",[541,1489,1438],{}," from another site.\nThe board's own page and a page on this machine pass.",[554,1492,631],{"id":1493},"agents-and-gates",[526,1495,1496,1499,1500,1503],{},[568,1497,1498],{},"Which gates wait for you."," The shipped ",[541,1501,1502],{},"default"," chain stops and waits for\nyou to approve the spec and the plan, before it opens a draft merge request,\nand again before it marks it ready. There are two exceptions:",[1169,1505,1506,1509],{},[565,1507,1508],{},"A spec or plan you attach at intake arrives already decided, so its gate is\ndropped.",[565,1510,1511,1512,1515],{},"The ",[541,1513,1514],{},"chain_revision_approval"," gate passes on its own when the revision\nproposes no change, which is the usual case.",[526,1517,1518,1519,1522],{},"If your forge requires a review, the item then waits for that approval before\nit merges. A gate you give an ",[541,1520,1521],{},"auto_review"," task lets that agent's verdict\napprove it.",[526,1524,1525,1526,941,1529,941,1532,941,1535,941,1538,1439,1541,941,1544,941,1547,941,1550,773,1553,1556],{},"The ten item verbs are ",[541,1527,1528],{},"approve",[541,1530,1531],{},"reject",[541,1533,1534],{},"pause",[541,1536,1537],{},"resume",[541,1539,1540],{},"skip",[541,1542,1543],{},"abandon",[541,1545,1546],{},"retry",[541,1548,1549],{},"complete",[541,1551,1552],{},"cancel",[541,1554,1555],{},"escalate",". The rules differ for\na sandboxed worker and an unsandboxed one.",[526,1558,1559],{},[568,1560,1561,1562,1564],{},"A sandboxed worker under a ",[541,1563,581],{}," policy cannot decide its own gates.",[1169,1566,1567,1570,1573],{},[565,1568,1569],{},"It reaches Kraft only through its session's channel, which acts as that\nsession. The channel allows only reads, progress, thread replies and\npermission asks on the worker's own item, and an escalation turn's retry of\nit.",[565,1571,1572],{},"It cannot use any of the ten item verbs on its item, revise its\nattachments, overrides, policy or budget, or file work, whatever it sends.\nAnything else is refused and recorded.",[565,1574,1575,1576,552],{},"A permission hook that gets no answer denies. See\n",[530,1577,356],{"href":357},[526,1579,1580,1586,1587,1589,1590,1593],{},[568,1581,1582,1583,1585],{},"A sandbox with ",[541,1584,591],{}," has no channel, but nothing\nblocks a direct connection."," Without ",[541,1588,581],{}," the container has the\nruntime's default network, which is why Kraft refuses such a launch unless the\nsandbox sets that key. Kraft gives it no channel and no ",[541,1591,1592],{},"kraft"," shim, and it\nadds nothing that stops the container dialing the host. Whether it can reach\nKraft's loopback-bound API depends on the runtime.",[526,1595,1596],{},"If it can, Kraft cannot tell the worker's calls from yours, because the\nloopback API needs no login. Do not count on such a sandbox to keep a worker\nfrom approving its own gate.",[526,1598,1599,1602],{},[568,1600,1601],{},"An unsandboxed worker can, because it runs as you."," It can read Kraft's\ntoken, write Kraft's database and edit its config. No check inside Kraft can\nstop it approving its own gate or starting work it filed.",[526,1604,1605,1608],{},[568,1606,1607],{},"What refuses a worker acting on its own item."," Three checks do, and none\nis a boundary against a worker that is not sandboxed.",[1169,1610,1611,1616,1623],{},[565,1612,1511,1613,1615],{},[541,1614,1592],{}," CLI and the MCP server refuse a worker's item verbs on its own\nitem, and its changes to that item's attachments, overrides, policy and\nbudget. They check this on the client, from the item the worker stands in.",[565,1617,1618,1619,1622],{},"The API refuses the same calls when the request carries the worker's session\nid (",[541,1620,1621],{},"X-Kraft-Session-Id","). A caller that leaves the header off passes.",[565,1624,1625],{},"The review tools are refused by the API from any request that carries a\nsession id, on any item, not only the worker's own.",[526,1627,1511,1628,1630],{},[530,1629,478],{"href":479}," page lists every refusal.",[526,1632,1633,1636,1637,1640,1641,552],{},[568,1634,1635],{},"Filing and starting in one step."," The MCP create tool has no autostart\noption, so everything filed through it lands paused. A person starts it, from\nthe board or by asking their agent to resume it. The server refuses\n",[541,1638,1639],{},"kraft item create --autostart"," (403, nothing filed) from a request that carries\na Kraft session id or the MCP client tag; see\n",[530,1642,1643],{"href":275},[541,1644,1645],{},"kraft item create",[526,1647,1648,1649,1651],{},"The server cannot tell a coding agent that runs\n",[541,1650,1639],{}," in a shell on your machine from you, so that\ncall starts the item. Anyone with a shell can start work this way.",[526,1653,1654,1657,1658,1661,1662,1664,1665,552],{},[568,1655,1656],{},"What this does not stop."," These refusals stop an agent following the normal\npath, not one working around it. If a gate must hold against the agent, follow\nsteps 1, 2 and 4 of ",[530,1659,557],{"href":1660},"#run-it-safely",". See\n",[530,1663,689],{"href":1209}," for why a sandbox is the line, and\n",[530,1666,72],{"href":73},[554,1668,966],{"id":1669},"escalation-turns-can-force-push",[526,1671,1672],{},"An escalation turn is the agent Kraft starts to help with a stopped item. It\ncan commit, rebase and push its item's branch, and a push can be a force-push.",[526,1674,1675,1676,1678,1679,1681,1682,1686,1687,1689],{},"The turn is told to push only that branch, with ",[541,1677,956],{},". Its\n",[541,1680,947],{}," grant is the permission gate's allow for a push to a plain remote\nname whose refspecs all update the item's own branch and nothing else (see\n",[530,1683,1685],{"href":1684},"\u002Freference\u002Fpermissions#grants","Grants","). The grant does not require\n",[541,1688,956],{},": a push without a force flag matches too.",[526,1691,1692,1693,941,1696,1699,1700,1703,1704,1706,1707,1709,1710,552],{},"A plain ",[541,1694,1695],{},"--force",[541,1697,1698],{},"-f"," or a ",[541,1701,1702],{},"+"," refspec does not match the grant, but nothing\nblocks it either. On Claude, the call goes to Claude's classifier, or to the\npermission gate, which allows it when no ",[541,1705,831],{}," is set. On Codex and\nCursor, with no ",[541,1708,831],{},", the gate gives no opinion and the CLI's own\nmode decides. The other harnesses never reach the gate: see\n",[530,1711,689],{"href":1209},[526,1713,1714,1715,1717,1718,1720],{},"In Kraft's gate, only a ",[541,1716,839],{}," entry, an ",[541,1719,831],{}," list that leaves it out, or\n(on Cursor) a write to Kraft's hook file stops a call the grant does not cover.",[526,1722,1723,1724,1727],{},"A grant is the gate's allow only: on Cursor, a hook allow does not outrank\n",[541,1725,1726],{},"--auto-review",", so whether the CLI runs the call is up to Cursor.",[526,1729,1730,1731,1735,1736,1740,1741,1745,1746,1749,1750,1753],{},"Kraft starts a turn by itself when an item gets ",[530,1732,1734],{"href":1733},"\u002Fconcepts\u002Fvocabulary#stuck","stuck",": a task still failing\nafter recovery and the ",[530,1737,1739],{"href":1738},"\u002Fconcepts\u002Fvocabulary#fix-loop","fix loop",", or a fix loop that hits its cap, stalls on\nfindings that stop changing, or whose ",[530,1742,1744],{"href":1743},"\u002Fconcepts\u002Fvocabulary#judge","judge","\nstops it. This is ",[541,1747,1748],{},"auto_escalate_stuck",", on by default, up to three times by\ndefault (",[541,1751,1752],{},"auto_escalate_stuck_cap","). Config errors, budget and time caps,\ninfrastructure failures, wait timeouts and a worker's question are not\nanswered this way.",[526,1755,1756,1757,941,1759,773,1761,1763],{},"The turn holds the ",[541,1758,940],{},[541,1760,944],{},[541,1762,947],{}," grants:",[1169,1765,1766,1775],{},[565,1767,1768,1769,1771,1772,1774],{},"A grant is allowed even under an ",[541,1770,831],{}," list. Only ",[541,1773,839],{},"\noverrides it.",[565,1776,1777],{},"A grant does not stop git's own hooks, which the agent can edit.",[526,1779,1780],{},"The turn runs as a person's session, not a worker's. The CLI does not treat it\nas a worker acting on its own item. The API refuses it, by its session id, only\nthe calls listed further down. A turn that is not\nsandboxed can:",[1169,1782,1783,1786,1789],{},[565,1784,1785],{},"Complete, cancel or abandon the item.",[565,1787,1788],{},"Change its agent overrides, and the overrides of a node that has not\nstarted.",[565,1790,1791,1792,1795],{},"Ask for a retry of a ",[541,1793,1794],{},"needs_human"," item, which Kraft performs once the turn\nends.",[526,1797,1798,1799,1801,1802,1805],{},"A sandboxed turn under a ",[541,1800,581],{}," policy has only its session's channel, as\n",[530,1803,1804],{"href":630},"a sandboxed worker"," does. Of the calls above, the channel\ncarries the retry and nothing else.",[526,1807,1808],{},"The turn's prompt tells it not to skip or abandon the item, and to give you\nthe command instead. That is an instruction, not a check: no check stops an\nabandon from a turn that is not sandboxed. Kraft's own prompt does not mention\ncomplete or cancel.",[526,1810,1811],{},"While a turn runs, the API answers 409 to these calls on its item, whoever\nmakes them:",[1169,1813,1814,1817,1820],{},[565,1815,1816],{},"Skip, resume and a second escalation, the turn's own calls included.",[565,1818,1819],{},"Pause, because the item is stopped and pause takes only a running one.",[565,1821,1822],{},"A change to its attachments, because the item has started.",[526,1824,1825],{},"Those depend on the item's state, not on who is calling.",[526,1827,1828],{},"The API also refuses the turn a few calls by its session: approve and reject,\nraising the budget, changing the budget or policy, and a reviewer's calls. A\ngate, a review and a spending cap are a person's decision.",[526,1830,1831],{},"A reviewer's calls are opening, editing, deleting, resolving or reopening a\nthread, adding, editing or deleting a comment, and submitting a review. A turn\ncan still reply to a thread.",[526,1833,1834,1835,1837],{},"Those refusals apply when the call carries a session id. The check\nreads the ",[541,1836,1621],{}," header and is a consistency check, not a security\nboundary. A turn that is not sandboxed can leave the header off.",[526,1839,730,1840,1842,1843,1845,1846,1848,1849,1851,1852,1854,1855,1857],{},[541,1841,961],{}," in ",[541,1844,318],{}," to remove the grants.\nThat removes the gate's allow only. On Claude, the turn's pushes then go to\nClaude's classifier, or to the permission gate, which allows them when no\n",[541,1847,831],{}," is set. On Codex and Cursor, with no ",[541,1850,831],{},", the CLI's\nown mode decides them: the gate gives no opinion, or is not asked at all when\nno ",[541,1853,839],{}," is set and no grant but ",[541,1856,940],{}," is left.",[554,1859,1094],{"id":1860},"workers-and-the-sandbox",[526,1862,1863,1866,1867,1869,1870,552],{},[568,1864,1865],{},"A worker's environment is allowlisted, not inherited."," It does not take\nwhatever the server's own shell had set. A repository's ",[541,1868,300],{}," entry adds\nwhat it declares. See\n",[530,1871,380],{"href":381},[526,1873,1874],{},[568,1875,1876],{},"A sandbox bounds what a worker writes, and with a network policy what it\nreaches.",[1169,1878,1879,1882,1905,1908],{},[565,1880,1881],{},"A sandboxed worker cannot move a branch in your repository other than its\nown.",[565,1883,1884,1885,1889,1890,1892,1893,1896,1897,1900,1901,1904],{},"A tool policy Kraft cannot enforce for that ",[530,1886,1888],{"href":1887},"\u002Fconcepts\u002Fvocabulary#harness","harness"," in the sandbox refuses\nthe launch. Where it is enforced, an ",[541,1891,831],{}," list on Claude runs in\n",[541,1894,1895],{},"manual"," mode, and Claude then runs read-only shell commands such as ",[541,1898,1899],{},"cat","\nwithout asking Kraft's gate, if ",[541,1902,1903],{},"Bash"," is in the list.",[565,1906,1907],{},"Of Kraft's results folder it sees only its own work item's files,\nread-only, and writes only its own result file. Another item's diff,\nfindings and instructions are not in the container.",[565,1909,1910],{},"Git state it plants in its worktree, such as a HEAD naming another branch\nor a rebase or merge in progress, stops the item for you. Kraft never\ncommits, rebases or aborts over it.",[526,1912,1913],{},[568,1914,1915],{},"What it reaches.",[1169,1917,1918,1931,1934,1939],{},[565,1919,1920,1921,1924,1925,1927,1928,1930],{},"Without a ",[541,1922,1923],{},"network"," policy its network is not restricted, and on a cloud VM\nthe metadata address is reachable. Kraft refuses the launch unless the\nsandbox sets ",[541,1926,591],{},", and ",[541,1929,1456],{}," reports\nthe sandbox either way.",[565,1932,1933],{},"With one, the worker has only loopback and reaches out only through Kraft's\nown proxy, on a channel that is its session's alone. Only the hosts the\npolicy allows are reachable. Loopback, link-local, unspecified and multicast\naddresses, cloud metadata and the addresses the host's own name resolves to\nnever are. Another non-public address, such as an RFC 1918 one, is reachable\nonly when an allow entry names its host exactly. Refusals are recorded.",[565,1935,1936,1937,552],{},"On Docker Desktop and Podman machine that channel is a mutual-TLS connection,\nand a session's certificate expires after seven days, so a longer session\nfails closed. See ",[530,1938,360],{"href":361},[565,1940,1941],{},"The limit: the allow list is enforced on the requested name and the dialed\naddress. So an allowed name on a shared CDN address can reach other names\nthat address serves (domain fronting). Through an upstream proxy, the\nupstream resolves the name again, so the checked address is not necessarily\nthe one reached.",[526,1943,1944,1950,1951,1953,1954,1956,1957,1961,1962,773,1964,1966],{},[568,1945,1946,1947,1949],{},"A variable listed under ",[541,1948,792],{}," never enters the container."," It needs\na ",[541,1952,581],{}," policy: a sandbox policy that lists ",[541,1955,792],{}," without one is\nrefused when it loads. The container holds a ",[530,1958,1960],{"href":1959},"\u002Fconcepts\u002Fvocabulary#sentinel","sentinel"," in its place, and the\nproxy holds the real value in memory. Other variables are not covered:\n",[541,1963,780],{},[541,1965,783],{}," are forwarded into the\ncontainer unless you list them.",[526,1968,1969],{},"The proxy injects a credential only for a host the allow list names exactly. A\nhost reached only through a wildcard is a blind tunnel, where the worker sees\nonly the sentinel.",[526,1971,1972],{},"For the credential's host the proxy terminates TLS, with a\ncertificate from Kraft's CA, which such a container trusts. It verifies the\nreal host against the server's own roots plus the sandbox's extra CA, and\nreplaces the sentinel in the declared header. It refuses any request that does\nnot carry the sentinel.",[526,1974,1975,1976,552],{},"The limits: HTTP\u002F1.1 only, no upgrade to a managed host, and a host that\nechoed the key in its response would hand it to the worker. See\n",[530,1977,364],{"href":365},[526,1979,1980,1988,1989,552],{},[568,1981,1982,1983,1987],{},"A sandbox covers a ",[530,1984,1986],{"href":1985},"\u002Fconcepts\u002Fvocabulary#workspace","workspace","'s members as it covers the root."," Each member\nis checked out from its connected repository, never from a git directory the\nworker can write. The files host git trusts for it are read-only in the\ncontainer. A member Kraft did not check out, or one a worker swapped, stops\nthe item before host git runs in it. See\n",[530,1990,314],{"href":1991},"\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fgit-in-a-sandbox#workspace-members",[526,1993,1994,2002,2003,2006],{},[568,1995,1996,1997,2001],{},"A ",[530,1998,2000],{"href":1999},"\u002Fconcepts\u002Fvocabulary#kit","Kit"," runs only what Kraft enforces."," A ",[541,2004,2005],{},"kind: kit"," sandbox runs a Kit\npinned by digest whose descriptor decodes strictly. Kraft lowers the Kit onto\nthe same Docker sandbox: its network lists, credentials and limits alone, with\nno harness host added.",[1169,2008,2009,2012,2018],{},[565,2010,2011],{},"A required capability Kraft does not enforce stops the item naming it\nbefore anything runs, and an optional one is skipped and recorded.",[565,2013,2014,2015,2017],{},"A Kit credential's value comes only from the server variable ",[541,2016,372],{},"\nbinds to its service, never from a variable the Kit names.",[565,2019,2020,2021,552],{},"Kraft reads one Kit you wrote. A Kit that needs a capability Kraft does not\nenforce is refused, as Docker's published ones are. See\n",[530,2022,368],{"href":369},[554,2024,685],{"id":2025},"files-and-settings",[1169,2027,2028,2052,2066,2075,2083,2098],{},[565,2029,2030,2033,2034,2037,2038,2041,2042,552,2046,2048,2049,2051],{},[568,2031,2032],{},"The permission hook imports nothing from the worktree."," Cursor runs the\nhook from the worktree, which the worker writes, with the worker's\nenvironment. Kraft starts it with Python's ",[541,2035,2036],{},"-I",", so neither the current\ndirectory nor a ",[541,2039,2040],{},"PYTHONPATH"," is on its import path. A file in the worktree\nnamed like a module Kraft imports cannot run in its place and answer the\nhook. See ",[530,2043,2045],{"href":2044},"\u002Freference\u002Fpermissions#cursor","Cursor",[1380,2047],{},"This does not protect Kraft's own install: an unsandboxed worker can change\nthat as it can any file your user owns (see\n",[530,2050,689],{"href":1209},").",[565,2053,2054,2057,2058,2061,2062,2065],{},[568,2055,2056],{},"Search indexes only files inside the repository."," Kraft indexes the\nMarkdown files git tracks under a repository's ",[541,2059,2060],{},".engineering\u002F",". It skips a\nsymlink, wherever it points, and anything else that is not a regular file.\nA repository cannot commit a link to a file outside it, such as a token in\nyour home directory, and have search hand that file to you or your agent.\nThe scan also never runs a ",[541,2063,2064],{},"core.fsmonitor"," program the repository's own git\nconfig names.",[565,2067,2068,2071,2072,552],{},[568,2069,2070],{},"A worker's session summary is read only from its own worktree."," It is read\nonly if it is a Markdown file, so a worker cannot point search at a file\nsuch as your checkout's ",[541,2073,2074],{},".env",[565,2076,2077,2080,2081,552],{},[568,2078,2079],{},"An add-on changes what agents are told."," See ",[530,2082,1120],{"href":1119},[565,2084,2085,2088,2089,2091,2092,2094,2095,2097],{},[568,2086,2087],{},"Settings can change what the server runs."," A harness profile's\n",[541,2090,676],{}," (Settings › Harnesses) is the program every agent launch on\nthat harness profile starts. A repository's ",[541,2093,680],{}," (Settings › Repos) runs\nin every new worktree.",[1380,2096],{},"Both are editable by anyone who can open the Settings pages. On a loopback\nbind, a request from this machine needs no password, so anyone with access\nto this machine can change them. Off loopback, the access password\n(Settings › Access) guards command execution, not only configuration. Keep\nthe bind on loopback or behind the access password, and review these fields\nafter anyone else has had access.",[565,2099,2100,2106,2107,552],{},[568,2101,2102,2105],{},[541,2103,2104],{},"install.sh"," is a shell script fetched and piped from the internet."," It\nis short by design: read it before you run it,\n",[530,2108,2112],{"href":2109,"rel":2110},"https:\u002F\u002Fgithub.com\u002FitsOmidKarami\u002Fkraft\u002Fblob\u002Fmain\u002Finstall.sh",[2111],"nofollow",[541,2113,2104],{},[554,2115,1120],{"id":2116},"kraft-add-ons",[526,2118,1996,2119,2123],{},[530,2120,2122],{"href":2121},"\u002Fconcepts\u002Fvocabulary#add-on","Kraft add-on"," is configuration someone\nelse wrote: chains, prompts, skills and agent profiles that your instance runs.\nKraft changes what an instance runs only after you accept a review, and it\nnever lets an add-on change what a run may do.",[526,2125,2126,2129],{},[568,2127,2128],{},"What an add-on cannot change."," Kraft refuses an add-on that tries, at\nvalidate, install and update:",[1169,2131,2132,2145,2177,2186],{},[565,2133,2134,2002,2137,2140,2141,2144],{},[568,2135,2136],{},"It runs no command.",[541,2138,2139],{},"subprocess"," task is refused: a shell command runs\noutside the ",[530,2142,2143],{"href":437},"permission gate"," an agent works under.",[565,2146,2147,2150,2151,2154,2155,2157,2158,941,2160,941,2162,1344,2164,2167,2168,773,2170,2172,2173,2176],{},[568,2148,2149],{},"It grants no permission."," Its ",[541,2152,2153],{},"policy:"," blocks take limits only: time,\nattempts, budget and ",[541,2156,839],{},". ",[541,2159,831],{},[541,2161,952],{},[541,2163,538],{},[541,2165,2166],{},"allowed_harnesses"," stay in your ",[541,2169,318],{},[541,2171,300],{},", and a limit\nabove your ",[541,2174,2175],{},"maxima:"," is refused.",[565,2178,2179,2182,2183,2185],{},[568,2180,2181],{},"It picks no executable."," It cannot define a harness profile. Its tasks\nrun only on harness profiles your ",[541,2184,326],{}," defines and its manifest\nlists.",[565,2187,2188,2191,2192,2194],{},[568,2189,2190],{},"It reaches nothing of yours by name."," Its content sits under its own\nnamespace, a bare name in your files never resolves to it, and ",[541,2193,1592],{}," is\nreserved.",[526,2196,2197,2200],{},[568,2198,2199],{},"What an add-on does change."," It decides what the agent is told, and which\ngates, merge steps, models and limits its chains have. A prompt, a steering\nprofile and a skill are instructions the agent follows with whatever tools\nyour instance allows.",[526,2202,2203,2204,2206,2207,941,2209,2211,2212,552],{},"Under the ",[530,2205,1210],{"href":1209},", a prompt\nthat says to run a command is about as strong as a command task. Set\n",[541,2208,2175],{},[541,2210,831],{}," and a sandbox before you install an add-on from\npeople you do not fully trust: see\n",[530,2213,2215],{"href":2214},"\u002Fguides\u002Fcustomize\u002Fshare-chains-with-addons#bound-what-an-add-ons-agents-may-do","Bound what an add-on's agents may do",[526,2217,2218],{},[568,2219,2220],{},"Nothing changes without a review.",[1169,2222,2223,2226,2229,2236],{},[565,2224,2225],{},"An install or update prints what would change, leading with what can change\nhow far a run goes, and writes nothing until you accept it.",[565,2227,2228],{},"A file that carries a control or Unicode format character is refused, and\nthe review writes any such character out, so text cannot hide from you\nwhile a model still reads it.",[565,2230,2231,2232,2235],{},"The library loads an add-on only from the commit and digest in\n",[541,2233,2234],{},"addons.lock",". A stored add-on whose files no longer match is not loaded.",[565,2237,2238],{},"A work item keeps the add-on version it was filed with until it ends.",[526,2240,2241,2244,2245,2248],{},[568,2242,2243],{},"Auto-update is off unless you turn it on."," It applies an update whose\nreview has no ",[568,2246,2247],{},"Reach"," line, so a new version that changes only a prompt or a\nskill is applied with no one reading it. It holds for you a removed gate, a\nmerge step, a changed harness, model or agent profile, a raised limit, a\ncollection moved to another URL, a downgrade and a pre-release.",[526,2250,2251,2253,2254,2256,2257,941,2259,2261,2262,552],{},[541,2252,1456],{}," warns when an add-on auto-updates and\n",[541,2255,318],{}," sets none of ",[541,2258,2175],{},[541,2260,831],{}," and a sandbox. See\n",[530,2263,2265],{"href":2264},"\u002Freference\u002Fconfiguration\u002Faddons#auto-update","Auto-update",[526,2267,2268,2271,2272,2276,2277,2280,2281,552],{},[568,2269,2270],{},"Fetching a collection runs none of its code."," Kraft fetches into a bare\nmirror, never checks out a working tree, runs no hook and never prompts for a\nlogin. It reads only the add-on's own files, within\n",[530,2273,2275],{"href":2274},"\u002Freference\u002Fconfiguration\u002Faddons#size-and-content-limits","size and content limits",".\nAn ",[541,2278,2279],{},"https"," URL with credentials in it is refused in ",[541,2282,2283],{},"addons.yaml",[526,2285,2286,2292,2293,2295,2296,2298,2299,2302,2303,2305],{},[568,2287,2288,2289,552],{},"The lock is trusted like the rest of ",[541,2290,2291],{},"config\u002F"," Restoring an add-on from an\n",[541,2294,2234],{}," you copied is not a review: Kraft takes the commit the lock\nnames. A ",[530,2297,587],{"href":586}," is refused the\n",[541,2300,2301],{},"kraft admin addon"," verbs that change add-ons, but an unsandboxed worker can\nedit ",[541,2304,2291],{}," as it can any file your user owns.",[554,2307,388],{"id":2308},"repo-libraries",[526,2310,1996,2311,2315,2316,2318],{},[530,2312,2314],{"href":2313},"\u002Fconcepts\u002Fvocabulary#repo-library","repo library"," is the same content as an\nadd-on, under the same limits: limits and never permissions, no command, no\nharness. Kraft reads it from the commit ",[541,2317,1135],{}," names as the default branch's\nhead, never from a branch, working tree or worktree of your checkout, and it\nloads only after you accept a review.",[1169,2320,2321,2338,2347,2357,2366],{},[565,2322,2323,948,2326,2329,2330,2333,2334,2337],{},[568,2324,2325],{},"A first load is always a person's.",[541,2327,2328],{},"kraft repo connect"," in a terminal asks.\n",[541,2331,2332],{},"-y",", no terminal, the web UI and an agent's ",[541,2335,2336],{},"ensure_repo"," never accept one.",[565,2339,2340,2343,2344,552],{},[568,2341,2342],{},"A change waits."," The server checks each accepted library after a start and\nonce a day, reports a change as waiting, and applies nothing. You take it with\n",[541,2345,2346],{},"kraft repo library",[565,2348,2349,2352,2353,2356],{},[568,2350,2351],{},"Opting in trusts what the merge says."," With ",[541,2354,2355],{},"library_auto_update: true"," on\nthe repository's entry, a change that alters only prompt text, gate messages,\ndescriptions, and skills and steering no deciding task reads is taken without\nyou. That trusts whoever can merge to the default branch, Kraft's own merges\nincluded, with what the repository's agents are told.",[565,2358,2359,2362,2363,2365],{},[568,2360,2361],{},"Everything else still waits."," A change of structure, route, limit or gate,\na new chain, and the text a gate's own reviewer reads wait for you. Anything\nthat can write ",[541,2364,300],{}," or reach the API can set the key.",[565,2367,2368,2371,2372,2374,2375,2378,2379,2382,2383,2385,2386,552],{},[568,2369,2370],{},"A worker with no sandbox runs with your access."," It can rewrite the\ncheckout's ",[541,2373,1135],{}," URL, or ",[541,2376,2377],{},"repo-libraries.lock"," itself. A sandboxed worker\ncannot reach ",[541,2380,2381],{},"$KRAFT_HOME\u002Fconfig"," or the remote's default branch. Refusing the\n",[541,2384,2346],{}," verb to a worker is a convention, as it is for\n",[541,2387,2301],{},[526,2389,2390],{},"Whoever can merge to the default branch decides what the next accept shows\nyou. Read the review before you take it, as you do an add-on's.",[554,2392,663],{"id":2393},"the-bearer-token",[526,2395,2396,2399,2400,2403,2404,552],{},[541,2397,2398],{},"$KRAFT_HOME\u002Frun\u002Fmcp-token"," is a full-admin credential. A request that\ncarries it as ",[541,2401,2402],{},"Authorization: Bearer \u003Ctoken>"," passes the login check on every\nroute: it can file, start, approve and cancel work, and change settings. It is\nnot limited to ",[541,2405,2406],{},"\u002Fapi\u002Ftriggers",[526,2408,2409,2412,2413,2416,2417,2420,2421,2423,2424,2426],{},[541,2410,2411],{},"$KRAFT_HOME\u002Frun\u002Ftrigger-token"," is the one to hand out. It passes the login\ncheck on ",[541,2414,2415],{},"POST \u002Fapi\u002Ftriggers"," only, so its holder can file work, which lands\npaused, and nothing else. On any other route Kraft treats it as no credential\nand answers ",[541,2418,2419],{},"401",". The ",[541,2422,658],{}," works on ",[541,2425,2415],{}," too.",[1169,2428,2429,2446,2451],{},[565,2430,2431,2432,2435,2436,2438,2439,1301,2442,2445],{},"Kraft creates both files with mode ",[541,2433,2434],{},"0600"," on first start and keeps them after\nthat. ",[541,2437,1456],{}," fails its ",[541,2440,2441],{},"mcp token",[541,2443,2444],{},"trigger token"," check if\nthe file's mode gives anyone but you any access.",[565,2447,1511,2448,2450],{},[541,2449,1592],{}," CLI and the MCP server read the file on every call, so they\nneed no setup.",[565,2452,2453,2454,552],{},"To rotate either, follow ",[530,2455,2457],{"href":2456},"\u002Fguides\u002Frun\u002Fremote-access#rotate-the-token","Rotate the token",[2459,2460,2461,2462,2464,2465,2467,2468,2470],"warning",{},"Give CI systems and webhook senders the ",[541,2463,654],{},", never the\n",[541,2466,658],{},". Anyone with the ",[541,2469,658],{}," has full control of this Kraft\ninstance and of the work it runs in your repos.",[554,2472,1078],{"id":2473},"login",[526,2475,2476,2477,2479,2480,941,2483,2486,2487,2489],{},"Remote access uses a password, stored in ",[541,2478,330],{}," as a salted scrypt\nhash. A successful login sets an ",[541,2481,2482],{},"HttpOnly",[541,2484,2485],{},"SameSite=Lax"," session cookie.\n",[530,2488,144],{"href":145}," shows how to set it up.",[1169,2491,2492,2506,2519,2525],{},[565,2493,2494,2497,2498,2501,2502,2505],{},[568,2495,2496],{},"Failed logins are throttled per client address."," After 5 wrong passwords\nfrom one address within 15 minutes, Kraft answers that address ",[541,2499,2500],{},"429"," with a\n",[541,2503,2504],{},"Retry-After"," header. It does so even for the right password, until 15\nminutes have passed since the last failure. A successful login clears the\ncount. The counts live in memory, so a restart clears them too.",[565,2507,2508,2511,2512,2515,2516,2518],{},[568,2509,2510],{},"The address is the one Kraft sees."," A proxy or tunnel on the same machine\ncan name the real client in ",[541,2513,2514],{},"X-Forwarded-For",". Kraft believes that header\nonly from ",[541,2517,543],{},", so a remote caller cannot pick its own address.",[565,2520,2521,2524],{},[568,2522,2523],{},"A tunnel that sends no such header makes the throttle global."," Every\nvisitor looks like the same address, so 5 wrong guesses from anyone lock\neveryone out for 15 minutes. That still guards the password, but use a long\nrandom one before you expose the board anywhere.",[565,2526,2527,2534,2535,2538,2539,2541],{},[568,2528,2529,2530,2533],{},"The cookie is ",[541,2531,2532],{},"Secure"," over HTTPS."," When the login request arrives over\nHTTPS, or carries the ",[541,2536,2537],{},"X-Forwarded-Proto: https"," a tunnel sets, the cookie is\nmarked ",[541,2540,2532],{}," and the browser never sends it over plain HTTP. A login over\nplain HTTP, such as loopback or Tailscale, gets a cookie without it.",[554,2543,551],{"id":2544},"reporting-a-vulnerability",[526,2546,2547,2548,2553,2554,2559,2560,552],{},"Report vulnerabilities privately, not in a public issue. Use\n",[530,2549,2552],{"href":2550,"rel":2551},"https:\u002F\u002Fgithub.com\u002FitsOmidKarami\u002Fkraft\u002Fsecurity\u002Fadvisories\u002Fnew",[2111],"GitHub private reporting",",\nas described in\n",[530,2555,2558],{"href":2556,"rel":2557},"https:\u002F\u002Fgithub.com\u002FitsOmidKarami\u002Fkraft\u002Fblob\u002Fmain\u002FSECURITY.md",[2111],"SECURITY.md",".\nOnly the latest release gets security fixes: see\n",[530,2561,2563],{"href":2562},"\u002Fproject\u002Fstatus-and-support#supported-versions","Supported versions",[554,2565,2567],{"id":2566},"related","Related",[1169,2569,2570,2575,2580,2585],{},[565,2571,2572,2574],{},[530,2573,497],{"href":498},": what leaves your machine and where Kraft keeps secrets.",[565,2576,2577,2579],{},[530,2578,436],{"href":437},": what the permission gate allows each harness to do.",[565,2581,2582,2584],{},[530,2583,346],{"href":347},": how to run agents in a container.",[565,2586,2587,2589],{},[530,2588,144],{"href":145},": how to reach the board from another device.",{"title":2591,"searchDepth":2592,"depth":2592,"links":2593},"",2,[2594,2595,2596,2597,2598,2599,2603,2604,2606,2607,2608,2610,2611,2612,2613,2614],{"id":556,"depth":2592,"text":557},{"id":688,"depth":2592,"text":689},{"id":1016,"depth":2592,"text":1017},{"id":1164,"depth":2592,"text":646},{"id":1217,"depth":2592,"text":984},{"id":1308,"depth":2592,"text":1058,"children":2600},[2601],{"id":1388,"depth":2602,"text":1389},3,{"id":1493,"depth":2592,"text":631},{"id":1669,"depth":2592,"text":2605},"Escalation turns can force-​push",{"id":1860,"depth":2592,"text":1094},{"id":2025,"depth":2592,"text":685},{"id":2116,"depth":2592,"text":2609},"Kraft add-​ons",{"id":2308,"depth":2592,"text":388},{"id":2393,"depth":2592,"text":663},{"id":2473,"depth":2592,"text":1078},{"id":2544,"depth":2592,"text":551},{"id":2566,"depth":2592,"text":2567},"What Kraft does on your machine, the few settings that make it safe to run, and the threat model behind them: what it protects against and what it does not.","md",null,{},true,{"title":493,"description":2615},"pu6Wksp6JNUC2dpAHQxTa36CXhGH9EeRKDSQlS2vp2Y",[2623,2625],{"title":10,"path":487,"stem":491,"description":2624,"children":-1},"Security, data and privacy, release news, status and support, architecture, and how to contribute.",{"title":497,"path":498,"stem":499,"description":2626,"children":-1},"What leaves your machine, where it goes, how to turn it off, and where Kraft keeps secrets and state.",1791801169377]