Agent harnesses
Unattended runs
The permission mode each harness runs in when no one can answer a prompt, and where its tool calls go.
This page lists the permission mode Kraft runs each harness in. A worker has nobody to answer a permission prompt, so Kraft runs each CLI in its classifier mode where it has one, and otherwise in its most autonomous unattended mode. A classifier is the CLI's own automatic approver. What Kraft itself needs from a worker, its result file and its commits, is granted explicitly and never left to a classifier.
| Harness | Mode | Classifier | Extras Kraft adds | Tool lists |
|---|---|---|---|---|
claude | --permission-mode auto | yes | Kraft's MCP permission tool answers what the classifier does not settle. | Asked through the gate |
codex | approve-for-me, set with -c keys | yes | Explicit writable roots for the result file and .git. Kraft's PreToolUse hook, trusted per launch, when the policy has something to enforce. | Asked through the gate (hook); the hook's deny blocks |
cursor | --auto-review | yes | A per-launch config with commit attribution off. Kraft's preToolUse hook when the policy has something to enforce. | Asked through the gate (hook); the hook's deny blocks, its allow does not outrank the classifier |
opencode | --auto | no | The task's tool policy as per-launch config rules (--standalone), when it has any. | Rules enforced by OpenCode; no permission gate, nothing logged |
amp | none: Amp approves by default | no | The task's tool policy as a per-launch settings file, when it has any. | Rules enforced by Amp; no permission gate, nothing logged |
gemini | --approval-mode yolo, unless the task sets another | no | None. | Refused: a task with deny_tools or allowed_tools does not launch. No call reaches the gate |
antigravity | --dangerously-skip-permissions | no | None. | Refused: a task with deny_tools or allowed_tools does not launch. No call reaches the gate |
A tool list is enforced one of three ways: the permission gate answers a call (claude, codex, cursor), the CLI enforces rules Kraft wrote for the launch (opencode, amp), or Kraft refuses the task (gemini, antigravity). The permission gate says how a call reaches Kraft and how Kraft decides it.
Notes by harness
- Codex. Codex runs in its approve-for-me mode, the counterpart of Claude's
auto. The sandbox isworkspace-write. A sandbox escalation the model asks for goes to Codex's automatic reviewer (approval_policy=on-request,approvals_reviewer=auto_review), not to a person. Apermission_modeofread-onlyordanger-full-access(a harness profile'sdefaults:or a task) changes the sandbox, and the reviewer stays on in every mode. - Codex in a docker sandbox. The default becomes
danger-full-access(container_permission_mode). Codex's own sandbox cannot start inside a container, and the container is the boundary. See Sandboxed workers. - Cursor.
--auto-reviewis Cursor's Smart Auto: a server-side classifier runs the tool calls it judges safe and refuses the rest. Without a mode, print mode only proposes edits and applies none.permission_mode: forceoverrides it. - Amp.
amptakes nopermission_mode: it asks for no approvals. - Antigravity. Every launch passes
--dangerously-skip-permissions, since headlessagyotherwise denies every file write and shell command and still exits 0. Kraft therefore has no per-action control over anagyworker. The worktree is the boundary, and a sandbox bounds what it can reach.
Related
- Permission gate: what the gate decides for each harness, and the grants it allows.
- Harness definition files: how a harness file declares
permission_mode,permission_hookandpermission_rules. - Why a permission gate: the reasoning behind running workers this way.