[{"data":1,"prerenderedAt":1284},["ShallowReactive",2],{"navigation_docs":3,"-reference-configuration-sandbox-credentials":504,"-reference-configuration-sandbox-credentials-surround":1279},[4,28,51,187,214,469],{"title":5,"path":6,"stem":7,"children":8},"Get started","\u002Fget-started","1.get-started",[9,12,16,20,24],{"title":10,"path":6,"stem":11},"Overview","1.get-started\u002Findex",{"title":13,"path":14,"stem":15},"Why Kraft","\u002Fget-started\u002Fwhy-kraft","1.get-started\u002F0.why-kraft",{"title":17,"path":18,"stem":19},"Install","\u002Fget-started\u002Finstall","1.get-started\u002F1.install",{"title":21,"path":22,"stem":23},"Your first work item","\u002Fget-started\u002Ffirst-work-item","1.get-started\u002F2.first-work-item",{"title":25,"path":26,"stem":27},"FAQ","\u002Fget-started\u002Ffaq","1.get-started\u002F3.faq",{"title":29,"path":30,"stem":31,"children":32},"Concepts","\u002Fconcepts","2.concepts",[33,35,39,43,47],{"title":10,"path":30,"stem":34},"2.concepts\u002Findex",{"title":36,"path":37,"stem":38},"How a work item runs","\u002Fconcepts\u002Fhow-a-work-item-runs","2.concepts\u002F1.how-a-work-item-runs",{"title":40,"path":41,"stem":42},"Caps and budgets","\u002Fconcepts\u002Fcaps-and-budgets","2.concepts\u002F2.caps-and-budgets",{"title":44,"path":45,"stem":46},"Why a permission gate","\u002Fconcepts\u002Fpermission-gate","2.concepts\u002F3.permission-gate",{"title":48,"path":49,"stem":50},"Vocabulary","\u002Fconcepts\u002Fvocabulary","2.concepts\u002F4.vocabulary",{"title":52,"path":53,"stem":54,"children":55},"Guides","\u002Fguides","3.guides",[56,58,96,113,134,183],{"title":10,"path":53,"stem":57},"3.guides\u002Findex",{"title":59,"path":60,"stem":61,"children":62,"page":95},"Day to day","\u002Fguides\u002Fday-to-day","3.guides\u002F1.day-to-day",[63,67,71,75,79,83,87,91],{"title":64,"path":65,"stem":66},"The setup wizard on first start","\u002Fguides\u002Fday-to-day\u002Ffirst-run","3.guides\u002F1.day-to-day\u002F2.first-run",{"title":68,"path":69,"stem":70},"File a work item","\u002Fguides\u002Fday-to-day\u002Ffile-a-work-item","3.guides\u002F1.day-to-day\u002F3.file-a-work-item",{"title":72,"path":73,"stem":74},"Use Kraft from your agent","\u002Fguides\u002Fday-to-day\u002Fagent-integration","3.guides\u002F1.day-to-day\u002F4.agent-integration",{"title":76,"path":77,"stem":78},"Reviewing a change","\u002Fguides\u002Fday-to-day\u002Freview-a-change","3.guides\u002F1.day-to-day\u002F5.review-a-change",{"title":80,"path":81,"stem":82},"Raise a cap on a stopped item","\u002Fguides\u002Fday-to-day\u002Fraise-a-cap","3.guides\u002F1.day-to-day\u002F6.raise-a-cap",{"title":84,"path":85,"stem":86},"Kraft for VS Code","\u002Fguides\u002Fday-to-day\u002Fvscode","3.guides\u002F1.day-to-day\u002F7.vscode",{"title":88,"path":89,"stem":90},"Kraft on a phone","\u002Fguides\u002Fday-to-day\u002Fkraft-on-a-phone","3.guides\u002F1.day-to-day\u002F8.kraft-on-a-phone",{"title":92,"path":93,"stem":94},"Get notified when an item needs you","\u002Fguides\u002Fday-to-day\u002Fnotifications","3.guides\u002F1.day-to-day\u002F9.notifications",false,{"title":97,"path":98,"stem":99,"children":100,"page":95},"Customize and automate","\u002Fguides\u002Fcustomize","3.guides\u002F2.customize",[101,105,109],{"title":102,"path":103,"stem":104},"Write your own chain","\u002Fguides\u002Fcustomize\u002Fwrite-your-own-chain","3.guides\u002F2.customize\u002F1.write-your-own-chain",{"title":106,"path":107,"stem":108},"Add a security review or a gate reviewer","\u002Fguides\u002Fcustomize\u002Fadd-review-agents","3.guides\u002F2.customize\u002F2.add-review-agents",{"title":110,"path":111,"stem":112},"Schedule or webhook work","\u002Fguides\u002Fcustomize\u002Fschedule-and-webhook-work","3.guides\u002F2.customize\u002F3.schedule-and-webhook-work",{"title":114,"path":115,"stem":116,"children":117,"page":95},"Agents and harnesses","\u002Fguides\u002Fharnesses","3.guides\u002F3.harnesses",[118,122,126,130],{"title":119,"path":120,"stem":121},"Switch a task to another harness","\u002Fguides\u002Fharnesses\u002Fswitch-harness","3.guides\u002F3.harnesses\u002F1.switch-harness",{"title":123,"path":124,"stem":125},"Add or override a harness","\u002Fguides\u002Fharnesses\u002Fadding-a-harness","3.guides\u002F3.harnesses\u002F2.adding-a-harness",{"title":127,"path":128,"stem":129},"Build a worker Kit","\u002Fguides\u002Fharnesses\u002Fworker-kit","3.guides\u002F3.harnesses\u002F3.worker-kit",{"title":131,"path":132,"stem":133},"Give a worker its login","\u002Fguides\u002Fharnesses\u002Fgive-a-worker-its-login","3.guides\u002F3.harnesses\u002F4.give-a-worker-its-login",{"title":135,"path":136,"stem":137,"children":138,"page":95},"Run the server","\u002Fguides\u002Frun","3.guides\u002F4.run",[139,143,147,151,155,159,163,167,171,175,179],{"title":140,"path":141,"stem":142},"Remote access","\u002Fguides\u002Frun\u002Fremote-access","3.guides\u002F4.run\u002F01.remote-access",{"title":144,"path":145,"stem":146},"Put a proxy in front of Kraft","\u002Fguides\u002Frun\u002Fput-a-proxy-in-front-of-kraft","3.guides\u002F4.run\u002F02.put-a-proxy-in-front-of-kraft",{"title":148,"path":149,"stem":150},"Restart Kraft without ending running agents","\u002Fguides\u002Frun\u002Frestart-kraft","3.guides\u002F4.run\u002F03.restart-kraft",{"title":152,"path":153,"stem":154},"Back up and restore the database","\u002Fguides\u002Frun\u002Fback-up-and-restore","3.guides\u002F4.run\u002F04.back-up-and-restore",{"title":156,"path":157,"stem":158},"Logs and disk space","\u002Fguides\u002Frun\u002Flogs-and-disk-space","3.guides\u002F4.run\u002F05.logs-and-disk-space",{"title":160,"path":161,"stem":162},"Run Kraft as a service","\u002Fguides\u002Frun\u002Frun-as-a-service","3.guides\u002F4.run\u002F06.run-as-a-service",{"title":164,"path":165,"stem":166},"Upgrade Kraft","\u002Fguides\u002Frun\u002Fupgrade-kraft","3.guides\u002F4.run\u002F07.upgrade-kraft",{"title":168,"path":169,"stem":170},"Upgrade your configuration","\u002Fguides\u002Frun\u002Fupgrade-your-configuration","3.guides\u002F4.run\u002F08.upgrade-your-configuration",{"title":172,"path":173,"stem":174},"Upgrade from 1.4","\u002Fguides\u002Frun\u002Fupgrade-from-1-4","3.guides\u002F4.run\u002F09.upgrade-from-1-4",{"title":176,"path":177,"stem":178},"Upgrade from 0.x or a release candidate","\u002Fguides\u002Frun\u002Fupgrade-from-0-x-or-a-release-candidate","3.guides\u002F4.run\u002F10.upgrade-from-0-x-or-a-release-candidate",{"title":180,"path":181,"stem":182},"Roll back to 1.4","\u002Fguides\u002Frun\u002Froll-back","3.guides\u002F4.run\u002F11.roll-back",{"title":184,"path":185,"stem":186},"Kraft Lite","\u002Fguides\u002Fkraft-lite","3.guides\u002F5.kraft-lite",{"title":188,"path":189,"stem":190,"children":191},"Troubleshooting","\u002Ftroubleshooting","4.troubleshooting",[192,194,198,202,206,210],{"title":10,"path":189,"stem":193},"4.troubleshooting\u002Findex",{"title":195,"path":196,"stem":197},"Why did my item stop?","\u002Ftroubleshooting\u002Fwhy-did-my-item-stop","4.troubleshooting\u002F1.why-did-my-item-stop",{"title":199,"path":200,"stem":201},"Stop reasons in detail","\u002Ftroubleshooting\u002Fstop-reasons-in-detail","4.troubleshooting\u002F2.stop-reasons-in-detail",{"title":203,"path":204,"stem":205},"Starting and reaching Kraft","\u002Ftroubleshooting\u002Fstarting-and-reaching-kraft","4.troubleshooting\u002F3.starting-and-reaching-kraft",{"title":207,"path":208,"stem":209},"Doctor failures","\u002Ftroubleshooting\u002Fdoctor-failures","4.troubleshooting\u002F4.doctor-failures",{"title":211,"path":212,"stem":213},"Sandbox and Kit stops","\u002Ftroubleshooting\u002Fsandbox-and-kit-stops","4.troubleshooting\u002F5.sandbox-and-kit-stops",{"title":215,"path":216,"stem":217,"children":218},"Reference","\u002Freference","5.reference",[219,221,259,281,285,375,393,419,423,427,461,465],{"title":10,"path":216,"stem":220},"5.reference\u002Findex",{"title":222,"path":223,"stem":224,"children":225},"Web UI","\u002Freference\u002Fweb-ui","5.reference\u002F00.web-ui\u002Findex",[226,227,231,235,239,243,247,251,255],{"title":10,"path":223,"stem":224},{"title":228,"path":229,"stem":230},"Sidebar, search, and keyboard","\u002Freference\u002Fweb-ui\u002Fsidebar-search-and-keyboard","5.reference\u002F00.web-ui\u002F0.sidebar-search-and-keyboard",{"title":232,"path":233,"stem":234},"The board","\u002Freference\u002Fweb-ui\u002Fboard","5.reference\u002F00.web-ui\u002F1.board",{"title":236,"path":237,"stem":238},"An item's page","\u002Freference\u002Fweb-ui\u002Fitem-page","5.reference\u002F00.web-ui\u002F2.item-page",{"title":240,"path":241,"stem":242},"Fix loops and test scopes","\u002Freference\u002Fweb-ui\u002Ffix-loops-and-test-scopes","5.reference\u002F00.web-ui\u002F3.fix-loops-and-test-scopes",{"title":244,"path":245,"stem":246},"Config before an item starts","\u002Freference\u002Fweb-ui\u002Fconfig-before-start","5.reference\u002F00.web-ui\u002F4.config-before-start",{"title":248,"path":249,"stem":250},"The review page","\u002Freference\u002Fweb-ui\u002Freview-page","5.reference\u002F00.web-ui\u002F5.review-page",{"title":252,"path":253,"stem":254},"Templates and Settings","\u002Freference\u002Fweb-ui\u002Ftemplates-and-settings","5.reference\u002F00.web-ui\u002F6.templates-and-settings",{"title":256,"path":257,"stem":258},"Analytics","\u002Freference\u002Fweb-ui\u002Fanalytics","5.reference\u002F00.web-ui\u002F7.analytics",{"title":260,"path":261,"stem":262,"children":263},"CLI","\u002Freference\u002Fcli","5.reference\u002F01.cli\u002Findex",[264,265,269,273,277],{"title":10,"path":261,"stem":262},{"title":266,"path":267,"stem":268},"Item verbs","\u002Freference\u002Fcli\u002Fitem","5.reference\u002F01.cli\u002F2.item",{"title":270,"path":271,"stem":272},"View verbs","\u002Freference\u002Fcli\u002Fview","5.reference\u002F01.cli\u002F3.view",{"title":274,"path":275,"stem":276},"Repo verbs","\u002Freference\u002Fcli\u002Frepo","5.reference\u002F01.cli\u002F4.repo",{"title":278,"path":279,"stem":280},"Admin verbs","\u002Freference\u002Fcli\u002Fadmin","5.reference\u002F01.cli\u002F5.admin",{"title":282,"path":283,"stem":284},"Work item statuses","\u002Freference\u002Fstatuses","5.reference\u002F02.statuses",{"title":286,"path":287,"stem":288,"children":289},"Configuration","\u002Freference\u002Fconfiguration","5.reference\u002F03.configuration\u002Findex",[290,291,309,313,317,321,325,329,333,337,371],{"title":10,"path":287,"stem":288},{"title":292,"path":293,"stem":294,"children":295},"repos.yaml","\u002Freference\u002Fconfiguration\u002Frepos","5.reference\u002F03.configuration\u002F02.repos\u002Findex",[296,297,301,305],{"title":10,"path":293,"stem":294},{"title":298,"path":299,"stem":300},"How connect proposes commands","\u002Freference\u002Fconfiguration\u002Frepos\u002Fconnect-proposals","5.reference\u002F03.configuration\u002F02.repos\u002F1.connect-proposals",{"title":302,"path":303,"stem":304},"detectors.yaml","\u002Freference\u002Fconfiguration\u002Frepos\u002Fdetectors","5.reference\u002F03.configuration\u002F02.repos\u002F2.detectors",{"title":306,"path":307,"stem":308},"Workspaces","\u002Freference\u002Fconfiguration\u002Frepos\u002Fworkspaces","5.reference\u002F03.configuration\u002F02.repos\u002F3.workspaces",{"title":310,"path":311,"stem":312},"policy.yaml","\u002Freference\u002Fconfiguration\u002Fpolicy","5.reference\u002F03.configuration\u002F03.policy",{"title":314,"path":315,"stem":316},"Library and chains","\u002Freference\u002Fconfiguration\u002Flibrary-and-chains","5.reference\u002F03.configuration\u002F04.library-and-chains",{"title":318,"path":319,"stem":320},"harnesses.yaml","\u002Freference\u002Fconfiguration\u002Fharnesses-file","5.reference\u002F03.configuration\u002F05.harnesses-file",{"title":322,"path":323,"stem":324},"access.yaml","\u002Freference\u002Fconfiguration\u002Faccess","5.reference\u002F03.configuration\u002F06.access",{"title":326,"path":327,"stem":328},"intake.yaml","\u002Freference\u002Fconfiguration\u002Fintake","5.reference\u002F03.configuration\u002F07.intake",{"title":330,"path":331,"stem":332},"notify.yaml","\u002Freference\u002Fconfiguration\u002Fnotify","5.reference\u002F03.configuration\u002F08.notify",{"title":334,"path":335,"stem":336},"theme.yaml","\u002Freference\u002Fconfiguration\u002Ftheme","5.reference\u002F03.configuration\u002F09.theme",{"title":338,"path":339,"stem":340,"children":341},"Sandboxed workers","\u002Freference\u002Fconfiguration\u002Fsandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002Findex",[342,343,347,351,355,359,363,367],{"title":10,"path":339,"stem":340},{"title":344,"path":345,"stem":346},"Resource limits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fresource-limits","5.reference\u002F03.configuration\u002F10.sandbox\u002F1.resource-limits",{"title":348,"path":349,"stem":350},"Callbacks from a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcallbacks","5.reference\u002F03.configuration\u002F10.sandbox\u002F2.callbacks",{"title":352,"path":353,"stem":354},"Network policy","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fnetwork-policy","5.reference\u002F03.configuration\u002F10.sandbox\u002F3.network-policy",{"title":356,"path":357,"stem":358},"Credentials","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcredentials","5.reference\u002F03.configuration\u002F10.sandbox\u002F4.credentials",{"title":360,"path":361,"stem":362},"Kits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fkits","5.reference\u002F03.configuration\u002F10.sandbox\u002F5.kits",{"title":364,"path":365,"stem":366},"sandbox.yaml","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fsandbox-yaml","5.reference\u002F03.configuration\u002F10.sandbox\u002F6.sandbox-yaml",{"title":368,"path":369,"stem":370},"Git in a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fgit-in-a-sandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002F7.git-in-a-sandbox",{"title":372,"path":373,"stem":374},"Environment variables","\u002Freference\u002Fconfiguration\u002Fenvironment-variables","5.reference\u002F03.configuration\u002F11.environment-variables",{"title":376,"path":377,"stem":378,"children":379},"Chain file keys","\u002Freference\u002Fchain-nodes","5.reference\u002F04.chain-nodes\u002Findex",[380,381,385,389],{"title":10,"path":377,"stem":378},{"title":382,"path":383,"stem":384},"Subprocess tasks","\u002Freference\u002Fchain-nodes\u002Fsubprocess-tasks","5.reference\u002F04.chain-nodes\u002F2.subprocess-tasks",{"title":386,"path":387,"stem":388},"Fix loop and judge","\u002Freference\u002Fchain-nodes\u002Ffix-loop","5.reference\u002F04.chain-nodes\u002F3.fix-loop",{"title":390,"path":391,"stem":392},"Result file","\u002Freference\u002Fchain-nodes\u002Fresult-file","5.reference\u002F04.chain-nodes\u002F4.result-file",{"title":394,"path":395,"stem":396,"children":397},"Agent harnesses","\u002Freference\u002Fharnesses","5.reference\u002F05.harnesses\u002Findex",[398,399,403,407,411,415],{"title":10,"path":395,"stem":396},{"title":400,"path":401,"stem":402},"Unattended runs","\u002Freference\u002Fharnesses\u002Funattended-runs","5.reference\u002F05.harnesses\u002F2.unattended-runs",{"title":404,"path":405,"stem":406},"Agent profiles","\u002Freference\u002Fharnesses\u002Fagent-profiles","5.reference\u002F05.harnesses\u002F3.agent-profiles",{"title":408,"path":409,"stem":410},"Harness definition files","\u002Freference\u002Fharnesses\u002Fharness-files","5.reference\u002F05.harnesses\u002F4.harness-files",{"title":412,"path":413,"stem":414},"Fallback and escalation","\u002Freference\u002Fharnesses\u002Ffallback-and-escalation","5.reference\u002F05.harnesses\u002F5.fallback-and-escalation",{"title":416,"path":417,"stem":418},"Cost reporting","\u002Freference\u002Fharnesses\u002Fcost-reporting","5.reference\u002F05.harnesses\u002F6.cost-reporting",{"title":420,"path":421,"stem":422},"Permission gate","\u002Freference\u002Fpermissions","5.reference\u002F06.permissions",{"title":424,"path":425,"stem":426},"Inbound triggers","\u002Freference\u002Ftriggers","5.reference\u002F07.triggers",{"title":428,"path":429,"stem":430,"children":431},"HTTP API","\u002Freference\u002Fhttp-api","5.reference\u002F08.http-api\u002Findex",[432,433,437,441,445,449,453,457],{"title":10,"path":429,"stem":430},{"title":434,"path":435,"stem":436},"Filing, reading and changing work items","\u002Freference\u002Fhttp-api\u002Fwork-items","5.reference\u002F08.http-api\u002F2.work-items",{"title":438,"path":439,"stem":440},"Gates, run control, ending and retry","\u002Freference\u002Fhttp-api\u002Fgates-run-control-and-ending","5.reference\u002F08.http-api\u002F3.gates-run-control-and-ending",{"title":442,"path":443,"stem":444},"The work item object","\u002Freference\u002Fhttp-api\u002Fwork-item-object","5.reference\u002F08.http-api\u002F4.work-item-object",{"title":446,"path":447,"stem":448},"Budget, events, diff and documents","\u002Freference\u002Fhttp-api\u002Fbudget-and-events","5.reference\u002F08.http-api\u002F5.budget-and-events",{"title":450,"path":451,"stem":452},"Repos, chains, harnesses and the server","\u002Freference\u002Fhttp-api\u002Frepos-chains-harnesses-and-server","5.reference\u002F08.http-api\u002F6.repos-chains-harnesses-and-server",{"title":454,"path":455,"stem":456},"Drafts","\u002Freference\u002Fhttp-api\u002Fdrafts","5.reference\u002F08.http-api\u002F7.drafts",{"title":458,"path":459,"stem":460},"Ops for each draft area","\u002Freference\u002Fhttp-api\u002Fdraft-ops","5.reference\u002F08.http-api\u002F8.draft-ops",{"title":462,"path":463,"stem":464},"MCP tools","\u002Freference\u002Fmcp-tools","5.reference\u002F09.mcp-tools",{"title":466,"path":467,"stem":468},"Events","\u002Freference\u002Fevents","5.reference\u002F10.events",{"title":470,"path":471,"stem":472,"children":473},"Security and project","\u002Fproject","6.project",[474,476,480,484,488,492,496,500],{"title":10,"path":471,"stem":475},"6.project\u002Findex",{"title":477,"path":478,"stem":479},"Security","\u002Fproject\u002Fsecurity","6.project\u002F1.security",{"title":481,"path":482,"stem":483},"Data and privacy","\u002Fproject\u002Fdata-and-privacy","6.project\u002F2.data-and-privacy",{"title":485,"path":486,"stem":487},"What's new in 2.0","\u002Fproject\u002Fwhats-new","6.project\u002F3.whats-new",{"title":489,"path":490,"stem":491},"Status and support","\u002Fproject\u002Fstatus-and-support","6.project\u002F4.status-and-support",{"title":493,"path":494,"stem":495},"Architecture","\u002Fproject\u002Farchitecture","6.project\u002F5.architecture",{"title":497,"path":498,"stem":499},"Source map","\u002Fproject\u002Fsource-map","6.project\u002F6.source-map",{"title":501,"path":502,"stem":503},"Contributing","\u002Fproject\u002Fcontributing","6.project\u002F7.contributing",{"id":505,"title":356,"body":506,"description":1272,"extension":1273,"links":1274,"meta":1275,"navigation":1276,"path":357,"seo":1277,"stem":358,"__hash__":1278},"docs\u002F5.reference\u002F03.configuration\u002F10.sandbox\u002F4.credentials.md",{"type":507,"value":508,"toc":1260},"minimark",[509,518,708,717,734,739,766,929,934,944,948,962,966,1003,1006,1027,1035,1039,1046,1053,1065,1068,1085,1088,1095,1099,1112,1123,1132,1140,1157,1161,1230,1234,1256],[510,511,512,513,517],"p",{},"A variable listed under ",[514,515,516],"code",{},"credentials"," never reaches the container: Kraft's egress proxy adds its value to requests instead. This page covers how to declare one, how it works and its limits.",[519,520,526],"pre",{"className":521,"code":522,"filename":523,"language":524,"meta":525,"style":525},"language-yaml shiki shiki-themes github-light-high-contrast github-light-high-contrast github-dark-high-contrast","repos:\n  - path: \u002Fhome\u002Fyou\u002Fcode\u002Fmy-service\n    sandbox:\n      kind: docker\n      image: ghcr.io\u002Facme\u002Fagent@sha256:...\n      network:\n        runtime: {allow: [registry.example.com]}\n      credentials:\n        - env: ANTHROPIC_API_KEY          # its harness says how\n        - env: REGISTRY_TOKEN             # the repository's own, in full\n          service: registry\n          inject: [{domain: registry.example.com, header: authorization, format: \"Bearer %s\"}]\n","config\u002Frepos.yaml","yaml","",[514,527,528,541,557,565,576,587,595,616,624,642,657,668],{"__ignoreMap":525},[529,530,533,537],"span",{"class":531,"line":532},"line",1,[529,534,536],{"class":535},"sb7M8","repos",[529,538,540],{"class":539},"s7iLA",":\n",[529,542,544,547,550,553],{"class":531,"line":543},2,[529,545,546],{"class":539},"  - ",[529,548,549],{"class":535},"path",[529,551,552],{"class":539},": ",[529,554,556],{"class":555},"semJd","\u002Fhome\u002Fyou\u002Fcode\u002Fmy-service\n",[529,558,560,563],{"class":531,"line":559},3,[529,561,562],{"class":535},"    sandbox",[529,564,540],{"class":539},[529,566,568,571,573],{"class":531,"line":567},4,[529,569,570],{"class":535},"      kind",[529,572,552],{"class":539},[529,574,575],{"class":555},"docker\n",[529,577,579,582,584],{"class":531,"line":578},5,[529,580,581],{"class":535},"      image",[529,583,552],{"class":539},[529,585,586],{"class":555},"ghcr.io\u002Facme\u002Fagent@sha256:...\n",[529,588,590,593],{"class":531,"line":589},6,[529,591,592],{"class":535},"      network",[529,594,540],{"class":539},[529,596,598,601,604,607,610,613],{"class":531,"line":597},7,[529,599,600],{"class":535},"        runtime",[529,602,603],{"class":539},": {",[529,605,606],{"class":535},"allow",[529,608,609],{"class":539},": [",[529,611,612],{"class":555},"registry.example.com",[529,614,615],{"class":539},"]}\n",[529,617,619,622],{"class":531,"line":618},8,[529,620,621],{"class":535},"      credentials",[529,623,540],{"class":539},[529,625,627,630,633,635,638],{"class":531,"line":626},9,[529,628,629],{"class":539},"        - ",[529,631,632],{"class":535},"env",[529,634,552],{"class":539},[529,636,637],{"class":555},"ANTHROPIC_API_KEY",[529,639,641],{"class":640},"sq92B","          # its harness says how\n",[529,643,645,647,649,651,654],{"class":531,"line":644},10,[529,646,629],{"class":539},[529,648,632],{"class":535},[529,650,552],{"class":539},[529,652,653],{"class":555},"REGISTRY_TOKEN",[529,655,656],{"class":640},"             # the repository's own, in full\n",[529,658,660,663,665],{"class":531,"line":659},11,[529,661,662],{"class":535},"          service",[529,664,552],{"class":539},[529,666,667],{"class":555},"registry\n",[529,669,671,674,677,680,682,684,687,690,692,695,697,700,702,705],{"class":531,"line":670},12,[529,672,673],{"class":535},"          inject",[529,675,676],{"class":539},": [{",[529,678,679],{"class":535},"domain",[529,681,552],{"class":539},[529,683,612],{"class":555},[529,685,686],{"class":539},", ",[529,688,689],{"class":535},"header",[529,691,552],{"class":539},[529,693,694],{"class":555},"authorization",[529,696,686],{"class":539},[529,698,699],{"class":535},"format",[529,701,552],{"class":539},[529,703,704],{"class":555},"\"Bearer %s\"",[529,706,707],{"class":539},"}]\n",[510,709,710,711,716],{},"The container gets a ",[712,713,715],"a",{"href":714},"\u002Fconcepts\u002Fvocabulary#sentinel","sentinel"," in the variable's place, and Kraft's egress proxy puts the server's own value into the named header on requests to the named host.",[510,718,719,720,724,725,729,730,733],{},"This holds for every ",[712,721,723],{"href":722},"\u002Fconcepts\u002Fvocabulary#sandbox","sandboxed"," launch of the item: agent sessions, subprocess tasks, test scopes and setup commands, whose code the ",[712,726,728],{"href":727},"\u002Fconcepts\u002Fvocabulary#worker","worker"," may have written. A variable not listed passes through as ",[712,731,338],{"href":732},"\u002Freference\u002Fconfiguration\u002Fsandbox#forwarded-credentials"," describes. Nothing is managed unless the repository lists it.",[735,736,738],"h2",{"id":737},"credential-fields","Credential fields",[510,740,741,742,744,745,747,748,752,753,757,758,761,762,765],{},"Each entry under ",[514,743,516],{}," has these keys. ",[514,746,632],{}," alone takes the rest from the ",[712,749,751],{"href":750},"\u002Fconcepts\u002Fvocabulary#harness","harness"," file of the session's CLI (see ",[712,754,756],{"href":755},"#credentials-a-harness-declares","Credentials a harness declares","); a repository's own credential gives ",[514,759,760],{},"service"," and ",[514,763,764],{},"inject"," itself.",[767,768,769,788],"table",{},[770,771,772],"thead",{},[773,774,775,779,782,785],"tr",{},[776,777,778],"th",{},"Field",[776,780,781],{},"Type",[776,783,784],{},"Default",[776,786,787],{},"Meaning",[789,790,791,810,830,863,879,905],"tbody",{},[773,792,793,798,801,807],{},[794,795,796],"td",{},[514,797,632],{},[794,799,800],{},"string, a variable name",[794,802,803],{},[804,805,806],"em",{},"(required)",[794,808,809],{},"The variable the container holds only as a sentinel.",[773,811,812,816,819,824],{},[794,813,814],{},[514,815,760],{},[794,817,818],{},"string",[794,820,821],{},[514,822,823],{},"null",[794,825,826,827,829],{},"The service the credential is for. A repository's own credential gives it, with ",[514,828,764],{},".",[773,831,832,836,842,847],{},[794,833,834],{},[514,835,764],{},[794,837,838,839],{},"list of ",[514,840,841],{},"{domain, header, format}",[794,843,844],{},[514,845,846],{},"[]",[794,848,849,850,852,853,855,856,858,859,862],{},"Where the proxy puts the value: an exact ",[514,851,679],{},", a ",[514,854,689],{},", and optionally a ",[514,857,699],{}," holding ",[514,860,861],{},"%s"," where the value goes.",[773,864,865,869,871,876],{},[794,866,867],{},[514,868,715],{},[794,870,818],{},[794,872,873],{},[514,874,875],{},"kraft-proxy-managed",[794,877,878],{},"What the container sees. The harness's own sentinel wins over the default, when it declares one.",[773,880,881,886,894,897],{},[794,882,883],{},[514,884,885],{},"phase",[794,887,838,888,761,891],{},[514,889,890],{},"install",[514,892,893],{},"runtime",[794,895,896],{},"both",[794,898,899,900,829],{},"The launches that get this credential. See ",[712,901,903],{"href":902},"#phase",[514,904,885],{},[773,906,907,912,914,918],{},[794,908,909],{},[514,910,911],{},"source",[794,913,800],{},[794,915,916],{},[514,917,823],{},[794,919,920,921,923,924,829],{},"The server's own variable the value is read from, instead of ",[514,922,632],{},". See ",[712,925,927],{"href":926},"#source",[514,928,911],{},[930,931,932],"h3",{"id":885},[514,933,885],{},[510,935,936,939,940,943],{},[514,937,938],{},"[install]"," is the setup command. ",[514,941,942],{},"[runtime]"," is agent sessions, subprocess tasks and test scopes. A launch in another phase gets neither the sentinel nor the value. Unset, the credential is in both.",[930,945,946],{"id":911},[514,947,911],{},[510,949,950,952,953,955,956,958,959,961],{},[514,951,911],{}," names the server's own environment variable its value is read from, instead of ",[514,954,632],{}," in the worker's environment. The worker's environment is never read for it, not even as a fallback, and the ",[514,957,911],{}," variable is kept out of the container as ",[514,960,632],{}," is. Set but empty counts as no value.",[930,963,965],{"id":964},"rules-for-the-list","Rules for the list",[967,968,969,979,991,997],"ul",{},[970,971,972,974,975,978],"li",{},[514,973,516],{}," needs ",[514,976,977],{},"network",". It is part of the sandbox, so a chain, node or task cannot change it.",[970,980,981,982,984,985,987,988,990],{},"A repository's own credential's ",[514,983,679],{}," must be named in the ",[514,986,606],{}," list of each phase its ",[514,989,885],{}," lists (either phase, when unset), and not denied there. A wildcard or a harness's hosts do not count.",[970,992,993,994,996],{},"A variable can be listed once per phase, and one header on one host set by one credential per phase. One name can therefore serve two entries whose ",[514,995,885],{}," lists do not overlap.",[970,998,999,1000,1002],{},"Anything else fails when ",[514,1001,292],{}," loads.",[735,1004,756],{"id":1005},"credentials-a-harness-declares",[510,1007,1008,1009,1012,1013,1016,1017,686,1020,761,1023,1026],{},"A harness file declares the variable, header and host for its CLI, so ",[514,1010,1011],{},"env: NAME"," alone is enough. ",[712,1014,408],{"href":1015},"\u002Freference\u002Fharnesses\u002Fharness-files#credentials"," lists what the shipped ",[514,1018,1019],{},"claude",[514,1021,1022],{},"codex",[514,1024,1025],{},"gemini"," files declare.",[967,1028,1029,1032],{},[970,1030,1031],{},"A CLI that pins its host's certificate, or needs HTTP\u002F2, cannot be managed this way, and its variable should stay unlisted.",[970,1033,1034],{},"A CLI whose harness does not declare the name gets the sentinel and nothing injected.",[735,1036,1038],{"id":1037},"how-credentials-work","How credentials work",[510,1040,1041,1042,1045],{},"When a session manages a credential, its container's CA bundle (mounted at ",[514,1043,1044],{},"\u002Fetc\u002Fkraft\u002Fca-bundle.pem",", as for an extra CA) also holds Kraft's own CA.",[510,1047,1048,1049,1052],{},"For a host with a managed credential that the session's phase allows by name, Kraft does not tunnel the ",[514,1050,1051],{},"CONNECT",". Instead the proxy:",[1054,1055,1056,1059,1062],"ol",{},[970,1057,1058],{},"Answers the worker's TLS itself, with a certificate Kraft's CA issued for exactly that host. It refuses a handshake that names another.",[970,1060,1061],{},"Makes its own TLS connection to the real host, verified against the server's own roots plus the extra CA, never Kraft's.",[970,1063,1064],{},"Passes each request on, one at a time, keep-alive and pipelined included.",[510,1066,1067],{},"A request is answered 403 and recorded as a refused host, and never reaches the host, when:",[967,1069,1070,1077,1082],{},[970,1071,1072,1073,1076],{},"its ",[514,1074,1075],{},"Host"," is not the host it connected to",[970,1078,1079,1080],{},"any instance of the credential's header is not exactly the sentinel in its ",[514,1081,699],{},[970,1083,1084],{},"it carries no managed credential's sentinel at all",[510,1086,1087],{},"That way the worker cannot use the route with a key of its own.",[510,1089,1090,1091,1094],{},"Otherwise every instance of the header is dropped and one set to the real value. A server that has no value refuses those requests rather than forward the sentinel. Every other host stays a blind tunnel, including one allowed only through a wildcard, and a plain ",[514,1092,1093],{},"http:\u002F\u002F"," request to a managed host is refused.",[735,1096,1098],{"id":1097},"where-the-value-is-kept","Where the value is kept",[510,1100,1101,1102,1105,1106,1108,1109,1111],{},"The value is read the way the rest of the worker's environment is: the server's own, a name in ",[514,1103,1104],{},"env_passthrough",", or ",[514,1107,632],{},". A credential with ",[514,1110,911],{}," reads the server's own variable of that name alone.",[510,1113,1114,1115,1118,1119,1122],{},"Kraft keeps it only in the server's memory and puts it only in the header on its way out. It is not in the container's environment, argv, mounts, ",[514,1116,1117],{},"docker inspect"," (which shows the sentinel), the ",[514,1120,1121],{},"docker"," client's environment, an event, a log line or the session's row.",[510,1124,1125,1128,1129,1131],{},[514,1126,1127],{},"kraft admin doctor"," lists, for each sandboxed repository with ",[514,1130,516],{},":",[967,1133,1134,1137],{},[970,1135,1136],{},"which names are managed and on which hosts",[970,1138,1139],{},"which names a harness declares that still pass through",[510,1141,1142,1143,1145,1146,1148,1149,1152,1153,1156],{},"A managed name with no value (under its ",[514,1144,911],{},", for one that has one) fails the row, and a credential with ",[514,1147,885],{}," says which. A name listed alone that no harness declares, such as ",[514,1150,1151],{},"OPENAI_API_KEY"," for Codex (whose name is ",[514,1154,1155],{},"CODEX_API_KEY","), warns, naming what each harness does declare: it holds only its sentinel and nothing injects it.",[735,1158,1160],{"id":1159},"credential-limits","Credential limits",[967,1162,1163,1181,1187,1221],{},[970,1164,1165,1169,1170,1173,1174,1177,1178,1180],{},[1166,1167,1168],"strong",{},"HTTP\u002F1.1 only."," The terminated connection offers only ",[514,1171,1172],{},"http\u002F1.1",", in both directions. A CLI that needs HTTP\u002F2 does not get it, and a WebSocket or any other upgrade does not work to a managed host: a ",[514,1175,1176],{},"101"," ends the connection. Codex opens a WebSocket to its host first. Against a stand-in host it falls back to HTTPS; whether it does when the real host's ",[514,1179,1176],{}," ends the connection is untested.",[970,1182,1183,1186],{},[1166,1184,1185],{},"Responses pass back as they are."," Only the request is rewritten. A host that echoed the real key in a response header or body would hand it to the worker; Kraft does not strip it.",[970,1188,1189,1195],{},[1166,1190,1191,1192,829],{},"Listing a credential does not clean the item's ",[514,1193,1194],{},"HOME",[967,1196,1197,1206,1209],{},[970,1198,1199,1200,686,1202,1205],{},"A sandboxed item keeps one ",[514,1201,1194],{},[514,1203,1204],{},"$KRAFT_HOME\u002Frun\u002Fsandbox-home\u002F\u003Cwork item id>",", across its sessions.",[970,1207,1208],{},"A session that ran before the variable was listed had the real value, and its CLI may have saved it there, in a login or config file.",[970,1210,1211,1212,1215,1216,1220],{},"To start clean, pause the item and delete that directory. Kraft makes an empty one at the next session, and that session starts without the CLI's saved state, so it cannot resume the earlier one. ",[514,1213,1214],{},"kraft view show"," prints the ",[712,1217,1219],{"href":1218},"\u002Fconcepts\u002Fvocabulary#work-item","work item"," id.",[970,1222,1223,1226,1227,1229],{},[1166,1224,1225],{},"After a server restart,"," a running session's credentials are restored with the rules it launched with, and their values are read again through the repository entry it launched with. If that repository has been disconnected, its ",[514,1228,292],{}," no longer loads, or the value is gone, its requests carrying the sentinel are refused until the item is retried.",[735,1231,1233],{"id":1232},"related","Related",[967,1235,1236,1244,1251],{},[970,1237,1238,1240,1241,1243],{},[712,1239,352],{"href":353},": the ",[514,1242,977],{}," a credential needs.",[970,1245,1246,552,1248,1250],{},[712,1247,364],{"href":365},[514,1249,516],{},", which binds a Kit's credentials to server variables.",[970,1252,1253,1255],{},[712,1254,131],{"href":132},": giving a harness its login outside a sandbox.",[1257,1258,1259],"style",{},"html pre.shiki code .sb7M8, html code.shiki .sb7M8{--shiki-light:#024C1A;--shiki-default:#024C1A;--shiki-dark:#72F088}html pre.shiki code .s7iLA, html code.shiki .s7iLA{--shiki-light:#0E1116;--shiki-default:#0E1116;--shiki-dark:#F0F3F6}html pre.shiki code .semJd, html code.shiki .semJd{--shiki-light:#032563;--shiki-default:#032563;--shiki-dark:#ADDCFF}html pre.shiki code .sq92B, html code.shiki .sq92B{--shiki-light:#66707B;--shiki-default:#66707B;--shiki-dark:#BDC4CC}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":525,"searchDepth":543,"depth":543,"links":1261},[1262,1267,1268,1269,1270,1271],{"id":737,"depth":543,"text":738,"children":1263},[1264,1265,1266],{"id":885,"depth":559,"text":885},{"id":911,"depth":559,"text":911},{"id":964,"depth":559,"text":965},{"id":1005,"depth":543,"text":756},{"id":1037,"depth":543,"text":1038},{"id":1097,"depth":543,"text":1098},{"id":1159,"depth":543,"text":1160},{"id":1232,"depth":543,"text":1233},"How a sandbox's credentials keep a secret out of the container while Kraft's proxy adds it to requests, and what that cannot do.","md",null,{},true,{"title":356,"description":1272},"YncJUjH8irhFZV6vMR9KlbeFAkimDmPsZsPFqhrh_cA",[1280,1282],{"title":352,"path":353,"stem":354,"description":1281,"children":-1},"How the hosts a sandboxed task may reach are listed, how Kraft enforces them, and what the policy does not cover.",{"title":360,"path":361,"stem":362,"description":1283,"children":-1},"How to declare a Kit as a repository's sandbox, and what Kraft enforces, reads and refuses.",1791801262585]