[{"data":1,"prerenderedAt":863},["ShallowReactive",2],{"navigation_docs":3,"-reference-configuration-sandbox-callbacks":520,"-reference-configuration-sandbox-callbacks-surround":858},[4,28,51,191,222,485],{"title":5,"path":6,"stem":7,"children":8},"Get started","\u002Fget-started","1.get-started",[9,12,16,20,24],{"title":10,"path":6,"stem":11},"Overview","1.get-started\u002Findex",{"title":13,"path":14,"stem":15},"Why Kraft","\u002Fget-started\u002Fwhy-kraft","1.get-started\u002F0.why-kraft",{"title":17,"path":18,"stem":19},"Install","\u002Fget-started\u002Finstall","1.get-started\u002F1.install",{"title":21,"path":22,"stem":23},"Your first work item","\u002Fget-started\u002Ffirst-work-item","1.get-started\u002F2.first-work-item",{"title":25,"path":26,"stem":27},"FAQ","\u002Fget-started\u002Ffaq","1.get-started\u002F3.faq",{"title":29,"path":30,"stem":31,"children":32},"Concepts","\u002Fconcepts","2.concepts",[33,35,39,43,47],{"title":10,"path":30,"stem":34},"2.concepts\u002Findex",{"title":36,"path":37,"stem":38},"How a work item runs","\u002Fconcepts\u002Fhow-a-work-item-runs","2.concepts\u002F1.how-a-work-item-runs",{"title":40,"path":41,"stem":42},"Caps and budgets","\u002Fconcepts\u002Fcaps-and-budgets","2.concepts\u002F2.caps-and-budgets",{"title":44,"path":45,"stem":46},"Why a permission gate","\u002Fconcepts\u002Fpermission-gate","2.concepts\u002F3.permission-gate",{"title":48,"path":49,"stem":50},"Vocabulary","\u002Fconcepts\u002Fvocabulary","2.concepts\u002F4.vocabulary",{"title":52,"path":53,"stem":54,"children":55},"Guides","\u002Fguides","3.guides",[56,58,96,117,138,187],{"title":10,"path":53,"stem":57},"3.guides\u002Findex",{"title":59,"path":60,"stem":61,"children":62,"page":95},"Day to day","\u002Fguides\u002Fday-to-day","3.guides\u002F1.day-to-day",[63,67,71,75,79,83,87,91],{"title":64,"path":65,"stem":66},"The setup wizard on first start","\u002Fguides\u002Fday-to-day\u002Ffirst-run","3.guides\u002F1.day-to-day\u002F2.first-run",{"title":68,"path":69,"stem":70},"File a work item","\u002Fguides\u002Fday-to-day\u002Ffile-a-work-item","3.guides\u002F1.day-to-day\u002F3.file-a-work-item",{"title":72,"path":73,"stem":74},"Use Kraft from your agent","\u002Fguides\u002Fday-to-day\u002Fagent-integration","3.guides\u002F1.day-to-day\u002F4.agent-integration",{"title":76,"path":77,"stem":78},"Reviewing a change","\u002Fguides\u002Fday-to-day\u002Freview-a-change","3.guides\u002F1.day-to-day\u002F5.review-a-change",{"title":80,"path":81,"stem":82},"Raise a cap on a stopped item","\u002Fguides\u002Fday-to-day\u002Fraise-a-cap","3.guides\u002F1.day-to-day\u002F6.raise-a-cap",{"title":84,"path":85,"stem":86},"Kraft for VS Code","\u002Fguides\u002Fday-to-day\u002Fvscode","3.guides\u002F1.day-to-day\u002F7.vscode",{"title":88,"path":89,"stem":90},"Kraft on a phone","\u002Fguides\u002Fday-to-day\u002Fkraft-on-a-phone","3.guides\u002F1.day-to-day\u002F8.kraft-on-a-phone",{"title":92,"path":93,"stem":94},"Get notified when an item needs you","\u002Fguides\u002Fday-to-day\u002Fnotifications","3.guides\u002F1.day-to-day\u002F9.notifications",false,{"title":97,"path":98,"stem":99,"children":100,"page":95},"Customize and automate","\u002Fguides\u002Fcustomize","3.guides\u002F2.customize",[101,105,109,113],{"title":102,"path":103,"stem":104},"Write your own chain","\u002Fguides\u002Fcustomize\u002Fwrite-your-own-chain","3.guides\u002F2.customize\u002F1.write-your-own-chain",{"title":106,"path":107,"stem":108},"Add a security review or a gate reviewer","\u002Fguides\u002Fcustomize\u002Fadd-review-agents","3.guides\u002F2.customize\u002F2.add-review-agents",{"title":110,"path":111,"stem":112},"Schedule or webhook work","\u002Fguides\u002Fcustomize\u002Fschedule-and-webhook-work","3.guides\u002F2.customize\u002F3.schedule-and-webhook-work",{"title":114,"path":115,"stem":116},"Share chains with add-ons","\u002Fguides\u002Fcustomize\u002Fshare-chains-with-addons","3.guides\u002F2.customize\u002F4.share-chains-with-addons",{"title":118,"path":119,"stem":120,"children":121,"page":95},"Agents and harnesses","\u002Fguides\u002Fharnesses","3.guides\u002F3.harnesses",[122,126,130,134],{"title":123,"path":124,"stem":125},"Switch a task to another harness","\u002Fguides\u002Fharnesses\u002Fswitch-harness","3.guides\u002F3.harnesses\u002F1.switch-harness",{"title":127,"path":128,"stem":129},"Add or override a harness","\u002Fguides\u002Fharnesses\u002Fadding-a-harness","3.guides\u002F3.harnesses\u002F2.adding-a-harness",{"title":131,"path":132,"stem":133},"Build a worker Kit","\u002Fguides\u002Fharnesses\u002Fworker-kit","3.guides\u002F3.harnesses\u002F3.worker-kit",{"title":135,"path":136,"stem":137},"Give a worker its login","\u002Fguides\u002Fharnesses\u002Fgive-a-worker-its-login","3.guides\u002F3.harnesses\u002F4.give-a-worker-its-login",{"title":139,"path":140,"stem":141,"children":142,"page":95},"Run the server","\u002Fguides\u002Frun","3.guides\u002F4.run",[143,147,151,155,159,163,167,171,175,179,183],{"title":144,"path":145,"stem":146},"Remote access","\u002Fguides\u002Frun\u002Fremote-access","3.guides\u002F4.run\u002F01.remote-access",{"title":148,"path":149,"stem":150},"Put a proxy in front of Kraft","\u002Fguides\u002Frun\u002Fput-a-proxy-in-front-of-kraft","3.guides\u002F4.run\u002F02.put-a-proxy-in-front-of-kraft",{"title":152,"path":153,"stem":154},"Restart Kraft without ending running agents","\u002Fguides\u002Frun\u002Frestart-kraft","3.guides\u002F4.run\u002F03.restart-kraft",{"title":156,"path":157,"stem":158},"Back up and restore the database","\u002Fguides\u002Frun\u002Fback-up-and-restore","3.guides\u002F4.run\u002F04.back-up-and-restore",{"title":160,"path":161,"stem":162},"Logs and disk space","\u002Fguides\u002Frun\u002Flogs-and-disk-space","3.guides\u002F4.run\u002F05.logs-and-disk-space",{"title":164,"path":165,"stem":166},"Run Kraft as a service","\u002Fguides\u002Frun\u002Frun-as-a-service","3.guides\u002F4.run\u002F06.run-as-a-service",{"title":168,"path":169,"stem":170},"Upgrade Kraft","\u002Fguides\u002Frun\u002Fupgrade-kraft","3.guides\u002F4.run\u002F07.upgrade-kraft",{"title":172,"path":173,"stem":174},"Upgrade your configuration","\u002Fguides\u002Frun\u002Fupgrade-your-configuration","3.guides\u002F4.run\u002F08.upgrade-your-configuration",{"title":176,"path":177,"stem":178},"Upgrade from 1.4","\u002Fguides\u002Frun\u002Fupgrade-from-1-4","3.guides\u002F4.run\u002F09.upgrade-from-1-4",{"title":180,"path":181,"stem":182},"Upgrade from 0.x or a release candidate","\u002Fguides\u002Frun\u002Fupgrade-from-0-x-or-a-release-candidate","3.guides\u002F4.run\u002F10.upgrade-from-0-x-or-a-release-candidate",{"title":184,"path":185,"stem":186},"Roll back to 1.4","\u002Fguides\u002Frun\u002Froll-back","3.guides\u002F4.run\u002F11.roll-back",{"title":188,"path":189,"stem":190},"Kraft Lite","\u002Fguides\u002Fkraft-lite","3.guides\u002F5.kraft-lite",{"title":192,"path":193,"stem":194,"children":195},"Troubleshooting","\u002Ftroubleshooting","4.troubleshooting",[196,198,202,206,210,214,218],{"title":10,"path":193,"stem":197},"4.troubleshooting\u002Findex",{"title":199,"path":200,"stem":201},"Why did my item stop?","\u002Ftroubleshooting\u002Fwhy-did-my-item-stop","4.troubleshooting\u002F1.why-did-my-item-stop",{"title":203,"path":204,"stem":205},"Stop reasons in detail","\u002Ftroubleshooting\u002Fstop-reasons-in-detail","4.troubleshooting\u002F2.stop-reasons-in-detail",{"title":207,"path":208,"stem":209},"Starting and reaching Kraft","\u002Ftroubleshooting\u002Fstarting-and-reaching-kraft","4.troubleshooting\u002F3.starting-and-reaching-kraft",{"title":211,"path":212,"stem":213},"Doctor failures","\u002Ftroubleshooting\u002Fdoctor-failures","4.troubleshooting\u002F4.doctor-failures",{"title":215,"path":216,"stem":217},"Sandbox and Kit stops","\u002Ftroubleshooting\u002Fsandbox-and-kit-stops","4.troubleshooting\u002F5.sandbox-and-kit-stops",{"title":219,"path":220,"stem":221},"Add-on problems","\u002Ftroubleshooting\u002Faddon-problems","4.troubleshooting\u002F6.addon-problems",{"title":223,"path":224,"stem":225,"children":226},"Reference","\u002Freference","5.reference",[227,229,267,289,293,391,409,435,439,443,477,481],{"title":10,"path":224,"stem":228},"5.reference\u002Findex",{"title":230,"path":231,"stem":232,"children":233},"Web UI","\u002Freference\u002Fweb-ui","5.reference\u002F00.web-ui\u002Findex",[234,235,239,243,247,251,255,259,263],{"title":10,"path":231,"stem":232},{"title":236,"path":237,"stem":238},"Sidebar, search, and keyboard","\u002Freference\u002Fweb-ui\u002Fsidebar-search-and-keyboard","5.reference\u002F00.web-ui\u002F0.sidebar-search-and-keyboard",{"title":240,"path":241,"stem":242},"The board","\u002Freference\u002Fweb-ui\u002Fboard","5.reference\u002F00.web-ui\u002F1.board",{"title":244,"path":245,"stem":246},"An item's page","\u002Freference\u002Fweb-ui\u002Fitem-page","5.reference\u002F00.web-ui\u002F2.item-page",{"title":248,"path":249,"stem":250},"Fix loops and test scopes","\u002Freference\u002Fweb-ui\u002Ffix-loops-and-test-scopes","5.reference\u002F00.web-ui\u002F3.fix-loops-and-test-scopes",{"title":252,"path":253,"stem":254},"Config before an item starts","\u002Freference\u002Fweb-ui\u002Fconfig-before-start","5.reference\u002F00.web-ui\u002F4.config-before-start",{"title":256,"path":257,"stem":258},"The review page","\u002Freference\u002Fweb-ui\u002Freview-page","5.reference\u002F00.web-ui\u002F5.review-page",{"title":260,"path":261,"stem":262},"Templates and Settings","\u002Freference\u002Fweb-ui\u002Ftemplates-and-settings","5.reference\u002F00.web-ui\u002F6.templates-and-settings",{"title":264,"path":265,"stem":266},"Analytics","\u002Freference\u002Fweb-ui\u002Fanalytics","5.reference\u002F00.web-ui\u002F7.analytics",{"title":268,"path":269,"stem":270,"children":271},"CLI","\u002Freference\u002Fcli","5.reference\u002F01.cli\u002Findex",[272,273,277,281,285],{"title":10,"path":269,"stem":270},{"title":274,"path":275,"stem":276},"Item verbs","\u002Freference\u002Fcli\u002Fitem","5.reference\u002F01.cli\u002F2.item",{"title":278,"path":279,"stem":280},"View verbs","\u002Freference\u002Fcli\u002Fview","5.reference\u002F01.cli\u002F3.view",{"title":282,"path":283,"stem":284},"Repo verbs","\u002Freference\u002Fcli\u002Frepo","5.reference\u002F01.cli\u002F4.repo",{"title":286,"path":287,"stem":288},"Admin verbs","\u002Freference\u002Fcli\u002Fadmin","5.reference\u002F01.cli\u002F5.admin",{"title":290,"path":291,"stem":292},"Work item statuses","\u002Freference\u002Fstatuses","5.reference\u002F02.statuses",{"title":294,"path":295,"stem":296,"children":297},"Configuration","\u002Freference\u002Fconfiguration","5.reference\u002F03.configuration\u002Findex",[298,299,317,321,325,329,333,337,341,345,379,383,387],{"title":10,"path":295,"stem":296},{"title":300,"path":301,"stem":302,"children":303},"repos.yaml","\u002Freference\u002Fconfiguration\u002Frepos","5.reference\u002F03.configuration\u002F02.repos\u002Findex",[304,305,309,313],{"title":10,"path":301,"stem":302},{"title":306,"path":307,"stem":308},"How connect proposes commands","\u002Freference\u002Fconfiguration\u002Frepos\u002Fconnect-proposals","5.reference\u002F03.configuration\u002F02.repos\u002F1.connect-proposals",{"title":310,"path":311,"stem":312},"detectors.yaml","\u002Freference\u002Fconfiguration\u002Frepos\u002Fdetectors","5.reference\u002F03.configuration\u002F02.repos\u002F2.detectors",{"title":314,"path":315,"stem":316},"Workspaces","\u002Freference\u002Fconfiguration\u002Frepos\u002Fworkspaces","5.reference\u002F03.configuration\u002F02.repos\u002F3.workspaces",{"title":318,"path":319,"stem":320},"policy.yaml","\u002Freference\u002Fconfiguration\u002Fpolicy","5.reference\u002F03.configuration\u002F03.policy",{"title":322,"path":323,"stem":324},"Library and chains","\u002Freference\u002Fconfiguration\u002Flibrary-and-chains","5.reference\u002F03.configuration\u002F04.library-and-chains",{"title":326,"path":327,"stem":328},"harnesses.yaml","\u002Freference\u002Fconfiguration\u002Fharnesses-file","5.reference\u002F03.configuration\u002F05.harnesses-file",{"title":330,"path":331,"stem":332},"access.yaml","\u002Freference\u002Fconfiguration\u002Faccess","5.reference\u002F03.configuration\u002F06.access",{"title":334,"path":335,"stem":336},"intake.yaml","\u002Freference\u002Fconfiguration\u002Fintake","5.reference\u002F03.configuration\u002F07.intake",{"title":338,"path":339,"stem":340},"notify.yaml","\u002Freference\u002Fconfiguration\u002Fnotify","5.reference\u002F03.configuration\u002F08.notify",{"title":342,"path":343,"stem":344},"theme.yaml","\u002Freference\u002Fconfiguration\u002Ftheme","5.reference\u002F03.configuration\u002F09.theme",{"title":346,"path":347,"stem":348,"children":349},"Sandboxed workers","\u002Freference\u002Fconfiguration\u002Fsandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002Findex",[350,351,355,359,363,367,371,375],{"title":10,"path":347,"stem":348},{"title":352,"path":353,"stem":354},"Resource limits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fresource-limits","5.reference\u002F03.configuration\u002F10.sandbox\u002F1.resource-limits",{"title":356,"path":357,"stem":358},"Callbacks from a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcallbacks","5.reference\u002F03.configuration\u002F10.sandbox\u002F2.callbacks",{"title":360,"path":361,"stem":362},"Network policy","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fnetwork-policy","5.reference\u002F03.configuration\u002F10.sandbox\u002F3.network-policy",{"title":364,"path":365,"stem":366},"Credentials","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcredentials","5.reference\u002F03.configuration\u002F10.sandbox\u002F4.credentials",{"title":368,"path":369,"stem":370},"Kits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fkits","5.reference\u002F03.configuration\u002F10.sandbox\u002F5.kits",{"title":372,"path":373,"stem":374},"sandbox.yaml","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fsandbox-yaml","5.reference\u002F03.configuration\u002F10.sandbox\u002F6.sandbox-yaml",{"title":376,"path":377,"stem":378},"Git in a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fgit-in-a-sandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002F7.git-in-a-sandbox",{"title":380,"path":381,"stem":382},"Environment variables","\u002Freference\u002Fconfiguration\u002Fenvironment-variables","5.reference\u002F03.configuration\u002F11.environment-variables",{"title":384,"path":385,"stem":386},"Add-ons and collections","\u002Freference\u002Fconfiguration\u002Faddons","5.reference\u002F03.configuration\u002F12.addons",{"title":388,"path":389,"stem":390},"Repo libraries","\u002Freference\u002Fconfiguration\u002Frepo-libraries","5.reference\u002F03.configuration\u002F13.repo-libraries",{"title":392,"path":393,"stem":394,"children":395},"Chain file keys","\u002Freference\u002Fchain-nodes","5.reference\u002F04.chain-nodes\u002Findex",[396,397,401,405],{"title":10,"path":393,"stem":394},{"title":398,"path":399,"stem":400},"Subprocess tasks","\u002Freference\u002Fchain-nodes\u002Fsubprocess-tasks","5.reference\u002F04.chain-nodes\u002F2.subprocess-tasks",{"title":402,"path":403,"stem":404},"Fix loop and judge","\u002Freference\u002Fchain-nodes\u002Ffix-loop","5.reference\u002F04.chain-nodes\u002F3.fix-loop",{"title":406,"path":407,"stem":408},"Result file","\u002Freference\u002Fchain-nodes\u002Fresult-file","5.reference\u002F04.chain-nodes\u002F4.result-file",{"title":410,"path":411,"stem":412,"children":413},"Agent harnesses","\u002Freference\u002Fharnesses","5.reference\u002F05.harnesses\u002Findex",[414,415,419,423,427,431],{"title":10,"path":411,"stem":412},{"title":416,"path":417,"stem":418},"Unattended runs","\u002Freference\u002Fharnesses\u002Funattended-runs","5.reference\u002F05.harnesses\u002F2.unattended-runs",{"title":420,"path":421,"stem":422},"Agent profiles","\u002Freference\u002Fharnesses\u002Fagent-profiles","5.reference\u002F05.harnesses\u002F3.agent-profiles",{"title":424,"path":425,"stem":426},"Harness definition files","\u002Freference\u002Fharnesses\u002Fharness-files","5.reference\u002F05.harnesses\u002F4.harness-files",{"title":428,"path":429,"stem":430},"Fallback and escalation","\u002Freference\u002Fharnesses\u002Ffallback-and-escalation","5.reference\u002F05.harnesses\u002F5.fallback-and-escalation",{"title":432,"path":433,"stem":434},"Cost reporting","\u002Freference\u002Fharnesses\u002Fcost-reporting","5.reference\u002F05.harnesses\u002F6.cost-reporting",{"title":436,"path":437,"stem":438},"Permission gate","\u002Freference\u002Fpermissions","5.reference\u002F06.permissions",{"title":440,"path":441,"stem":442},"Inbound triggers","\u002Freference\u002Ftriggers","5.reference\u002F07.triggers",{"title":444,"path":445,"stem":446,"children":447},"HTTP API","\u002Freference\u002Fhttp-api","5.reference\u002F08.http-api\u002Findex",[448,449,453,457,461,465,469,473],{"title":10,"path":445,"stem":446},{"title":450,"path":451,"stem":452},"Filing, reading and changing work items","\u002Freference\u002Fhttp-api\u002Fwork-items","5.reference\u002F08.http-api\u002F2.work-items",{"title":454,"path":455,"stem":456},"Gates, run control, ending and retry","\u002Freference\u002Fhttp-api\u002Fgates-run-control-and-ending","5.reference\u002F08.http-api\u002F3.gates-run-control-and-ending",{"title":458,"path":459,"stem":460},"The work item object","\u002Freference\u002Fhttp-api\u002Fwork-item-object","5.reference\u002F08.http-api\u002F4.work-item-object",{"title":462,"path":463,"stem":464},"Budget, events, diff and documents","\u002Freference\u002Fhttp-api\u002Fbudget-and-events","5.reference\u002F08.http-api\u002F5.budget-and-events",{"title":466,"path":467,"stem":468},"Repos, chains, harnesses and the server","\u002Freference\u002Fhttp-api\u002Frepos-chains-harnesses-and-server","5.reference\u002F08.http-api\u002F6.repos-chains-harnesses-and-server",{"title":470,"path":471,"stem":472},"Drafts","\u002Freference\u002Fhttp-api\u002Fdrafts","5.reference\u002F08.http-api\u002F7.drafts",{"title":474,"path":475,"stem":476},"Ops for each draft area","\u002Freference\u002Fhttp-api\u002Fdraft-ops","5.reference\u002F08.http-api\u002F8.draft-ops",{"title":478,"path":479,"stem":480},"MCP tools","\u002Freference\u002Fmcp-tools","5.reference\u002F09.mcp-tools",{"title":482,"path":483,"stem":484},"Events","\u002Freference\u002Fevents","5.reference\u002F10.events",{"title":486,"path":487,"stem":488,"children":489},"Security and project","\u002Fproject","6.project",[490,492,496,500,504,508,512,516],{"title":10,"path":487,"stem":491},"6.project\u002Findex",{"title":493,"path":494,"stem":495},"Security","\u002Fproject\u002Fsecurity","6.project\u002F1.security",{"title":497,"path":498,"stem":499},"Data and privacy","\u002Fproject\u002Fdata-and-privacy","6.project\u002F2.data-and-privacy",{"title":501,"path":502,"stem":503},"What's new in 2.0","\u002Fproject\u002Fwhats-new","6.project\u002F3.whats-new",{"title":505,"path":506,"stem":507},"Status and support","\u002Fproject\u002Fstatus-and-support","6.project\u002F4.status-and-support",{"title":509,"path":510,"stem":511},"Architecture","\u002Fproject\u002Farchitecture","6.project\u002F5.architecture",{"title":513,"path":514,"stem":515},"Source map","\u002Fproject\u002Fsource-map","6.project\u002F6.source-map",{"title":517,"path":518,"stem":519},"Contributing","\u002Fproject\u002Fcontributing","6.project\u002F7.contributing",{"id":521,"title":356,"body":522,"description":851,"extension":852,"links":853,"meta":854,"navigation":855,"path":357,"seo":856,"stem":358,"__hash__":857},"docs\u002F5.reference\u002F03.configuration\u002F10.sandbox\u002F2.callbacks.md",{"type":523,"value":524,"toc":840},"minimark",[525,545,554,583,586,629,646,666,673,681,698,704,752,758,766,778,793,819,823],[526,527,528,529,534,535,539,540,544],"p",{},"A ",[530,531,533],"a",{"href":532},"\u002Fconcepts\u002Fvocabulary#sandbox","sandboxed"," ",[530,536,538],{"href":537},"\u002Fconcepts\u002Fvocabulary#worker","worker"," reaches Kraft through a channel of its own. This page covers the shim it calls, how each harness's permission check travels, and what changes without ",[541,542,543],"code",{},"network:",".",[546,547,549,550,553],"h2",{"id":548},"the-kraft-shim","The ",[541,551,552],{},"kraft"," shim",[526,555,556,557,560,561,563,564,567,568,571,572,575,576,579,580,582],{},"Under a ",[530,558,559],{"href":361},"network policy"," a sandboxed worker reaches Kraft through its session's own channel, the one its proxy runs on. Every such container has Kraft's ",[541,562,552],{}," shim, a ",[541,565,566],{},"sh"," and ",[541,569,570],{},"curl"," script, mounted read-only at ",[541,573,574],{},"\u002Fopt\u002Fkraft\u002Fbin"," and first on its ",[541,577,578],{},"PATH"," (the image's own ",[541,581,578],{}," after it).",[526,584,585],{},"The shim has only the verbs a worker needs, each for the worker's own item only:",[587,588,589,595,600,614,619,624],"ul",{},[590,591,592],"li",{},[541,593,594],{},"kraft item progress K",[590,596,597],{},[541,598,599],{},"kraft item reply THREAD --body ...",[590,601,602,605,606,610,611],{},[541,603,604],{},"kraft item retry",": an ",[530,607,609],{"href":608},"\u002Fconcepts\u002Fvocabulary#escalation-turn","escalation turn"," may retry its item, and a worker's own retry is answered ",[541,612,613],{},"403",[590,615,616],{},[541,617,618],{},"kraft view show|threads",[590,620,621],{},[541,622,623],{},"kraft view events [--after N] [--type T]",[590,625,626],{},[541,627,628],{},"kraft admin permission-hook HARNESS",[526,630,631,634,635,567,638,641,642,645],{},[541,632,633],{},"view events"," answers the item's history as JSON (all of it, or the part ",[541,636,637],{},"--after",[541,639,640],{},"--type"," keep). The history holds what a person wrote in a steer or a gate note, and every permission decision. There is no ",[541,643,644],{},"-f"," inside.",[526,647,648,649,652,653,656,657,661,662,665],{},"There is no ",[541,650,651],{},"kraft view diff"," or ",[541,654,655],{},"compare"," inside: Kraft reads no git in a ",[530,658,660],{"href":659},"\u002Fconcepts\u002Fvocabulary#worktree","worktree"," while a sandboxed session runs in it, and the worker has ",[541,663,664],{},"git"," itself.",[526,667,668,669,672],{},"The shim sends each call to ",[541,670,671],{},"http:\u002F\u002Fkraft"," through the proxy, which answers it in the Kraft server itself, never forwarded anywhere.",[526,674,675,676,680],{},"A call acts as the session whose channel it came in on, whatever headers or token the worker sends. It acts only on that session's own ",[530,677,679],{"href":678},"\u002Fconcepts\u002Fvocabulary#work-item","work item",": its progress, replies on its own item's threads, its own permission asks, and reads of its own item. An escalation turn may also retry that item.",[526,682,683,684,686,687,690,691,694,695,697],{},"A call to anything else is answered ",[541,685,613],{}," and recorded as a ",[541,688,689],{},"sandbox_egress_refused"," event, like a refused host. A worker's own ",[541,692,693],{},"retry"," of its item passes the channel, and the API refuses it with ",[541,696,613],{}," (\"a worker session cannot act on its own work item\"); no event is recorded for that one. No allow list entry is needed for any of this.",[546,699,701,702],{"id":700},"permission-checks-under-network","Permission checks under ",[541,703,543],{},[587,705,706,732,746],{},[590,707,708,712,713,716,717],{},[709,710,711],"strong",{},"Codex."," Its hook is the shim's ",[541,714,715],{},"admin permission-hook codex",".\n",[587,718,719,726,729],{},[590,720,721,722,725],{},"The hash Codex needs to trust the hook is asked of the image's own ",[541,723,724],{},"codex",", in a short container with no network, since Codex silently skips a hook it does not trust and runs the call.",[590,727,728],{},"When that cannot be done (the image's Codex does not start, or does not trust the hook), the task is refused.",[590,730,731],{},"When the shim gets no answer from Kraft, it prints Codex's own deny.",[590,733,734,737,738,741,742,745],{},[709,735,736],{},"Claude."," Launched with Kraft's MCP server at ",[541,739,740],{},"http:\u002F\u002Fkraft\u002Fmcp"," and no other (",[541,743,744],{},"--strict-mcp-config","), which answers its permission tool for that session alone.",[590,747,748,751],{},[709,749,750],{},"Cursor"," ignores a proxy, so it is refused under a network policy.",[546,753,755,756],{"id":754},"without-network","Without ",[541,757,543],{},[526,759,760,761,763,764,544],{},"Kraft sets up no channel to itself: the container has no ",[541,762,552],{}," command and no Kraft MCP server. Kraft does not restrict the container's network either, so do not rely on this configuration to keep a worker away from the host: see ",[530,765,493],{"href":494},[526,767,768,769,771,772,775,776,544],{},"For that reason every launch into a sandbox without ",[541,770,543],{}," is refused, whatever the harness, unless the sandbox sets ",[541,773,774],{},"unrestricted_network: true",". That key says you accept an unrestricted network and gates that are not enforced; it cannot be set together with ",[541,777,543],{},[526,779,780,781,784,785,788,789,792],{},"With it, a sandboxed Claude task is still refused before it starts (its permission tool would be missing and the CLI would exit), as is a Codex or Cursor task with a tool policy (",[541,782,783],{},"allowed_tools",", ",[541,786,787],{},"deny_tools"," or a grant other than ",[541,790,791],{},"git-commit","). For a task that does start:",[587,794,795,801,816],{},[590,796,797,798,800],{},"Prompts do not tell the worker to run ",[541,799,552],{},": it tags its commits with the task number instead of reporting progress, and says what it did about each review thread in its result.",[590,802,803,804,807,808,811,812,815],{},"No reply agent is launched for review threads: a ",[541,805,806],{},"comment"," review answers ",[541,809,810],{},"reply_agent: false",", and the item records a ",[541,813,814],{},"reply_agent_skipped"," event saying why.",[590,817,818],{},"An escalation turn cannot resume the chain itself: you retry it.",[546,820,822],{"id":821},"related","Related",[587,824,825,830,835],{},[590,826,827,829],{},[530,828,360],{"href":361},": the channel the callbacks travel on.",[590,831,832,834],{},[530,833,346],{"href":347},": what else reaches the container.",[590,836,837,839],{},[530,838,352],{"href":353},": the CPU, memory and process limits of a sandbox's container.",{"title":841,"searchDepth":842,"depth":842,"links":843},"",2,[844,846,848,850],{"id":548,"depth":842,"text":845},"The kraft shim",{"id":700,"depth":842,"text":847},"Permission checks under network:",{"id":754,"depth":842,"text":849},"Without network:",{"id":821,"depth":842,"text":822},"How a sandboxed worker reaches Kraft through a network policy's channel, which verbs it has there, and what is refused without one.","md",null,{},true,{"title":356,"description":851},"RzeUvu5bNXUqbge4hkJosz9NO55BNSPcnAZ2zmmOw90",[859,861],{"title":352,"path":353,"stem":354,"description":860,"children":-1},"The CPU, memory and process limits a sandbox sets on its container, when a limit cannot be enforced, and what Kraft does when a memory limit kills a process.",{"title":360,"path":361,"stem":362,"description":862,"children":-1},"How the hosts a sandboxed task may reach are listed, how Kraft enforces them, and what the policy does not cover.",1791801163749]