[{"data":1,"prerenderedAt":3612},["ShallowReactive",2],{"navigation_docs":3,"docs-page:\u002Fbuild\u002Fparts\u002Fconnections":1849,"docs-surround:\u002Fbuild\u002Fparts\u002Fconnections":3607},[4,72,214,304,947,1040,1230,1504,1590,1701,1830],{"title":5,"path":6,"stem":7,"children":8,"icon":71},"Get started","\u002Fgetting-started","01.getting-started\u002F00.index",[9,10,15,20,25,36],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","01.getting-started\u002F01.introduction","i-ph-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","01.getting-started\u002F02.quickstart","i-ph-rocket-launch",{"title":21,"path":22,"stem":23,"icon":24},"Concepts","\u002Fgetting-started\u002Fconcepts","01.getting-started\u002F03.concepts","i-ph-book-open",{"title":26,"path":27,"stem":28,"children":29,"icon":31},"Install","\u002Fgetting-started\u002Finstall","01.getting-started\u002F04.install\u002F00.index",[30,32],{"title":26,"path":27,"stem":28,"icon":31},"i-ph-download-simple",{"title":33,"path":34,"stem":35},"Prepare the Linux sandbox","\u002Fgetting-started\u002Finstall\u002Flinux-sandbox","01.getting-started\u002F04.install\u002F01.linux-sandbox",{"title":37,"path":38,"stem":39,"children":40,"icon":42},"Web UI","\u002Fgetting-started\u002Fweb-ui","01.getting-started\u002F05.web-ui\u002F00.index",[41,43,47,51,55,59,63,67],{"title":37,"path":38,"stem":39,"icon":42},"i-ph-monitor",{"title":44,"path":45,"stem":46},"Choose a tenant","\u002Fgetting-started\u002Fweb-ui\u002Ftenants","01.getting-started\u002F05.web-ui\u002F01.tenants",{"title":48,"path":49,"stem":50},"Find a page","\u002Fgetting-started\u002Fweb-ui\u002Fnavigation","01.getting-started\u002F05.web-ui\u002F02.navigation",{"title":52,"path":53,"stem":54},"Use the chat drawer","\u002Fgetting-started\u002Fweb-ui\u002Fchats","01.getting-started\u002F05.web-ui\u002F03.chats",{"title":56,"path":57,"stem":58},"Create and edit records","\u002Fgetting-started\u002Fweb-ui\u002Fforms","01.getting-started\u002F05.web-ui\u002F04.forms",{"title":60,"path":61,"stem":62},"Keyboard and accessibility","\u002Fgetting-started\u002Fweb-ui\u002Faccessibility","01.getting-started\u002F05.web-ui\u002F05.accessibility",{"title":64,"path":65,"stem":66},"Accounts and permissions","\u002Fgetting-started\u002Fweb-ui\u002Faccounts","01.getting-started\u002F05.web-ui\u002F06.accounts",{"title":68,"path":69,"stem":70},"Console page directory","\u002Fgetting-started\u002Fweb-ui\u002Fpage-directory","01.getting-started\u002F05.web-ui\u002F07.page-directory",false,{"title":21,"path":73,"stem":74,"children":75,"icon":71},"\u002Fconcepts","02.concepts\u002F00.index",[76,77,82,87,92,123,128,143,166,185,204,209],{"title":21,"path":73,"stem":74},{"title":78,"path":79,"stem":80,"icon":81},"Architecture","\u002Fconcepts\u002Farchitecture","02.concepts\u002F01.architecture","i-ph-planet",{"title":83,"path":84,"stem":85,"icon":86},"Jobs and durability","\u002Fconcepts\u002Fjobs","02.concepts\u002F02.jobs","i-ph-infinity",{"title":88,"path":89,"stem":90,"icon":91},"Routing","\u002Fconcepts\u002Frouting","02.concepts\u002F03.routing","i-ph-path",{"title":93,"path":94,"stem":95,"children":96,"icon":98},"Security model","\u002Fconcepts\u002Fsecurity","02.concepts\u002F04.security\u002F00.index",[97,99,103,107,111,115,119],{"title":93,"path":94,"stem":95,"icon":98},"i-ph-shield-check",{"title":100,"path":101,"stem":102},"Node identity and tenant secrets","\u002Fconcepts\u002Fsecurity\u002Fidentity-and-secrets","02.concepts\u002F04.security\u002F01.identity-and-secrets",{"title":104,"path":105,"stem":106},"Plugin processes and operator exemptions","\u002Fconcepts\u002Fsecurity\u002Fplugins","02.concepts\u002F04.security\u002F02.plugins",{"title":108,"path":109,"stem":110},"Sandbox tiers and routing","\u002Fconcepts\u002Fsecurity\u002Fsandbox-tiers","02.concepts\u002F04.security\u002F03.sandbox-tiers",{"title":112,"path":113,"stem":114},"Sandbox egress rules","\u002Fconcepts\u002Fsecurity\u002Fegress","02.concepts\u002F04.security\u002F04.egress",{"title":116,"path":117,"stem":118},"Protected files and sandbox limits","\u002Fconcepts\u002Fsecurity\u002Fprotected-files","02.concepts\u002F04.security\u002F05.protected-files",{"title":120,"path":121,"stem":122},"Security assurance","\u002Fconcepts\u002Fsecurity\u002Fassurance","02.concepts\u002F04.security\u002F06.assurance",{"title":124,"path":125,"stem":126,"icon":127},"Temporal","\u002Fconcepts\u002Ftemporal","02.concepts\u002F05.temporal","i-ph-clock",{"title":129,"path":130,"stem":131,"children":132,"icon":134},"Limits and scaling","\u002Fconcepts\u002Flimits-and-scaling","02.concepts\u002F06.limits-and-scaling\u002F00.index",[133,135,139],{"title":129,"path":130,"stem":131,"icon":134},"i-ph-gauge",{"title":136,"path":137,"stem":138},"Tenant and queue limits","\u002Fconcepts\u002Flimits-and-scaling\u002Flimits","02.concepts\u002F06.limits-and-scaling\u002F01.limits",{"title":140,"path":141,"stem":142},"Capacity measurements","\u002Fconcepts\u002Flimits-and-scaling\u002Fmeasurements","02.concepts\u002F06.limits-and-scaling\u002F02.measurements",{"title":144,"path":145,"stem":146,"children":147,"icon":149},"Threat model","\u002Fconcepts\u002Fthreat-model","02.concepts\u002F07.threat-model\u002F00.index",[148,150,154,158,162],{"title":144,"path":145,"stem":146,"icon":149},"i-ph-crosshair",{"title":151,"path":152,"stem":153},"Trust boundaries and compromise","\u002Fconcepts\u002Fthreat-model\u002Ftrust-boundaries","02.concepts\u002F07.threat-model\u002F01.trust-boundaries",{"title":155,"path":156,"stem":157},"Harness and tool boundaries","\u002Fconcepts\u002Fthreat-model\u002Fharness-tools","02.concepts\u002F07.threat-model\u002F02.harness-tools",{"title":159,"path":160,"stem":161},"Known security gaps","\u002Fconcepts\u002Fthreat-model\u002Fknown-gaps","02.concepts\u002F07.threat-model\u002F03.known-gaps",{"title":163,"path":164,"stem":165},"Origins, sequences and tool results","\u002Fconcepts\u002Fthreat-model\u002Forigins-and-results","02.concepts\u002F07.threat-model\u002F04.origins-and-results",{"title":167,"path":168,"stem":169,"children":170,"icon":172},"Outbound connections","\u002Fconcepts\u002Foutbound-connections","02.concepts\u002F08.outbound-connections\u002F00.index",[171,173,177,181],{"title":167,"path":168,"stem":169,"icon":172},"i-ph-arrow-square-out",{"title":174,"path":175,"stem":176},"Server outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fserver","02.concepts\u002F08.outbound-connections\u002F01.server",{"title":178,"path":179,"stem":180},"Node and plugin outbound connections","\u002Fconcepts\u002Foutbound-connections\u002Fnodes-and-plugins","02.concepts\u002F08.outbound-connections\u002F02.nodes-and-plugins",{"title":182,"path":183,"stem":184},"Addresses a model provider fetches","\u002Fconcepts\u002Foutbound-connections\u002Fprovider-fetches","02.concepts\u002F08.outbound-connections\u002F03.provider-fetches",{"title":186,"path":187,"stem":188,"children":189,"icon":191},"Run receipts","\u002Fconcepts\u002Frun-receipts","02.concepts\u002F09.run-receipts\u002F00.index",[190,192,196,200],{"title":186,"path":187,"stem":188,"icon":191},"i-ph-receipt",{"title":193,"path":194,"stem":195},"Authority envelopes and delegation","\u002Fconcepts\u002Frun-receipts\u002Fauthority","02.concepts\u002F09.run-receipts\u002F01.authority",{"title":197,"path":198,"stem":199},"Call bindings and budget charges","\u002Fconcepts\u002Frun-receipts\u002Fcalls-and-charges","02.concepts\u002F09.run-receipts\u002F02.calls-and-charges",{"title":201,"path":202,"stem":203},"Verify run receipts offline","\u002Fconcepts\u002Frun-receipts\u002Fverify","02.concepts\u002F09.run-receipts\u002F03.verify",{"title":205,"path":206,"stem":207,"icon":208},"Delegation and identity","\u002Fconcepts\u002Fdelegation-and-identity","02.concepts\u002F10.delegation-and-identity","i-ph-identification-badge",{"title":210,"path":211,"stem":212,"icon":213},"How a tool call is decided","\u002Fconcepts\u002Fhow-a-tool-call-is-decided","02.concepts\u002F11.how-a-tool-call-is-decided","i-ph-list-checks",{"title":215,"path":216,"stem":217,"children":218,"icon":71},"Run","\u002Fagents","03.agents\u002F00.index",[219,221,226,231,236,240,245,250,268,299],{"title":220,"path":216,"stem":217},"Run agents",{"title":222,"path":223,"stem":224,"icon":225},"Run jobs","\u002Fagents\u002Frun-jobs","03.agents\u002F01.run-jobs","i-ph-play",{"title":227,"path":228,"stem":229,"icon":230},"Job history","\u002Fagents\u002Fhistory","03.agents\u002F02.history","i-ph-clock-counter-clockwise",{"title":232,"path":233,"stem":234,"icon":235},"Long jobs","\u002Fagents\u002Flong-jobs","03.agents\u002F03.long-jobs","i-ph-hourglass-medium",{"title":237,"path":238,"stem":239,"icon":235},"Waiting for events","\u002Fagents\u002Fwaiting-for-events","03.agents\u002F04.waiting-for-events",{"title":241,"path":242,"stem":243,"icon":244},"Delegation","\u002Fagents\u002Fdelegation","03.agents\u002F05.delegation","i-ph-git-fork",{"title":246,"path":247,"stem":248,"icon":249},"Colleagues and the board","\u002Fagents\u002Fcolleagues","03.agents\u002F06.colleagues","i-ph-chats-circle",{"title":251,"path":252,"stem":253,"children":254,"icon":249},"Conversations","\u002Fagents\u002Fconversations","03.agents\u002F07.conversations\u002F00.index",[255,256,260,264],{"title":251,"path":252,"stem":253,"icon":249},{"title":257,"path":258,"stem":259},"Conversation access and history","\u002Fagents\u002Fconversations\u002Faccess-and-history","03.agents\u002F07.conversations\u002F02.access-and-history",{"title":261,"path":262,"stem":263},"Use conversations from an app","\u002Fagents\u002Fconversations\u002Fapps","03.agents\u002F07.conversations\u002F03.apps",{"title":265,"path":266,"stem":267},"Hand off a conversation and use Ask","\u002Fagents\u002Fconversations\u002Fhandoffs-and-ask","03.agents\u002F07.conversations\u002F04.handoffs-and-ask",{"title":269,"path":270,"stem":271,"children":272,"icon":274},"Decide an approval","\u002Fagents\u002Fapprovals","03.agents\u002F08.approvals\u002F00.index",[273,275,279,283,287,291,295],{"title":269,"path":270,"stem":271,"icon":274},"i-ph-hand-palm",{"title":276,"path":277,"stem":278},"Configure approval ownership and deadlines","\u002Fagents\u002Fapprovals\u002Fconfigure","03.agents\u002F08.approvals\u002F02.configure",{"title":280,"path":281,"stem":282},"How approval decisions bind a call","\u002Fagents\u002Fapprovals\u002Fsecurity","03.agents\u002F08.approvals\u002F03.security",{"title":284,"path":285,"stem":286},"Edit an approval or allow repeated calls","\u002Fagents\u002Fapprovals\u002Fedits-and-repeat-calls","03.agents\u002F08.approvals\u002F04.edits-and-repeat-calls",{"title":288,"path":289,"stem":290},"Resolve loop, budget and recovery waits","\u002Fagents\u002Fapprovals\u002Frecovery","03.agents\u002F08.approvals\u002F05.recovery",{"title":292,"path":293,"stem":294},"Review approval statistics and test cards","\u002Fagents\u002Fapprovals\u002Fstatistics","03.agents\u002F08.approvals\u002F06.statistics",{"title":296,"path":297,"stem":298},"Decide approvals from an app","\u002Fagents\u002Fapprovals\u002Fapps","03.agents\u002F08.approvals\u002F07.apps",{"title":300,"path":301,"stem":302,"icon":303},"Asking people","\u002Fagents\u002Fasking-people","03.agents\u002F09.asking-people","i-ph-chat-circle-dots",{"title":305,"path":306,"stem":307,"children":308,"icon":71},"Build","\u002Fbuild","04.build\u002F00.index",[309,310,655,844],{"title":305,"path":306,"stem":307},{"title":311,"path":312,"stem":313,"children":314,"icon":71},"Plugins","\u002Fbuild\u002Fplugins","04.build\u002F01.plugins\u002F00.index",[315,316,321,352,357,362,367,378,397,412,417,422,427,442,447,452,457,472,476,481,492,497,502,640],{"title":311,"path":312,"stem":313},{"title":317,"path":318,"stem":319,"icon":320},"What a plugin is","\u002Fbuild\u002Fplugins\u002Foverview","04.build\u002F01.plugins\u002F01.overview","i-ph-puzzle-piece",{"title":322,"path":323,"stem":324,"children":325,"icon":327},"Install a plugin","\u002Fbuild\u002Fplugins\u002Finstall","04.build\u002F01.plugins\u002F02.install\u002F00.index",[326,328,332,336,340,344,348],{"title":322,"path":323,"stem":324,"icon":327},"i-ph-package",{"title":329,"path":330,"stem":331,"icon":327},"Review an install","\u002Fbuild\u002Fplugins\u002Finstall\u002Freview","04.build\u002F01.plugins\u002F02.install\u002F01.review",{"title":333,"path":334,"stem":335,"icon":327},"Install from a source","\u002Fbuild\u002Fplugins\u002Finstall\u002Fsources","04.build\u002F01.plugins\u002F02.install\u002F02.sources",{"title":337,"path":338,"stem":339,"icon":327},"Update a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fupdate","04.build\u002F01.plugins\u002F02.install\u002F03.update",{"title":341,"path":342,"stem":343,"icon":327},"Roll out a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Frollouts","04.build\u002F01.plugins\u002F02.install\u002F04.rollouts",{"title":345,"path":346,"stem":347,"icon":327},"Grant access between plugins","\u002Fbuild\u002Fplugins\u002Finstall\u002Fgrants","04.build\u002F01.plugins\u002F02.install\u002F05.grants",{"title":349,"path":350,"stem":351,"icon":327},"Retire or remove a plugin","\u002Fbuild\u002Fplugins\u002Finstall\u002Fretire-and-remove","04.build\u002F01.plugins\u002F02.install\u002F06.retire-and-remove",{"title":353,"path":354,"stem":355,"icon":356},"Configure an installed plugin","\u002Fbuild\u002Fplugins\u002Fconfigure","04.build\u002F01.plugins\u002F03.configure","i-ph-sliders-horizontal",{"title":358,"path":359,"stem":360,"icon":361},"Sets","\u002Fbuild\u002Fplugins\u002Fsets","04.build\u002F01.plugins\u002F04.sets","i-ph-stack",{"title":363,"path":364,"stem":365,"icon":366},"Your first plugin","\u002Fbuild\u002Fplugins\u002Ffirst-plugin","04.build\u002F01.plugins\u002F05.first-plugin","i-ph-hammer",{"title":368,"path":369,"stem":370,"children":371,"icon":373},"Structure a plugin","\u002Fbuild\u002Fplugins\u002Fstructure","04.build\u002F01.plugins\u002F06.structure\u002F00.index",[372,374],{"title":368,"path":369,"stem":370,"icon":373},"i-ph-tree-structure",{"title":375,"path":376,"stem":377,"icon":373},"Plugin structure rules","\u002Fbuild\u002Fplugins\u002Fstructure\u002Flint-rules","04.build\u002F01.plugins\u002F06.structure\u002F01.lint-rules",{"title":379,"path":380,"stem":381,"children":382,"icon":384},"Develop a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test","04.build\u002F01.plugins\u002F07.develop-and-test\u002F00.index",[383,385,389,393],{"title":379,"path":380,"stem":381,"icon":384},"i-ph-flask",{"title":386,"path":387,"stem":388,"icon":384},"Check a plugin candidate","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Fcandidate-checks","04.build\u002F01.plugins\u002F07.develop-and-test\u002F01.candidate-checks",{"title":390,"path":391,"stem":392,"icon":384},"Lint and test a plugin","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Flint-and-tests","04.build\u002F01.plugins\u002F07.develop-and-test\u002F02.lint-and-tests",{"title":394,"path":395,"stem":396,"icon":384},"Run failure drills","\u002Fbuild\u002Fplugins\u002Fdevelop-and-test\u002Ftests-and-drills","04.build\u002F01.plugins\u002F07.develop-and-test\u002F03.tests-and-drills",{"title":398,"path":399,"stem":400,"children":401,"icon":403},"Build in Studio","\u002Fbuild\u002Fplugins\u002Fstudio","04.build\u002F01.plugins\u002F08.studio\u002F00.index",[402,404,408],{"title":398,"path":399,"stem":400,"icon":403},"i-ph-code",{"title":405,"path":406,"stem":407,"icon":403},"Test and explain a draft","\u002Fbuild\u002Fplugins\u002Fstudio\u002Ftest-and-explain","04.build\u002F01.plugins\u002F08.studio\u002F01.test-and-explain",{"title":409,"path":410,"stem":411,"icon":403},"Release a workspace plugin","\u002Fbuild\u002Fplugins\u002Fstudio\u002Frelease","04.build\u002F01.plugins\u002F08.studio\u002F02.release",{"title":413,"path":414,"stem":415,"icon":416},"The build kit","\u002Fbuild\u002Fplugins\u002Fclaude-code","04.build\u002F01.plugins\u002F09.claude-code","i-ph-sparkle",{"title":418,"path":419,"stem":420,"icon":421},"Example: support triage","\u002Fbuild\u002Fplugins\u002Fexample-support-triage","04.build\u002F01.plugins\u002F10.example-support-triage","i-ph-lifebuoy",{"title":423,"path":424,"stem":425,"icon":426},"Publish and version","\u002Fbuild\u002Fplugins\u002Fpublish","04.build\u002F01.plugins\u002F11.publish","i-ph-tag",{"title":428,"path":429,"stem":430,"children":431,"icon":433},"List a plugin","\u002Fbuild\u002Fplugins\u002Flist-a-plugin","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F00.index",[432,434,438],{"title":428,"path":429,"stem":430,"icon":433},"i-ph-storefront",{"title":435,"path":436,"stem":437,"icon":433},"Hub review checks","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Freview","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F01.review",{"title":439,"path":440,"stem":441,"icon":433},"Maintain a listing","\u002Fbuild\u002Fplugins\u002Flist-a-plugin\u002Fmaintain","04.build\u002F01.plugins\u002F12.list-a-plugin\u002F02.maintain",{"title":443,"path":444,"stem":445,"icon":446},"The catalog","\u002Fbuild\u002Fplugins\u002Fcatalog","04.build\u002F01.plugins\u002F13.catalog","i-ph-books",{"title":448,"path":449,"stem":450,"icon":451},"Folders, bundles and OCI","\u002Fbuild\u002Fplugins\u002Fsources","04.build\u002F01.plugins\u002F14.sources","i-ph-archive",{"title":453,"path":454,"stem":455,"icon":456},"The workspace","\u002Fbuild\u002Fplugins\u002Fworkspace","04.build\u002F01.plugins\u002F15.workspace","i-ph-folder-notch-open",{"title":458,"path":459,"stem":460,"children":461,"icon":463},"Use a plugin index","\u002Fbuild\u002Fplugins\u002Findexes","04.build\u002F01.plugins\u002F16.indexes\u002F00.index",[462,464,468],{"title":458,"path":459,"stem":460,"icon":463},"i-ph-seal-check",{"title":465,"path":466,"stem":467,"icon":463},"Read index version records","\u002Fbuild\u002Fplugins\u002Findexes\u002Fversion-records","04.build\u002F01.plugins\u002F16.indexes\u002F01.version-records",{"title":469,"path":470,"stem":471,"icon":463},"Manage plugin indexes","\u002Fbuild\u002Fplugins\u002Findexes\u002Fmanage","04.build\u002F01.plugins\u002F16.indexes\u002F02.manage",{"title":473,"path":474,"stem":475,"icon":327},"Existing MCP packages","\u002Fbuild\u002Fplugins\u002Fpackages","04.build\u002F01.plugins\u002F17.packages",{"title":477,"path":478,"stem":479,"icon":480},"MCP servers from container images","\u002Fbuild\u002Fplugins\u002Fcontainer-images","04.build\u002F01.plugins\u002F18.container-images","i-ph-cube",{"title":482,"path":483,"stem":484,"children":485,"icon":487},"Import agent plugins","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F00.index",[486,488],{"title":482,"path":483,"stem":484,"icon":487},"i-ph-arrow-square-in",{"title":489,"path":490,"stem":491,"icon":487},"Import from registries","\u002Fbuild\u002Fplugins\u002Fclaude-code-and-agent-plugins\u002Fmarketplaces","04.build\u002F01.plugins\u002F19.claude-code-and-agent-plugins\u002F01.marketplaces",{"title":493,"path":494,"stem":495,"icon":496},"GitHub","\u002Fbuild\u002Fplugins\u002Fgithub","04.build\u002F01.plugins\u002F20.github","i-ph-github-logo",{"title":498,"path":499,"stem":500,"icon":501},"Known vulnerabilities","\u002Fbuild\u002Fplugins\u002Fvulnerabilities","04.build\u002F01.plugins\u002F21.vulnerabilities","i-ph-shield-warning",{"title":503,"path":504,"stem":505,"children":506,"icon":71},"Verified plugins","\u002Fbuild\u002Fplugins\u002Fverified","04.build\u002F01.plugins\u002F22.verified\u002F01.index",[507,508,513,518,523,528,533,538,543,548,553,558,580,585,589,594,599,604,608,612,617,622,626],{"title":503,"path":504,"stem":505,"icon":463},{"title":509,"path":510,"stem":511,"icon":512},"ai.oz0\u002Fweb","\u002Fbuild\u002Fplugins\u002Fverified\u002Fweb","04.build\u002F01.plugins\u002F22.verified\u002F02.web","i-ph-globe",{"title":514,"path":515,"stem":516,"icon":517},"ai.oz0\u002Fnet-diag","\u002Fbuild\u002Fplugins\u002Fverified\u002Fnet-diag","04.build\u002F01.plugins\u002F22.verified\u002F03.net-diag","i-ph-network",{"title":519,"path":520,"stem":521,"icon":522},"ai.oz0\u002Fcve-triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fcve-triage","04.build\u002F01.plugins\u002F22.verified\u002F04.cve-triage","i-ph-bug",{"title":524,"path":525,"stem":526,"icon":527},"ai.oz0\u002Fhost-health","\u002Fbuild\u002Fplugins\u002Fverified\u002Fhost-health","04.build\u002F01.plugins\u002F22.verified\u002F05.host-health","i-ph-heartbeat",{"title":529,"path":530,"stem":531,"icon":532},"ai.oz0\u002Fpr-reviewer","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpr-reviewer","04.build\u002F01.plugins\u002F22.verified\u002F06.pr-reviewer","i-ph-git-pull-request",{"title":534,"path":535,"stem":536,"icon":537},"Slack","\u002Fbuild\u002Fplugins\u002Fverified\u002Fslack","04.build\u002F01.plugins\u002F22.verified\u002F07.slack","i-ph-slack-logo",{"title":539,"path":540,"stem":541,"icon":542},"Discord","\u002Fbuild\u002Fplugins\u002Fverified\u002Fdiscord","04.build\u002F01.plugins\u002F22.verified\u002F08.discord","i-ph-discord-logo",{"title":544,"path":545,"stem":546,"icon":547},"Microsoft Teams","\u002Fbuild\u002Fplugins\u002Fverified\u002Fteams","04.build\u002F01.plugins\u002F22.verified\u002F09.teams","i-ph-microsoft-teams-logo",{"title":549,"path":550,"stem":551,"icon":552},"ai.oz0\u002Fai-spend","\u002Fbuild\u002Fplugins\u002Fverified\u002Fai-spend","04.build\u002F01.plugins\u002F22.verified\u002F10.ai-spend","i-ph-coins",{"title":554,"path":555,"stem":556,"icon":557},"ai.oz0\u002Fa2a-remote","\u002Fbuild\u002Fplugins\u002Fverified\u002Fa2a-remote","04.build\u002F01.plugins\u002F22.verified\u002F11.a2a-remote","i-ph-arrows-left-right",{"title":559,"path":560,"stem":561,"children":562,"icon":98},"Guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F00.index",[563,564,568,572,576],{"title":559,"path":560,"stem":561,"icon":98},{"title":565,"path":566,"stem":567,"icon":98},"Configure guardrails","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fsettings","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F01.settings",{"title":569,"path":570,"stem":571,"icon":98},"Check classified text","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fclassified-text","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F02.classified-text",{"title":573,"path":574,"stem":575,"icon":98},"Check shell commands","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fcommands","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F03.commands",{"title":577,"path":578,"stem":579,"icon":98},"Guardrail coverage and limits","\u002Fbuild\u002Fplugins\u002Fverified\u002Fguardrails\u002Fintent-and-limits","04.build\u002F01.plugins\u002F22.verified\u002F12.guardrails\u002F04.intent-and-limits",{"title":581,"path":582,"stem":583,"icon":584},"ai.oz0\u002Fmemory","\u002Fbuild\u002Fplugins\u002Fverified\u002Fmemory","04.build\u002F01.plugins\u002F22.verified\u002F13.memory","i-ph-brain",{"title":586,"path":587,"stem":588,"icon":416},"ai.oz0\u002Fsetup-assistant","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsetup-assistant","04.build\u002F01.plugins\u002F22.verified\u002F14.setup-assistant",{"title":590,"path":591,"stem":592,"icon":593},"ai.oz0\u002Fpublic-access","\u002Fbuild\u002Fplugins\u002Fverified\u002Fpublic-access","04.build\u002F01.plugins\u002F22.verified\u002F15.public-access","i-ph-files",{"title":595,"path":596,"stem":597,"icon":598},"ai.oz0\u002Femail","\u002Fbuild\u002Fplugins\u002Fverified\u002Femail","04.build\u002F01.plugins\u002F22.verified\u002F16.email","i-ph-envelope-simple",{"title":600,"path":601,"stem":602,"icon":603},"Atlassian Cloud","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian","04.build\u002F01.plugins\u002F22.verified\u002F17.atlassian","i-ph-kanban",{"title":605,"path":606,"stem":607,"icon":603},"Atlassian Data Center","\u002Fbuild\u002Fplugins\u002Fverified\u002Fatlassian-dc","04.build\u002F01.plugins\u002F22.verified\u002F18.atlassian-dc",{"title":609,"path":610,"stem":611,"icon":421},"ServiceNow","\u002Fbuild\u002Fplugins\u002Fverified\u002Fservicenow","04.build\u002F01.plugins\u002F22.verified\u002F19.servicenow",{"title":613,"path":614,"stem":615,"icon":616},"GitLab","\u002Fbuild\u002Fplugins\u002Fverified\u002Fgitlab","04.build\u002F01.plugins\u002F22.verified\u002F20.gitlab","i-ph-git-merge",{"title":618,"path":619,"stem":620,"icon":621},"Support triage","\u002Fbuild\u002Fplugins\u002Fverified\u002Fsupport-triage","04.build\u002F01.plugins\u002F22.verified\u002F21.support-triage","i-ph-ticket",{"title":623,"path":624,"stem":625,"icon":361},"Essentials","\u002Fbuild\u002Fplugins\u002Fverified\u002Fessentials","04.build\u002F01.plugins\u002F22.verified\u002F22.essentials",{"title":627,"path":628,"stem":629,"children":630,"icon":532},"Plugin improver","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F00.index",[631,632,636],{"title":627,"path":628,"stem":629,"icon":532},{"title":633,"path":634,"stem":635,"icon":532},"How an improvement runs","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Fjob-lifecycle","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F01.job-lifecycle",{"title":637,"path":638,"stem":639,"icon":532},"Improver limits and records","\u002Fbuild\u002Fplugins\u002Fverified\u002Fplugin-improver\u002Flimits-and-records","04.build\u002F01.plugins\u002F22.verified\u002F23.plugin-improver\u002F02.limits-and-records",{"title":641,"path":642,"stem":643,"children":644,"icon":646},"Plugin size limits","\u002Fbuild\u002Fplugins\u002Flimits","04.build\u002F01.plugins\u002F23.limits\u002F00.index",[645,647,651],{"title":641,"path":642,"stem":643,"icon":646},"i-ph-ruler",{"title":648,"path":649,"stem":650,"icon":646},"Documentation limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fdocumentation","04.build\u002F01.plugins\u002F23.limits\u002F01.documentation",{"title":652,"path":653,"stem":654,"icon":646},"Artifact and index limits","\u002Fbuild\u002Fplugins\u002Flimits\u002Fartifacts","04.build\u002F01.plugins\u002F23.limits\u002F02.artifacts",{"title":656,"path":657,"stem":658,"children":659,"icon":71},"Parts","\u002Fbuild\u002Fparts","04.build\u002F02.parts\u002F00.index",[660,662,667,672,690,721,726,730,741,756,761,776,791,814,818,823,828,839],{"title":661,"path":657,"stem":658},"Plugin parts",{"title":663,"path":664,"stem":665,"icon":666},"Agents","\u002Fbuild\u002Fparts\u002Fagents","04.build\u002F02.parts\u002F01.agents","i-ph-robot",{"title":668,"path":669,"stem":670,"icon":671},"What an agent combines","\u002Fbuild\u002Fparts\u002Fwhat-an-agent-combines","04.build\u002F02.parts\u002F02.what-an-agent-combines","i-ph-intersect-three",{"title":673,"path":674,"stem":675,"children":676,"icon":646},"Agent contracts","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F00.index",[677,678,682,686],{"title":673,"path":674,"stem":675,"icon":646},{"title":679,"path":680,"stem":681,"icon":646},"Agent failure kinds","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Ffailures","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F01.failures",{"title":683,"path":684,"stem":685,"icon":646},"Agent limits","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Flimits","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F02.limits",{"title":687,"path":688,"stem":689,"icon":646},"Agent budgets","\u002Fbuild\u002Fparts\u002Fcontracts-and-limits\u002Fbudgets","04.build\u002F02.parts\u002F03.contracts-and-limits\u002F03.budgets",{"title":691,"path":692,"stem":693,"children":694,"icon":696},"Write a tool","\u002Fbuild\u002Fparts\u002Ftools","04.build\u002F02.parts\u002F04.tools\u002F00.index",[695,697,701,705,709,713,717],{"title":691,"path":692,"stem":693,"icon":696},"i-ph-wrench",{"title":698,"path":699,"stem":700,"icon":696},"Describe tool functions","\u002Fbuild\u002Fparts\u002Ftools\u002Fdefinitions","04.build\u002F02.parts\u002F04.tools\u002F01.definitions",{"title":702,"path":703,"stem":704,"icon":696},"Return results and files","\u002Fbuild\u002Fparts\u002Ftools\u002Fresults-and-files","04.build\u002F02.parts\u002F04.tools\u002F02.results-and-files",{"title":706,"path":707,"stem":708,"icon":696},"Handle tool call lifecycle","\u002Fbuild\u002Fparts\u002Ftools\u002Fcall-lifecycle","04.build\u002F02.parts\u002F04.tools\u002F03.call-lifecycle",{"title":710,"path":711,"stem":712,"icon":696},"Pin tool definitions","\u002Fbuild\u002Fparts\u002Ftools\u002Fsnapshots","04.build\u002F02.parts\u002F04.tools\u002F04.snapshots",{"title":714,"path":715,"stem":716,"icon":696},"Call a model from a tool","\u002Fbuild\u002Fparts\u002Ftools\u002Fmodel-calls","04.build\u002F02.parts\u002F04.tools\u002F05.model-calls",{"title":718,"path":719,"stem":720,"icon":696},"Tool labels and approvals","\u002Fbuild\u002Fparts\u002Ftools\u002Fpolicy","04.build\u002F02.parts\u002F04.tools\u002F06.policy",{"title":722,"path":723,"stem":724,"icon":725},"TypeScript tools","\u002Fbuild\u002Fparts\u002Ftypescript-tools","04.build\u002F02.parts\u002F05.typescript-tools","i-ph-file-code",{"title":727,"path":728,"stem":729,"icon":725},"Import an OpenAPI document","\u002Fbuild\u002Fparts\u002Fopenapi-import","04.build\u002F02.parts\u002F06.openapi-import",{"title":731,"path":732,"stem":733,"children":734,"icon":736},"Write and load skills","\u002Fbuild\u002Fparts\u002Fskills","04.build\u002F02.parts\u002F07.skills\u002F00.index",[735,737],{"title":731,"path":732,"stem":733,"icon":736},"i-ph-graduation-cap",{"title":738,"path":739,"stem":740,"icon":736},"Review skill use and proposals","\u002Fbuild\u002Fparts\u002Fskills\u002Fusage-and-proposals","04.build\u002F02.parts\u002F07.skills\u002F01.usage-and-proposals",{"title":742,"path":743,"stem":744,"children":745,"icon":747},"Write a flow","\u002Fbuild\u002Fparts\u002Fflows","04.build\u002F02.parts\u002F08.flows\u002F00.index",[746,748,752],{"title":742,"path":743,"stem":744,"icon":747},"i-ph-flow-arrow",{"title":749,"path":750,"stem":751,"icon":747},"Flow steps and expressions","\u002Fbuild\u002Fparts\u002Fflows\u002Fsteps-and-expressions","04.build\u002F02.parts\u002F08.flows\u002F01.steps-and-expressions",{"title":753,"path":754,"stem":755,"icon":747},"Expose and explain flows","\u002Fbuild\u002Fparts\u002Fflows\u002Fflow-tools","04.build\u002F02.parts\u002F08.flows\u002F02.flow-tools",{"title":757,"path":758,"stem":759,"icon":760},"Hooks","\u002Fbuild\u002Fparts\u002Fhooks","04.build\u002F02.parts\u002F09.hooks","i-ph-anchor",{"title":762,"path":763,"stem":764,"children":765,"icon":767},"Declare an event source","\u002Fbuild\u002Fparts\u002Fevent-sources","04.build\u002F02.parts\u002F10.event-sources\u002F00.index",[766,768,772],{"title":762,"path":763,"stem":764,"icon":767},"i-ph-broadcast",{"title":769,"path":770,"stem":771,"icon":767},"Bind and answer deliveries","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fdelivery-binding","04.build\u002F02.parts\u002F10.event-sources\u002F01.delivery-binding",{"title":773,"path":774,"stem":775,"icon":767},"Use platform events","\u002Fbuild\u002Fparts\u002Fevent-sources\u002Fplatform-events","04.build\u002F02.parts\u002F10.event-sources\u002F02.platform-events",{"title":777,"path":778,"stem":779,"children":780,"icon":782},"Declare a connection","\u002Fbuild\u002Fparts\u002Fconnections","04.build\u002F02.parts\u002F11.connections\u002F00.index",[781,783,787],{"title":777,"path":778,"stem":779,"icon":782},"i-ph-plugs-connected",{"title":784,"path":785,"stem":786,"icon":782},"Connection token lifecycle","\u002Fbuild\u002Fparts\u002Fconnections\u002Ftoken-lifecycle","04.build\u002F02.parts\u002F11.connections\u002F01.token-lifecycle",{"title":788,"path":789,"stem":790,"icon":782},"Connection setup and security","\u002Fbuild\u002Fparts\u002Fconnections\u002Fsetup-and-security","04.build\u002F02.parts\u002F11.connections\u002F02.setup-and-security",{"title":792,"path":793,"stem":794,"children":795,"icon":797},"Choose a harness","\u002Fbuild\u002Fparts\u002Fharnesses","04.build\u002F02.parts\u002F12.harnesses\u002F00.index",[796,798,802,806,810],{"title":792,"path":793,"stem":794,"icon":797},"i-ph-cpu",{"title":799,"path":800,"stem":801,"icon":797},"Harness tool controls","\u002Fbuild\u002Fparts\u002Fharnesses\u002Ftool-controls","04.build\u002F02.parts\u002F12.harnesses\u002F01.tool-controls",{"title":803,"path":804,"stem":805,"icon":797},"Recover a harness session","\u002Fbuild\u002Fparts\u002Fharnesses\u002Frecovery","04.build\u002F02.parts\u002F12.harnesses\u002F02.recovery",{"title":807,"path":808,"stem":809,"icon":797},"Write a harness","\u002Fbuild\u002Fparts\u002Fharnesses\u002Fcustom-harnesses","04.build\u002F02.parts\u002F12.harnesses\u002F03.custom-harnesses",{"title":811,"path":812,"stem":813,"icon":797},"Use an ACP agent","\u002Fbuild\u002Fparts\u002Fharnesses\u002Facp","04.build\u002F02.parts\u002F12.harnesses\u002F04.acp",{"title":815,"path":816,"stem":817,"icon":782},"Bring your own agent","\u002Fbuild\u002Fparts\u002Fbring-your-own-agent","04.build\u002F02.parts\u002F13.bring-your-own-agent",{"title":819,"path":820,"stem":821,"icon":822},"Records and start-up text","\u002Fbuild\u002Fparts\u002Frecords-and-startup","04.build\u002F02.parts\u002F14.records-and-startup","i-ph-database",{"title":824,"path":825,"stem":826,"icon":827},"Addresses","\u002Fbuild\u002Fparts\u002Faddresses","04.build\u002F02.parts\u002F15.addresses","i-ph-signpost",{"title":829,"path":830,"stem":831,"children":832,"icon":834},"Define a routine","\u002Fbuild\u002Fparts\u002Froutines","04.build\u002F02.parts\u002F16.routines\u002F00.index",[833,835],{"title":829,"path":830,"stem":831,"icon":834},"i-ph-clock-clockwise",{"title":836,"path":837,"stem":838,"icon":834},"Routine permissions and outputs","\u002Fbuild\u002Fparts\u002Froutines\u002Foutputs-and-permissions","04.build\u002F02.parts\u002F16.routines\u002F01.outputs-and-permissions",{"title":840,"path":841,"stem":842,"icon":843},"When to split an agent","\u002Fbuild\u002Fparts\u002Fwhen-to-split-an-agent","04.build\u002F02.parts\u002F17.when-to-split-an-agent","i-ph-arrows-split",{"title":845,"path":846,"stem":847,"children":848,"icon":71},"Apps on OZ","\u002Fbuild\u002Fapps","04.build\u002F03.apps\u002F00.index",[849,851,862,867,872,876,880,884,894,908,913,928,942],{"title":850,"path":846,"stem":847},"Applications and clients",{"title":852,"path":853,"stem":854,"children":855,"icon":857},"Use the runtime API","\u002Fbuild\u002Fapps\u002Fruntime-api","04.build\u002F03.apps\u002F01.runtime-api\u002F00.index",[856,858],{"title":852,"path":853,"stem":854,"icon":857},"i-ph-plug",{"title":859,"path":860,"stem":861,"icon":857},"Runtime API authentication","\u002Fbuild\u002Fapps\u002Fruntime-api\u002Fauthentication","04.build\u002F03.apps\u002F01.runtime-api\u002F01.authentication",{"title":863,"path":864,"stem":865,"icon":866},"Python SDK","\u002Fbuild\u002Fapps\u002Fsdk-python","04.build\u002F03.apps\u002F02.sdk-python","i-ph-file-py",{"title":868,"path":869,"stem":870,"icon":871},"TypeScript SDK","\u002Fbuild\u002Fapps\u002Fsdk-typescript","04.build\u002F03.apps\u002F03.sdk-typescript","i-ph-file-ts",{"title":873,"path":874,"stem":875,"icon":725},"Go SDK","\u002Fbuild\u002Fapps\u002Fsdk-go","04.build\u002F03.apps\u002F04.sdk-go",{"title":877,"path":878,"stem":879,"icon":782},"AG-UI for your apps","\u002Fbuild\u002Fapps\u002Fag-ui","04.build\u002F03.apps\u002F05.ag-ui",{"title":881,"path":882,"stem":883,"icon":249},"A chat in your own app","\u002Fbuild\u002Fapps\u002Fchat-app","04.build\u002F03.apps\u002F06.chat-app",{"title":885,"path":886,"stem":887,"children":888,"icon":767},"Follow live jobs","\u002Fbuild\u002Fapps\u002Flive-feeds","04.build\u002F03.apps\u002F07.live-feeds\u002F00.index",[889,890],{"title":885,"path":886,"stem":887,"icon":767},{"title":891,"path":892,"stem":893,"icon":767},"Feed access and browser streams","\u002Fbuild\u002Fapps\u002Flive-feeds\u002Fbrowser-and-access","04.build\u002F03.apps\u002F07.live-feeds\u002F01.browser-and-access",{"title":895,"path":896,"stem":897,"children":898,"icon":782},"Call agents over MCP","\u002Fbuild\u002Fapps\u002Fmcp-server","04.build\u002F03.apps\u002F08.mcp-server\u002F00.index",[899,900,904],{"title":895,"path":896,"stem":897,"icon":782},{"title":901,"path":902,"stem":903,"icon":782},"MCP client OAuth","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Foauth","04.build\u002F03.apps\u002F08.mcp-server\u002F01.oauth",{"title":905,"path":906,"stem":907,"icon":782},"MCP security and limits","\u002Fbuild\u002Fapps\u002Fmcp-server\u002Fsecurity-and-limits","04.build\u002F03.apps\u002F08.mcp-server\u002F02.security-and-limits",{"title":909,"path":910,"stem":911,"icon":912},"A2A agents","\u002Fbuild\u002Fapps\u002Fa2a","04.build\u002F03.apps\u002F09.a2a","i-ph-share-network",{"title":914,"path":915,"stem":916,"children":917,"icon":919},"Run a remote agent","\u002Fbuild\u002Fapps\u002Fremote-agents","04.build\u002F03.apps\u002F10.remote-agents\u002F00.index",[918,920,924],{"title":914,"path":915,"stem":916,"icon":919},"i-ph-cloud-arrow-down",{"title":921,"path":922,"stem":923,"icon":919},"Remote sessions and limits","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fsessions-and-limits","04.build\u002F03.apps\u002F10.remote-agents\u002F01.sessions-and-limits",{"title":925,"path":926,"stem":927,"icon":919},"Connect an outside A2A agent","\u002Fbuild\u002Fapps\u002Fremote-agents\u002Fa2a","04.build\u002F03.apps\u002F10.remote-agents\u002F02.a2a",{"title":929,"path":930,"stem":931,"children":932,"icon":249},"Connect a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels","04.build\u002F03.apps\u002F11.chat-channels\u002F00.index",[933,934,938],{"title":929,"path":930,"stem":931,"icon":249},{"title":935,"path":936,"stem":937,"icon":249},"Chat channel conversations","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fconversations","04.build\u002F03.apps\u002F11.chat-channels\u002F01.conversations",{"title":939,"path":940,"stem":941,"icon":249},"Build a chat channel","\u002Fbuild\u002Fapps\u002Fchat-channels\u002Fbuild","04.build\u002F03.apps\u002F11.chat-channels\u002F02.build",{"title":943,"path":944,"stem":945,"icon":946},"Interop matrix","\u002Fbuild\u002Fapps\u002Finterop","04.build\u002F03.apps\u002F12.interop","i-ph-check-square-offset",{"title":948,"path":949,"stem":950,"children":951,"icon":71},"Improve","\u002Fimprove","05.improve\u002F00.index",[952,953,958,963,968,994,1021,1026,1031,1036],{"title":948,"path":949,"stem":950},{"title":954,"path":955,"stem":956,"icon":957},"Search, compare and fix","\u002Fimprove\u002Fsearch-and-compare","05.improve\u002F01.search-and-compare","i-ph-magnifying-glass",{"title":959,"path":960,"stem":961,"icon":962},"Errors and insights","\u002Fimprove\u002Ferrors-and-insights","05.improve\u002F02.errors-and-insights","i-ph-chart-line",{"title":964,"path":965,"stem":966,"icon":967},"Measured savings","\u002Fimprove\u002Fmeasured-savings","05.improve\u002F03.measured-savings","i-ph-scales",{"title":969,"path":970,"stem":971,"children":972,"icon":463},"Evals and quality gates","\u002Fimprove\u002Fevals","05.improve\u002F04.evals\u002F00.index",[973,974,978,982,986,990],{"title":969,"path":970,"stem":971,"icon":463},{"title":975,"path":976,"stem":977},"Case expectations","\u002Fimprove\u002Fevals\u002Fcases","05.improve\u002F04.evals\u002F01.cases",{"title":979,"path":980,"stem":981},"Record and replay answers","\u002Fimprove\u002Fevals\u002Frecordings","05.improve\u002F04.evals\u002F02.recordings",{"title":983,"path":984,"stem":985},"Check policy paths","\u002Fimprove\u002Fevals\u002Fcoverage","05.improve\u002F04.evals\u002F03.coverage",{"title":987,"path":988,"stem":989},"Gate a plugin update","\u002Fimprove\u002Fevals\u002Fquality-gates","05.improve\u002F04.evals\u002F04.quality-gates",{"title":991,"path":992,"stem":993},"Track quality and regressions","\u002Fimprove\u002Fevals\u002Fregressions","05.improve\u002F04.evals\u002F05.regressions",{"title":995,"path":996,"stem":997,"children":998,"icon":1000},"Outcome checks and patterns","\u002Fimprove\u002Foutcome-checks","05.improve\u002F05.outcome-checks\u002F00.index",[999,1001,1005,1009,1013,1017],{"title":995,"path":996,"stem":997,"icon":1000},"i-ph-gavel",{"title":1002,"path":1003,"stem":1004},"Choose a judge and rubric","\u002Fimprove\u002Foutcome-checks\u002Fjudges","05.improve\u002F05.outcome-checks\u002F01.judges",{"title":1006,"path":1007,"stem":1008},"Measure a judge over time","\u002Fimprove\u002Foutcome-checks\u002Fsampling","05.improve\u002F05.outcome-checks\u002F02.sampling",{"title":1010,"path":1011,"stem":1012},"Use a reviewer agent","\u002Fimprove\u002Foutcome-checks\u002Freviewer","05.improve\u002F05.outcome-checks\u002F03.reviewer",{"title":1014,"path":1015,"stem":1016},"Choose among candidate answers","\u002Fimprove\u002Foutcome-checks\u002Fselection","05.improve\u002F05.outcome-checks\u002F04.selection",{"title":1018,"path":1019,"stem":1020},"Test and roll out judged agents","\u002Fimprove\u002Foutcome-checks\u002Frollouts","05.improve\u002F05.outcome-checks\u002F05.rollouts",{"title":1022,"path":1023,"stem":1024,"icon":1025},"Measured results","\u002Fimprove\u002Fmeasured-results","05.improve\u002F06.measured-results","i-ph-chart-bar",{"title":1027,"path":1028,"stem":1029,"icon":1030},"Comparisons of a changed agent","\u002Fimprove\u002Fcomparisons-of-a-changed-agent","05.improve\u002F07.comparisons-of-a-changed-agent","i-ph-git-diff",{"title":1032,"path":1033,"stem":1034,"icon":1035},"Where a fix belongs","\u002Fimprove\u002Fwhere-a-fix-belongs","05.improve\u002F08.where-a-fix-belongs","i-ph-ladder",{"title":1037,"path":1038,"stem":1039,"icon":957},"Evidence for agents","\u002Fimprove\u002Fevidence-for-agents","05.improve\u002F09.evidence-for-agents",{"title":1041,"path":1042,"stem":1043,"children":1044,"icon":71},"Govern","\u002Fgovern","06.govern\u002F00.index",[1045,1047,1085,1089,1111,1115,1120,1151,1170,1175,1180,1184,1207],{"title":1046,"path":1042,"stem":1043},"Govern agents",{"title":1048,"path":1049,"stem":1050,"children":1051,"icon":98},"Tool policy","\u002Fgovern\u002Ftool-policy","06.govern\u002F01.tool-policy\u002F00.index",[1052,1053,1057,1061,1065,1069,1073,1077,1081],{"title":1048,"path":1049,"stem":1050,"icon":98},{"title":1054,"path":1055,"stem":1056},"Export and apply a tool policy","\u002Fgovern\u002Ftool-policy\u002Ffiles","06.govern\u002F01.tool-policy\u002F02.files",{"title":1058,"path":1059,"stem":1060},"Rules for plugin and remote functions","\u002Fgovern\u002Ftool-policy\u002Fplugin-functions","06.govern\u002F01.tool-policy\u002F03.plugin-functions",{"title":1062,"path":1063,"stem":1064},"Function conditions and action classes","\u002Fgovern\u002Ftool-policy\u002Fconditions","06.govern\u002F01.tool-policy\u002F04.conditions",{"title":1066,"path":1067,"stem":1068},"Rules for taint, origins and sequences","\u002Fgovern\u002Ftool-policy\u002Forigins-and-sequences","06.govern\u002F01.tool-policy\u002F05.origins-and-sequences",{"title":1070,"path":1071,"stem":1072},"How the runtime enforces tool policy","\u002Fgovern\u002Ftool-policy\u002Fruntime","06.govern\u002F01.tool-policy\u002F06.runtime",{"title":1074,"path":1075,"stem":1076},"Preview, review and lint tool policy changes","\u002Fgovern\u002Ftool-policy\u002Freview-changes","06.govern\u002F01.tool-policy\u002F07.review-changes",{"title":1078,"path":1079,"stem":1080},"Assign duties to tool calls","\u002Fgovern\u002Ftool-policy\u002Fduties","06.govern\u002F01.tool-policy\u002F08.duties",{"title":1082,"path":1083,"stem":1084},"Command rules in a tool policy","\u002Fgovern\u002Ftool-policy\u002Fcommand-rules","06.govern\u002F01.tool-policy\u002F09.command-rules",{"title":1086,"path":1087,"stem":1088,"icon":230},"Governance replay","\u002Fgovern\u002Fgovernance-replay","06.govern\u002F02.governance-replay",{"title":1090,"path":1091,"stem":1092,"children":1093,"icon":532},"Reviewed changes","\u002Fgovern\u002Freviewed-changes","06.govern\u002F03.reviewed-changes\u002F00.index",[1094,1095,1099,1103,1107],{"title":1090,"path":1091,"stem":1092,"icon":532},{"title":1096,"path":1097,"stem":1098},"Review assistant and job proposals","\u002Fgovern\u002Freviewed-changes\u002Fproposals","06.govern\u002F03.reviewed-changes\u002F02.proposals",{"title":1100,"path":1101,"stem":1102},"Review plugin configurations","\u002Fgovern\u002Freviewed-changes\u002Fplugin-configurations","06.govern\u002F03.reviewed-changes\u002F03.plugin-configurations",{"title":1104,"path":1105,"stem":1106},"Review and roll back changesets","\u002Fgovern\u002Freviewed-changes\u002Fchangesets","06.govern\u002F03.reviewed-changes\u002F04.changesets",{"title":1108,"path":1109,"stem":1110},"Review changes to protected paths","\u002Fgovern\u002Freviewed-changes\u002Fprotected-paths","06.govern\u002F03.reviewed-changes\u002F05.protected-paths",{"title":1112,"path":1113,"stem":1114,"icon":666},"AI labels","\u002Fgovern\u002Fai-labels","06.govern\u002F04.ai-labels",{"title":1116,"path":1117,"stem":1118,"icon":1119},"Kill switches","\u002Fgovern\u002Fkill-switches","06.govern\u002F05.kill-switches","i-ph-power",{"title":1121,"path":1122,"stem":1123,"children":1124,"icon":1126},"Personal data","\u002Fgovern\u002Fpersonal-data","06.govern\u002F06.personal-data\u002F00.index",[1125,1127,1131,1135,1139,1143,1147],{"title":1121,"path":1122,"stem":1123,"icon":1126},"i-ph-user-minus",{"title":1128,"path":1129,"stem":1130},"Associate people and purposes with jobs","\u002Fgovern\u002Fpersonal-data\u002Fassociate-people","06.govern\u002F06.personal-data\u002F01.associate-people",{"title":1132,"path":1133,"stem":1134},"Find and export personal data","\u002Fgovern\u002Fpersonal-data\u002Fexport","06.govern\u002F06.personal-data\u002F02.export",{"title":1136,"path":1137,"stem":1138},"Restrict processing and record contests","\u002Fgovern\u002Fpersonal-data\u002Frestrictions-and-contests","06.govern\u002F06.personal-data\u002F03.restrictions-and-contests",{"title":1140,"path":1141,"stem":1142},"Erase personal data","\u002Fgovern\u002Fpersonal-data\u002Ferase","06.govern\u002F06.personal-data\u002F04.erase",{"title":1144,"path":1145,"stem":1146},"Retain records and restore backups","\u002Fgovern\u002Fpersonal-data\u002Fretention","06.govern\u002F06.personal-data\u002F05.retention",{"title":1148,"path":1149,"stem":1150},"Personal data held by plugins","\u002Fgovern\u002Fpersonal-data\u002Fplugin-records","06.govern\u002F06.personal-data\u002F06.plugin-records",{"title":1152,"path":1153,"stem":1154,"children":1155,"icon":1157},"Taint and labels","\u002Fgovern\u002Ftaint-and-labels","06.govern\u002F07.taint-and-labels\u002F00.index",[1156,1158,1162,1166],{"title":1152,"path":1153,"stem":1154,"icon":1157},"i-ph-drop-half-bottom",{"title":1159,"path":1160,"stem":1161},"Set rules on taint and labels","\u002Fgovern\u002Ftaint-and-labels\u002Frules","06.govern\u002F07.taint-and-labels\u002F02.rules",{"title":1163,"path":1164,"stem":1165},"Set clearance, egress and content walls","\u002Fgovern\u002Ftaint-and-labels\u002Flabel-policies","06.govern\u002F07.taint-and-labels\u002F03.label-policies",{"title":1167,"path":1168,"stem":1169},"Read outside text in a quarantine child","\u002Fgovern\u002Ftaint-and-labels\u002Fquarantine","06.govern\u002F07.taint-and-labels\u002F04.quarantine",{"title":1171,"path":1172,"stem":1173,"icon":1174},"Works-council mode","\u002Fgovern\u002Fworks-council-mode","06.govern\u002F08.works-council-mode","i-ph-users-three",{"title":1176,"path":1177,"stem":1178,"icon":1179},"Incidents","\u002Fgovern\u002Fincidents","06.govern\u002F09.incidents","i-ph-siren",{"title":1181,"path":1182,"stem":1183,"icon":213},"Inventory","\u002Fgovern\u002Finventory","06.govern\u002F10.inventory",{"title":1185,"path":1186,"stem":1187,"children":1188,"icon":1190},"Audit trail","\u002Fgovern\u002Faudit-trail","06.govern\u002F11.audit-trail\u002F00.index",[1189,1191,1195,1199,1203],{"title":1185,"path":1186,"stem":1187,"icon":1190},"i-ph-scroll",{"title":1192,"path":1193,"stem":1194},"Audit records and run identity","\u002Fgovern\u002Faudit-trail\u002Frecords","06.govern\u002F11.audit-trail\u002F02.records",{"title":1196,"path":1197,"stem":1198},"Verify the audit chain","\u002Fgovern\u002Faudit-trail\u002Fverification","06.govern\u002F11.audit-trail\u002F03.verification",{"title":1200,"path":1201,"stem":1202},"Export and verify evidence bundles","\u002Fgovern\u002Faudit-trail\u002Fevidence-bundles","06.govern\u002F11.audit-trail\u002F04.evidence-bundles",{"title":1204,"path":1205,"stem":1206},"Audit retention, erasure and legal holds","\u002Fgovern\u002Faudit-trail\u002Fretention","06.govern\u002F11.audit-trail\u002F05.retention",{"title":1208,"path":1209,"stem":1210,"children":1211,"icon":1213},"Command rules","\u002Fgovern\u002Fcommand-rules","06.govern\u002F12.command-rules\u002F00.index",[1212,1214,1218,1222,1226],{"title":1208,"path":1209,"stem":1210,"icon":1213},"i-ph-terminal",{"title":1215,"path":1216,"stem":1217},"Command rule patterns","\u002Fgovern\u002Fcommand-rules\u002Fpatterns","06.govern\u002F12.command-rules\u002F02.patterns",{"title":1219,"path":1220,"stem":1221},"What the command reader understands","\u002Fgovern\u002Fcommand-rules\u002Fcommand-reader","06.govern\u002F12.command-rules\u002F03.command-reader",{"title":1223,"path":1224,"stem":1225},"Create a command rule from an approval","\u002Fgovern\u002Fcommand-rules\u002Fallow-from-card","06.govern\u002F12.command-rules\u002F04.allow-from-card",{"title":1227,"path":1228,"stem":1229},"Command rule evaluation and limits","\u002Fgovern\u002Fcommand-rules\u002Fevaluation-and-limits","06.govern\u002F12.command-rules\u002F05.evaluation-and-limits",{"title":1231,"path":1232,"stem":1233,"children":1234,"icon":71},"Fleet","\u002Ffleet","07.fleet\u002F00.index",[1235,1237,1242,1247,1251,1256,1260,1265,1270,1274,1278,1297,1302,1307,1325,1329,1333,1352,1357,1380,1385,1390,1395,1399,1458,1462,1467,1481,1486,1490,1494],{"title":1236,"path":1232,"stem":1233},"Operate a fleet",{"title":1238,"path":1239,"stem":1240,"icon":1241},"Dev mode","\u002Ffleet\u002Fdev-mode","07.fleet\u002F01.dev-mode","i-ph-laptop",{"title":1243,"path":1244,"stem":1245,"icon":1246},"Run a cluster","\u002Ffleet\u002Fcluster","07.fleet\u002F02.cluster","i-ph-hard-drives",{"title":1248,"path":1249,"stem":1250,"icon":782},"Join nodes","\u002Ffleet\u002Fjoin-nodes","07.fleet\u002F03.join-nodes",{"title":1252,"path":1253,"stem":1254,"icon":1255},"Manage nodes","\u002Ffleet\u002Fmanage-nodes","07.fleet\u002F04.manage-nodes","i-ph-list-bullets",{"title":1257,"path":1258,"stem":1259,"icon":527},"Node health","\u002Ffleet\u002Fnodes","07.fleet\u002F05.nodes",{"title":1261,"path":1262,"stem":1263,"icon":1264},"Nodes as services","\u002Ffleet\u002Fservices","07.fleet\u002F06.services","i-ph-gear-six",{"title":1266,"path":1267,"stem":1268,"icon":1269},"Doctor","\u002Ffleet\u002Fdoctor","07.fleet\u002F07.doctor","i-ph-stethoscope",{"title":1271,"path":1272,"stem":1273,"icon":421},"Troubleshooting","\u002Ffleet\u002Ftroubleshooting","07.fleet\u002F08.troubleshooting",{"title":1275,"path":1276,"stem":1277,"icon":962},"Tracing and metrics","\u002Ffleet\u002Fobservability","07.fleet\u002F09.observability",{"title":1279,"path":1280,"stem":1281,"children":1282,"icon":1284},"Choose sandbox tier 2","\u002Ffleet\u002Fsandbox-tier-2","07.fleet\u002F10.sandbox-tier-2\u002F00.index",[1283,1285,1289,1293],{"title":1279,"path":1280,"stem":1281,"icon":1284},"i-ph-shield-chevron",{"title":1286,"path":1287,"stem":1288,"icon":1284},"Set up gVisor","\u002Ffleet\u002Fsandbox-tier-2\u002Fgvisor","07.fleet\u002F10.sandbox-tier-2\u002F01.gvisor",{"title":1290,"path":1291,"stem":1292,"icon":1284},"Set up microVM isolation","\u002Ffleet\u002Fsandbox-tier-2\u002Fmicrovms","07.fleet\u002F10.sandbox-tier-2\u002F02.microvms",{"title":1294,"path":1295,"stem":1296,"icon":1284},"Configure remote sandboxes","\u002Ffleet\u002Fsandbox-tier-2\u002Fremote","07.fleet\u002F10.sandbox-tier-2\u002F03.remote",{"title":1298,"path":1299,"stem":1300,"icon":1301},"Sandbox on macOS","\u002Ffleet\u002Fsandbox-on-macos","07.fleet\u002F11.sandbox-on-macos","i-ph-apple-logo",{"title":1303,"path":1304,"stem":1305,"icon":1306},"Sandbox on Windows","\u002Ffleet\u002Fsandbox-on-windows","07.fleet\u002F12.sandbox-on-windows","i-ph-windows-logo",{"title":1308,"path":1309,"stem":1310,"children":1311,"icon":797},"Configure local models","\u002Ffleet\u002Flocal-models","07.fleet\u002F13.local-models\u002F00.index",[1312,1313,1317,1321],{"title":1308,"path":1309,"stem":1310,"icon":797},{"title":1314,"path":1315,"stem":1316,"icon":797},"Share a local model with the fleet","\u002Ffleet\u002Flocal-models\u002Ffleet","07.fleet\u002F13.local-models\u002F01.fleet",{"title":1318,"path":1319,"stem":1320,"icon":797},"Review local-model safety checks","\u002Ffleet\u002Flocal-models\u002Ftrust","07.fleet\u002F13.local-models\u002F02.trust",{"title":1322,"path":1323,"stem":1324,"icon":797},"Size and price local models","\u002Ffleet\u002Flocal-models\u002Fsizing-and-cost","07.fleet\u002F13.local-models\u002F03.sizing-and-cost",{"title":1326,"path":1327,"stem":1328,"icon":1241},"Agents on a Mac with MLX","\u002Ffleet\u002Flocal-models-on-a-mac","07.fleet\u002F14.local-models-on-a-mac",{"title":1330,"path":1331,"stem":1332,"icon":127},"Queues","\u002Ffleet\u002Fqueues","07.fleet\u002F15.queues",{"title":1334,"path":1335,"stem":1336,"children":1337,"icon":1339},"Choose a Temporal backend","\u002Ffleet\u002Ftemporal-backends","07.fleet\u002F16.temporal-backends\u002F00.index",[1338,1340,1344,1348],{"title":1334,"path":1335,"stem":1336,"icon":1339},"i-ph-cloud",{"title":1341,"path":1342,"stem":1343},"Set retention and move tenants","\u002Ffleet\u002Ftemporal-backends\u002Fretention-and-migration","07.fleet\u002F16.temporal-backends\u002F01.retention-and-migration",{"title":1345,"path":1346,"stem":1347},"Encrypt Temporal payloads","\u002Ffleet\u002Ftemporal-backends\u002Fencryption","07.fleet\u002F16.temporal-backends\u002F02.encryption",{"title":1349,"path":1350,"stem":1351},"Read payloads in Temporal UI","\u002Ffleet\u002Ftemporal-backends\u002Fcodec","07.fleet\u002F16.temporal-backends\u002F03.codec",{"title":1353,"path":1354,"stem":1355,"icon":1356},"Regions","\u002Ffleet\u002Fregions","07.fleet\u002F17.regions","i-ph-globe-hemisphere-east",{"title":1358,"path":1359,"stem":1360,"children":1361,"icon":1363},"Run the roles separately","\u002Ffleet\u002Fseparate-roles","07.fleet\u002F18.separate-roles\u002F00.index",[1362,1364,1368,1372,1376],{"title":1358,"path":1359,"stem":1360,"icon":1363},"i-ph-squares-four",{"title":1365,"path":1366,"stem":1367},"Prepare database rights","\u002Ffleet\u002Fseparate-roles\u002Fdatabase-rights","07.fleet\u002F18.separate-roles\u002F01.database-rights",{"title":1369,"path":1370,"stem":1371},"Keep plaintext secrets on edges","\u002Ffleet\u002Fseparate-roles\u002Fsecrets","07.fleet\u002F18.separate-roles\u002F02.secrets",{"title":1373,"path":1374,"stem":1375},"Operate through role outages","\u002Ffleet\u002Fseparate-roles\u002Foutages","07.fleet\u002F18.separate-roles\u002F03.outages",{"title":1377,"path":1378,"stem":1379},"Use Temporal UI with separate roles","\u002Ffleet\u002Fseparate-roles\u002Ftemporal-ui","07.fleet\u002F18.separate-roles\u002F04.temporal-ui",{"title":1381,"path":1382,"stem":1383,"icon":1384},"High availability","\u002Ffleet\u002Fhigh-availability","07.fleet\u002F19.high-availability","i-ph-copy",{"title":1386,"path":1387,"stem":1388,"icon":1389},"Management over a WAN","\u002Ffleet\u002Fmanagement-over-a-wan","07.fleet\u002F20.management-over-a-wan","i-ph-globe-hemisphere-west",{"title":1391,"path":1392,"stem":1393,"icon":1394},"Cloud federation","\u002Ffleet\u002Fcloud-federation","07.fleet\u002F21.cloud-federation","i-ph-cloud-check",{"title":1396,"path":1397,"stem":1398,"icon":451},"Payload storage","\u002Ffleet\u002Fpayload-storage","07.fleet\u002F22.payload-storage",{"title":1400,"path":1401,"stem":1402,"children":1403,"icon":1405},"Upgrade a cluster","\u002Ffleet\u002Fupgrades","07.fleet\u002F23.upgrades\u002F00.index",[1404,1406,1410,1414,1418,1422,1426,1430,1434,1438,1442,1446,1450,1454],{"title":1400,"path":1401,"stem":1402,"icon":1405},"i-ph-arrows-clockwise",{"title":1407,"path":1408,"stem":1409},"Prepare for sandbox changes","\u002Ffleet\u002Fupgrades\u002Fsandbox-changes","07.fleet\u002F23.upgrades\u002F01.sandbox-changes",{"title":1411,"path":1412,"stem":1413},"Review policy changes","\u002Ffleet\u002Fupgrades\u002Fpolicy-changes","07.fleet\u002F23.upgrades\u002F02.policy-changes",{"title":1415,"path":1416,"stem":1417},"Review data and privacy migrations","\u002Ffleet\u002Fupgrades\u002Fdata-migrations","07.fleet\u002F23.upgrades\u002F03.data-migrations",{"title":1419,"path":1420,"stem":1421},"Prepare storage and identity migrations","\u002Ffleet\u002Fupgrades\u002Fstorage-and-identity","07.fleet\u002F23.upgrades\u002F04.storage-and-identity",{"title":1423,"path":1424,"stem":1425},"Prepare plugins for an upgrade","\u002Ffleet\u002Fupgrades\u002Fplugin-changes","07.fleet\u002F23.upgrades\u002F05.plugin-changes",{"title":1427,"path":1428,"stem":1429},"Keep calls compatible during upgrades","\u002Ffleet\u002Fupgrades\u002Fcall-compatibility","07.fleet\u002F23.upgrades\u002F06.call-compatibility",{"title":1431,"path":1432,"stem":1433},"Review model and budget migrations","\u002Ffleet\u002Fupgrades\u002Fmodel-and-budget-changes","07.fleet\u002F23.upgrades\u002F07.model-and-budget-changes",{"title":1435,"path":1436,"stem":1437},"Migrate to shared worker pools","\u002Ffleet\u002Fupgrades\u002Fshared-pools","07.fleet\u002F23.upgrades\u002F08.shared-pools",{"title":1439,"path":1440,"stem":1441},"Upgrade node binaries and runtimes","\u002Ffleet\u002Fupgrades\u002Fnodes","07.fleet\u002F23.upgrades\u002F09.nodes",{"title":1443,"path":1444,"stem":1445},"Understand runtime shutdown","\u002Ffleet\u002Fupgrades\u002Fruntime-shutdown","07.fleet\u002F23.upgrades\u002F10.runtime-shutdown",{"title":1447,"path":1448,"stem":1449},"Review runtime behaviour changes","\u002Ffleet\u002Fupgrades\u002Fruntime-changes","07.fleet\u002F23.upgrades\u002F11.runtime-changes",{"title":1451,"path":1452,"stem":1453},"Verify releases and switch channels","\u002Ffleet\u002Fupgrades\u002Frelease-verification","07.fleet\u002F23.upgrades\u002F12.release-verification",{"title":1455,"path":1456,"stem":1457},"Roll a runtime out in steps","\u002Ffleet\u002Fupgrades\u002Fruntime-rollouts","07.fleet\u002F23.upgrades\u002F13.runtime-rollouts",{"title":1459,"path":1460,"stem":1461,"icon":463},"Releases","\u002Ffleet\u002Freleases","07.fleet\u002F24.releases",{"title":1463,"path":1464,"stem":1465,"icon":1466},"Docker","\u002Ffleet\u002Fdocker","07.fleet\u002F25.docker","i-ph-shipping-container",{"title":1468,"path":1469,"stem":1470,"children":1471,"icon":480},"Deploy with Kubernetes","\u002Ffleet\u002Fkubernetes","07.fleet\u002F26.kubernetes\u002F00.index",[1472,1473,1477],{"title":1468,"path":1469,"stem":1470,"icon":480},{"title":1474,"path":1475,"stem":1476,"icon":480},"Helm objects and values","\u002Ffleet\u002Fkubernetes\u002Fvalues","07.fleet\u002F26.kubernetes\u002F01.values",{"title":1478,"path":1479,"stem":1480,"icon":480},"Maintain a Kubernetes deployment","\u002Ffleet\u002Fkubernetes\u002Fmaintenance","07.fleet\u002F26.kubernetes\u002F02.maintenance",{"title":1482,"path":1483,"stem":1484,"icon":1485},"Offline install","\u002Ffleet\u002Foffline-install","07.fleet\u002F27.offline-install","i-ph-airplane-tilt",{"title":1487,"path":1488,"stem":1489,"icon":98},"FIPS builds","\u002Ffleet\u002Ffips","07.fleet\u002F28.fips",{"title":1491,"path":1492,"stem":1493,"icon":249},"Run Orchestrator Zero from an MCP client","\u002Ffleet\u002Fmcp-client","07.fleet\u002F29.mcp-client",{"title":1495,"path":1496,"stem":1497,"children":1498,"icon":451},"Back up a cluster","\u002Ffleet\u002Fbackups","07.fleet\u002F30.backups\u002F00.index",[1499,1500],{"title":1495,"path":1496,"stem":1497,"icon":451},{"title":1501,"path":1502,"stem":1503},"Restore a cluster","\u002Ffleet\u002Fbackups\u002Frestore","07.fleet\u002F30.backups\u002F01.restore",{"title":1505,"path":1506,"stem":1507,"children":1508,"icon":71},"Spend","\u002Fspend","08.spend\u002F00.index",[1509,1511,1533,1547,1585],{"title":1510,"path":1506,"stem":1507},"Manage model access and spending",{"title":1512,"path":1513,"stem":1514,"children":1515,"icon":552},"Read cost and usage","\u002Fspend\u002Fcost-and-usage","08.spend\u002F01.cost-and-usage\u002F00.index",[1516,1517,1521,1525,1529],{"title":1512,"path":1513,"stem":1514,"icon":552},{"title":1518,"path":1519,"stem":1520},"Understand recorded charges","\u002Fspend\u002Fcost-and-usage\u002Faccounting","08.spend\u002F01.cost-and-usage\u002F01.accounting",{"title":1522,"path":1523,"stem":1524},"Read model call timings","\u002Fspend\u002Fcost-and-usage\u002Ftimings","08.spend\u002F01.cost-and-usage\u002F02.timings",{"title":1526,"path":1527,"stem":1528},"Export usage","\u002Fspend\u002Fcost-and-usage\u002Fexports","08.spend\u002F01.cost-and-usage\u002F03.exports",{"title":1530,"path":1531,"stem":1532},"Explain prices and cache costs","\u002Fspend\u002Fcost-and-usage\u002Fprices-and-cache","08.spend\u002F01.cost-and-usage\u002F04.prices-and-cache",{"title":1534,"path":1535,"stem":1536,"children":1537,"icon":134},"Set budgets and quotas","\u002Fspend\u002Fbudgets-and-quotas","08.spend\u002F02.budgets-and-quotas\u002F00.index",[1538,1539,1543],{"title":1534,"path":1535,"stem":1536,"icon":134},{"title":1540,"path":1541,"stem":1542,"icon":134},"Understand quota charging and refusals","\u002Fspend\u002Fbudgets-and-quotas\u002Fcharging","08.spend\u002F02.budgets-and-quotas\u002F01.charging",{"title":1544,"path":1545,"stem":1546,"icon":134},"Request and review budget","\u002Fspend\u002Fbudgets-and-quotas\u002Frequests","08.spend\u002F02.budgets-and-quotas\u002F02.requests",{"title":1548,"path":1549,"stem":1550,"children":1551,"icon":416},"Connect a model provider","\u002Fspend\u002Fmodels-and-keys","08.spend\u002F03.models-and-keys\u002F00.index",[1552,1553,1557,1561,1565,1569,1573,1577,1581],{"title":1548,"path":1549,"stem":1550,"icon":416},{"title":1554,"path":1555,"stem":1556},"Choose model aliases","\u002Fspend\u002Fmodels-and-keys\u002Faliases","08.spend\u002F03.models-and-keys\u002F01.aliases",{"title":1558,"path":1559,"stem":1560},"Map a plugin's models","\u002Fspend\u002Fmodels-and-keys\u002Fmapping","08.spend\u002F03.models-and-keys\u002F02.mapping",{"title":1562,"path":1563,"stem":1564},"Set reasoning effort and cascades","\u002Fspend\u002Fmodels-and-keys\u002Feffort-and-cascades","08.spend\u002F03.models-and-keys\u002F03.effort-and-cascades",{"title":1566,"path":1567,"stem":1568},"Authenticate model calls","\u002Fspend\u002Fmodels-and-keys\u002Fauthentication","08.spend\u002F03.models-and-keys\u002F04.authentication",{"title":1570,"path":1571,"stem":1572},"Control what model calls can reach","\u002Fspend\u002Fmodels-and-keys\u002Fdata-rules","08.spend\u002F03.models-and-keys\u002F05.data-rules",{"title":1574,"path":1575,"stem":1576},"Pool model deployments","\u002Fspend\u002Fmodels-and-keys\u002Fdeployment-pools","08.spend\u002F03.models-and-keys\u002F06.deployment-pools",{"title":1578,"path":1579,"stem":1580},"Configure caches and server tools","\u002Fspend\u002Fmodels-and-keys\u002Fcache-and-tools","08.spend\u002F03.models-and-keys\u002F07.cache-and-tools",{"title":1582,"path":1583,"stem":1584},"Check model changes and retirement","\u002Fspend\u002Fmodels-and-keys\u002Fcanaries-and-retirement","08.spend\u002F03.models-and-keys\u002F08.canaries-and-retirement",{"title":1586,"path":1587,"stem":1588,"icon":1589},"Translating providers","\u002Fspend\u002Ftranslating-providers","08.spend\u002F04.translating-providers","i-ph-translate",{"title":1591,"path":1592,"stem":1593,"children":1594,"icon":71},"Admin","\u002Fadmin","09.admin\u002F00.index",[1595,1597,1623,1650,1654,1658,1680,1685,1696],{"title":1596,"path":1592,"stem":1593},"Administer access and credentials",{"title":1598,"path":1599,"stem":1600,"children":1601,"icon":98},"Configure sign-in","\u002Fadmin\u002Fsign-in","09.admin\u002F01.sign-in\u002F00.index",[1602,1603,1607,1611,1615,1619],{"title":1598,"path":1599,"stem":1600,"icon":98},{"title":1604,"path":1605,"stem":1606},"Configure an identity provider","\u002Fadmin\u002Fsign-in\u002Fidentity-providers","09.admin\u002F01.sign-in\u002F01.identity-providers",{"title":1608,"path":1609,"stem":1610},"Provision accounts from a directory","\u002Fadmin\u002Fsign-in\u002Fprovisioning","09.admin\u002F01.sign-in\u002F02.provisioning",{"title":1612,"path":1613,"stem":1614},"Manage passwords and second factors","\u002Fadmin\u002Fsign-in\u002Fpasswords","09.admin\u002F01.sign-in\u002F03.passwords",{"title":1616,"path":1617,"stem":1618},"Sign in from the CLI and MCP clients","\u002Fadmin\u002Fsign-in\u002Fclients","09.admin\u002F01.sign-in\u002F04.clients",{"title":1620,"path":1621,"stem":1622},"End sessions and inspect sign-in events","\u002Fadmin\u002Fsign-in\u002Fsessions","09.admin\u002F01.sign-in\u002F05.sessions",{"title":1624,"path":1625,"stem":1626,"children":1627,"icon":1629},"Manage tenant secrets","\u002Fadmin\u002Fsecrets","09.admin\u002F02.secrets\u002F00.index",[1628,1630,1634,1638,1642,1646],{"title":1624,"path":1625,"stem":1626,"icon":1629},"i-ph-key",{"title":1631,"path":1632,"stem":1633},"Bind secrets to destination hosts","\u002Fadmin\u002Fsecrets\u002Fhost-bindings","09.admin\u002F02.secrets\u002F01.host-bindings",{"title":1635,"path":1636,"stem":1637},"Test and rotate secrets","\u002Fadmin\u002Fsecrets\u002Frotation","09.admin\u002F02.secrets\u002F02.rotation",{"title":1639,"path":1640,"stem":1641},"Use an external secret store","\u002Fadmin\u002Fsecrets\u002Fexternal-stores","09.admin\u002F02.secrets\u002F03.external-stores",{"title":1643,"path":1644,"stem":1645},"Deliver and scan plugin secrets","\u002Fadmin\u002Fsecrets\u002Fplugin-secrets","09.admin\u002F02.secrets\u002F04.plugin-secrets",{"title":1647,"path":1648,"stem":1649},"Configure plugin settings","\u002Fadmin\u002Fsecrets\u002Fsettings","09.admin\u002F02.secrets\u002F05.settings",{"title":1651,"path":1652,"stem":1653,"icon":1629},"Credential injection","\u002Fadmin\u002Fcredential-injection","09.admin\u002F03.credential-injection",{"title":1655,"path":1656,"stem":1657,"icon":1629},"Key commands","\u002Fadmin\u002Fkey-commands","09.admin\u002F04.key-commands",{"title":1659,"path":1660,"stem":1661,"children":1662,"icon":782},"Connect a plugin to another system","\u002Fadmin\u002Fconnections","09.admin\u002F05.connections\u002F00.index",[1663,1664,1668,1672,1676],{"title":1659,"path":1660,"stem":1661,"icon":782},{"title":1665,"path":1666,"stem":1667,"icon":782},"Renew and reconnect credentials","\u002Fadmin\u002Fconnections\u002Frenewal","09.admin\u002F05.connections\u002F01.renewal",{"title":1669,"path":1670,"stem":1671,"icon":782},"Restrict connection destinations","\u002Fadmin\u002Fconnections\u002Fdestinations","09.admin\u002F05.connections\u002F02.destinations",{"title":1673,"path":1674,"stem":1675,"icon":782},"Diagnose connection failures","\u002Fadmin\u002Fconnections\u002Ftroubleshooting","09.admin\u002F05.connections\u002F03.troubleshooting",{"title":1677,"path":1678,"stem":1679,"icon":782},"Understand connection security","\u002Fadmin\u002Fconnections\u002Fsecurity","09.admin\u002F05.connections\u002F04.security",{"title":1681,"path":1682,"stem":1683,"icon":1684},"Tenants","\u002Fadmin\u002Ftenants","09.admin\u002F06.tenants","i-ph-buildings",{"title":1686,"path":1687,"stem":1688,"children":1689,"icon":1691},"Export and verify a tenant","\u002Fadmin\u002Ftenant-export","09.admin\u002F07.tenant-export\u002F00.index",[1690,1692],{"title":1686,"path":1687,"stem":1688,"icon":1691},"i-ph-export",{"title":1693,"path":1694,"stem":1695,"icon":1691},"Tenant export format","\u002Fadmin\u002Ftenant-export\u002Fformat","09.admin\u002F07.tenant-export\u002F01.format",{"title":1697,"path":1698,"stem":1699,"icon":1700},"Notifications","\u002Fadmin\u002Fnotifications","09.admin\u002F08.notifications","i-ph-bell-ringing",{"title":1702,"path":1703,"stem":1704,"children":1705,"icon":71},"Reference","\u002Freference","10.reference\u002F00.index",[1706,1707,1726,1760,1794,1798,1803,1807,1812,1817,1822,1826],{"title":1702,"path":1703,"stem":1704},{"title":1708,"path":1709,"stem":1710,"children":1711,"icon":1725},"CLI","\u002Freference\u002Fcli","10.reference\u002F01.cli\u002F00.index",[1712,1713,1719],{"title":1708,"path":1709,"stem":1710},{"title":1714,"path":1715,"stem":1716,"children":1717},"oz0","\u002Freference\u002Fcli\u002Foz0","10.reference\u002F01.cli\u002F01.oz0\u002F00.index",[1718],{"title":1714,"path":1715,"stem":1716},{"title":1720,"path":1721,"stem":1722,"children":1723},"oz0-node","\u002Freference\u002Fcli\u002Foz0-node","10.reference\u002F01.cli\u002F02.oz0-node\u002F00.index",[1724],{"title":1720,"path":1721,"stem":1722},"i-ph-terminal-window",{"title":1727,"path":1728,"stem":1729,"children":1730,"icon":725},"oz0-plugin.yaml","\u002Freference\u002Fplugin-manifest","10.reference\u002F02.plugin-manifest\u002F00.index",[1731,1732,1736,1740,1744,1748,1752,1756],{"title":1727,"path":1728,"stem":1729,"icon":725},{"title":1733,"path":1734,"stem":1735},"Dependencies and cross-plugin access","\u002Freference\u002Fplugin-manifest\u002Fdependencies","10.reference\u002F02.plugin-manifest\u002F01.dependencies",{"title":1737,"path":1738,"stem":1739},"Tool declarations","\u002Freference\u002Fplugin-manifest\u002Ftools","10.reference\u002F02.plugin-manifest\u002F02.tools",{"title":1741,"path":1742,"stem":1743},"Harnesses, events and channels","\u002Freference\u002Fplugin-manifest\u002Fruntimes","10.reference\u002F02.plugin-manifest\u002F03.runtimes",{"title":1745,"path":1746,"stem":1747},"Connections and hooks","\u002Freference\u002Fplugin-manifest\u002Fconnections","10.reference\u002F02.plugin-manifest\u002F04.connections",{"title":1749,"path":1750,"stem":1751},"Plugin sets and policies","\u002Freference\u002Fplugin-manifest\u002Fsets-policy","10.reference\u002F02.plugin-manifest\u002F05.sets-policy",{"title":1753,"path":1754,"stem":1755},"Data, evidence and mail","\u002Freference\u002Fplugin-manifest\u002Fdata","10.reference\u002F02.plugin-manifest\u002F06.data",{"title":1757,"path":1758,"stem":1759},"Generated OpenAPI manifests","\u002Freference\u002Fplugin-manifest\u002Fopenapi","10.reference\u002F02.plugin-manifest\u002F07.openapi",{"title":1761,"path":1762,"stem":1763,"children":1764,"icon":666},"Agent definition","\u002Freference\u002Fagent-definition","10.reference\u002F03.agent-definition\u002F00.index",[1765,1766,1770,1774,1778,1782,1786,1790],{"title":1761,"path":1762,"stem":1763,"icon":666},{"title":1767,"path":1768,"stem":1769},"Identity, instructions and tools","\u002Freference\u002Fagent-definition\u002Fidentity","10.reference\u002F03.agent-definition\u002F01.identity",{"title":1771,"path":1772,"stem":1773},"Models and placement","\u002Freference\u002Fagent-definition\u002Fmodels","10.reference\u002F03.agent-definition\u002F02.models",{"title":1775,"path":1776,"stem":1777},"Limits and spend","\u002Freference\u002Fagent-definition\u002Flimits","10.reference\u002F03.agent-definition\u002F03.limits",{"title":1779,"path":1780,"stem":1781},"Judges and candidate selection","\u002Freference\u002Fagent-definition\u002Fquality","10.reference\u002F03.agent-definition\u002F04.quality",{"title":1783,"path":1784,"stem":1785},"Delegation and human decisions","\u002Freference\u002Fagent-definition\u002Fcoordination","10.reference\u002F03.agent-definition\u002F05.coordination",{"title":1787,"path":1788,"stem":1789},"History and recovery","\u002Freference\u002Fagent-definition\u002Fhistory","10.reference\u002F03.agent-definition\u002F06.history",{"title":1791,"path":1792,"stem":1793},"Sandbox, data and retention","\u002Freference\u002Fagent-definition\u002Fsecurity","10.reference\u002F03.agent-definition\u002F07.security",{"title":1795,"path":1796,"stem":1797,"icon":517},"Ports","\u002Freference\u002Fports","10.reference\u002F04.ports",{"title":1799,"path":1800,"stem":1801,"icon":1802},"Environment variables","\u002Freference\u002Fenvironment","10.reference\u002F05.environment","i-ph-brackets-curly",{"title":1804,"path":1805,"stem":1806,"icon":373},"Files and directories","\u002Freference\u002Ffiles","10.reference\u002F06.files",{"title":1808,"path":1809,"stem":1810,"icon":1811},"Lists and pages","\u002Freference\u002Flist-pages","10.reference\u002F07.list-pages","i-ph-list-numbers",{"title":1813,"path":1814,"stem":1815,"icon":1816},"Spend refusals","\u002Freference\u002Fspend-refusals","10.reference\u002F08.spend-refusals","i-ph-hand-coins",{"title":1818,"path":1819,"stem":1820,"icon":1821},"Admin API","\u002Freference\u002Fadmin-api","10.reference\u002F09.admin-api","i-ph-repeat",{"title":1823,"path":1824,"stem":1825},"Compatibility","\u002Freference\u002Fcompatibility","10.reference\u002F10.compatibility",{"title":1827,"path":1828,"stem":1829},"Known issues","\u002Freference\u002Fknown-issues","10.reference\u002F11.known-issues",{"title":1831,"path":1832,"stem":1833,"children":1834,"icon":71},"About","\u002Fabout","11.about\u002F00.index",[1835,1836,1840,1845],{"title":1831,"path":1832,"stem":1833},{"title":1837,"path":1838,"stem":1839,"icon":967},"Licensing","\u002Fabout\u002Flicensing","11.about\u002F01.licensing",{"title":1841,"path":1842,"stem":1843,"icon":1844},"About these docs","\u002Fabout\u002Fcontributing-docs","11.about\u002F02.contributing-docs","i-ph-pencil-simple",{"title":1846,"path":1847,"stem":1848,"icon":42},"A local environment","\u002Fabout\u002Flocal-environment","11.about\u002F03.local-environment",{"id":1850,"title":777,"body":1851,"description":3598,"extension":3599,"links":3600,"meta":3601,"navigation":3604,"path":778,"seo":3605,"stem":779,"__hash__":3606},"docs\u002F04.build\u002F02.parts\u002F11.connections\u002F00.index.md",{"type":1852,"value":1853,"toc":3586},"minimark",[1854,1858,1861,1874,1884,1889,1892,2524,2535,2540,2988,2992,3015,3035,3039,3070,3087,3106,3119,3122,3126,3132,3160,3172,3176,3187,3200,3204,3243,3253,3270,3353,3357,3390,3480,3496,3499,3503,3517,3582],[1855,1856,1857],"p",{},"For: plugin authors.",[1855,1859,1860],{},"Declare a connection when plugin tools act on another system as the tenant. The connection describes which tools receive tokens, the values an admin supplies, browser setup steps, token creation and the permissions of each function's token.",[1855,1862,1863,1864,1868,1869,1873],{},"The edge executes this configuration. Your plugin reads a token for each call rather than requesting a long-lived key through ",[1865,1866,1867],"code",{},"requires.secrets",". Admins connect it under Credentials, Connections in the console; see ",[1870,1871,1872],"a",{"href":1660},"connection administration",".",[1855,1875,1876,1879,1880,1883],{},[1870,1877,1878],{"href":494},"ai.oz0\u002Fgithub","'s connection, a GitHub App registered from a manifest and installed on an organization, is the full example: see ",[1865,1881,1882],{},"plugins\u002Fgithub\u002Foz0-plugin.yaml"," in your checkout. That file currently requires repository access; public source downloads are coming soon.",[1885,1886,1888],"h2",{"id":1887},"declare-one","Declare one",[1855,1890,1891],{},"An OAuth 2.0 app with PKCE, whose bot token the exchange answers:",[1893,1894,1899],"pre",{"className":1895,"code":1896,"filename":1727,"language":1897,"meta":1898,"style":1898},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","connections:\n  - name: forge                          # unique in the tenant: \u002Fconnect\u002F\u003Ctenant>\u002Fforge\u002Fcallback\n    description: The Forge workspace your agents post to\n    tools: [acme_forge]                  # this plugin's tools whose calls get its token\n    params:\n      - {name: client_id, description: The OAuth app's client ID, required: true}\n      - {name: api_url, default: \"https:\u002F\u002Fapi.forge.example\"}\n    steps:\n      - name: authorize\n        description: Forge asks which workspace to add the bot to\n        browser:\n          url: \"https:\u002F\u002Fforge.example\u002Foauth\u002Fauthorize\"\n          query:\n            client_id: \"{params.client_id}\"\n            redirect_uri: \"{callback_url}\"\n            scope: \"chat:write\"\n            code_challenge: \"{pkce.challenge}\"\n            code_challenge_method: S256\n        pkce: S256\n        callback: [code]                 # what the provider's redirect must carry (state is always checked)\n        exchange:                        # made by the edge, server to server\n          method: POST\n          url: \"{params.api_url}\u002Foauth\u002Ftoken\"\n          form:\n            code: \"{callback.code}\"\n            code_verifier: \"{pkce.verifier}\"\n            redirect_uri: \"{callback_url}\"\n          auth: basic\n          basic: {user: \"{params.client_id}\", password: \"{secret.FORGE_CLIENT_SECRET}\"}\n          expect: {ok: \"true\"}           # the answer must say so, or the step fails with its error\n        save:\n          secrets: {FORGE_BOT_TOKEN: \"{answer.access_token}\"}   # sealed for the edges\n          values: {workspace: \"{answer.team.name}\"}             # shown on the Connections tab\n    token:\n      kind: secret                       # calls get a tenant secret...\n      secret: FORGE_BOT_TOKEN            # ...the one the step saved\n      pass: {api_url: \"{params.api_url}\"}\n    scopes:\n      - functions: [acme_forge.post_message, acme_forge.list_channels]\n","yaml","",[1865,1900,1901,1914,1934,1945,1965,1973,2015,2047,2055,2067,2078,2086,2102,2110,2125,2140,2155,2170,2181,2191,2208,2219,2230,2244,2252,2267,2282,2295,2306,2343,2371,2379,2406,2433,2441,2455,2469,2493,2501],{"__ignoreMap":1898},[1902,1903,1906,1910],"span",{"class":1904,"line":1905},"line",1,[1902,1907,1909],{"class":1908},"swJcz","connections",[1902,1911,1913],{"class":1912},"sMK4o",":\n",[1902,1915,1917,1920,1923,1926,1930],{"class":1904,"line":1916},2,[1902,1918,1919],{"class":1912},"  -",[1902,1921,1922],{"class":1908}," name",[1902,1924,1925],{"class":1912},":",[1902,1927,1929],{"class":1928},"sfazB"," forge",[1902,1931,1933],{"class":1932},"sHwdD","                          # unique in the tenant: \u002Fconnect\u002F\u003Ctenant>\u002Fforge\u002Fcallback\n",[1902,1935,1937,1940,1942],{"class":1904,"line":1936},3,[1902,1938,1939],{"class":1908},"    description",[1902,1941,1925],{"class":1912},[1902,1943,1944],{"class":1928}," The Forge workspace your agents post to\n",[1902,1946,1948,1951,1953,1956,1959,1962],{"class":1904,"line":1947},4,[1902,1949,1950],{"class":1908},"    tools",[1902,1952,1925],{"class":1912},[1902,1954,1955],{"class":1912}," [",[1902,1957,1958],{"class":1928},"acme_forge",[1902,1960,1961],{"class":1912},"]",[1902,1963,1964],{"class":1932},"                  # this plugin's tools whose calls get its token\n",[1902,1966,1968,1971],{"class":1904,"line":1967},5,[1902,1969,1970],{"class":1908},"    params",[1902,1972,1913],{"class":1912},[1902,1974,1976,1979,1982,1985,1987,1990,1993,1996,1998,2001,2003,2006,2008,2012],{"class":1904,"line":1975},6,[1902,1977,1978],{"class":1912},"      -",[1902,1980,1981],{"class":1912}," {",[1902,1983,1984],{"class":1908},"name",[1902,1986,1925],{"class":1912},[1902,1988,1989],{"class":1928}," client_id",[1902,1991,1992],{"class":1912},",",[1902,1994,1995],{"class":1908}," description",[1902,1997,1925],{"class":1912},[1902,1999,2000],{"class":1928}," The OAuth app's client ID",[1902,2002,1992],{"class":1912},[1902,2004,2005],{"class":1908}," required",[1902,2007,1925],{"class":1912},[1902,2009,2011],{"class":2010},"sfNiH"," true",[1902,2013,2014],{"class":1912},"}\n",[1902,2016,2018,2020,2022,2024,2026,2029,2031,2034,2036,2039,2042,2045],{"class":1904,"line":2017},7,[1902,2019,1978],{"class":1912},[1902,2021,1981],{"class":1912},[1902,2023,1984],{"class":1908},[1902,2025,1925],{"class":1912},[1902,2027,2028],{"class":1928}," api_url",[1902,2030,1992],{"class":1912},[1902,2032,2033],{"class":1908}," default",[1902,2035,1925],{"class":1912},[1902,2037,2038],{"class":1912}," \"",[1902,2040,2041],{"class":1928},"https:\u002F\u002Fapi.forge.example",[1902,2043,2044],{"class":1912},"\"",[1902,2046,2014],{"class":1912},[1902,2048,2050,2053],{"class":1904,"line":2049},8,[1902,2051,2052],{"class":1908},"    steps",[1902,2054,1913],{"class":1912},[1902,2056,2058,2060,2062,2064],{"class":1904,"line":2057},9,[1902,2059,1978],{"class":1912},[1902,2061,1922],{"class":1908},[1902,2063,1925],{"class":1912},[1902,2065,2066],{"class":1928}," authorize\n",[1902,2068,2070,2073,2075],{"class":1904,"line":2069},10,[1902,2071,2072],{"class":1908},"        description",[1902,2074,1925],{"class":1912},[1902,2076,2077],{"class":1928}," Forge asks which workspace to add the bot to\n",[1902,2079,2081,2084],{"class":1904,"line":2080},11,[1902,2082,2083],{"class":1908},"        browser",[1902,2085,1913],{"class":1912},[1902,2087,2089,2092,2094,2096,2099],{"class":1904,"line":2088},12,[1902,2090,2091],{"class":1908},"          url",[1902,2093,1925],{"class":1912},[1902,2095,2038],{"class":1912},[1902,2097,2098],{"class":1928},"https:\u002F\u002Fforge.example\u002Foauth\u002Fauthorize",[1902,2100,2101],{"class":1912},"\"\n",[1902,2103,2105,2108],{"class":1904,"line":2104},13,[1902,2106,2107],{"class":1908},"          query",[1902,2109,1913],{"class":1912},[1902,2111,2113,2116,2118,2120,2123],{"class":1904,"line":2112},14,[1902,2114,2115],{"class":1908},"            client_id",[1902,2117,1925],{"class":1912},[1902,2119,2038],{"class":1912},[1902,2121,2122],{"class":1928},"{params.client_id}",[1902,2124,2101],{"class":1912},[1902,2126,2128,2131,2133,2135,2138],{"class":1904,"line":2127},15,[1902,2129,2130],{"class":1908},"            redirect_uri",[1902,2132,1925],{"class":1912},[1902,2134,2038],{"class":1912},[1902,2136,2137],{"class":1928},"{callback_url}",[1902,2139,2101],{"class":1912},[1902,2141,2143,2146,2148,2150,2153],{"class":1904,"line":2142},16,[1902,2144,2145],{"class":1908},"            scope",[1902,2147,1925],{"class":1912},[1902,2149,2038],{"class":1912},[1902,2151,2152],{"class":1928},"chat:write",[1902,2154,2101],{"class":1912},[1902,2156,2158,2161,2163,2165,2168],{"class":1904,"line":2157},17,[1902,2159,2160],{"class":1908},"            code_challenge",[1902,2162,1925],{"class":1912},[1902,2164,2038],{"class":1912},[1902,2166,2167],{"class":1928},"{pkce.challenge}",[1902,2169,2101],{"class":1912},[1902,2171,2173,2176,2178],{"class":1904,"line":2172},18,[1902,2174,2175],{"class":1908},"            code_challenge_method",[1902,2177,1925],{"class":1912},[1902,2179,2180],{"class":1928}," S256\n",[1902,2182,2184,2187,2189],{"class":1904,"line":2183},19,[1902,2185,2186],{"class":1908},"        pkce",[1902,2188,1925],{"class":1912},[1902,2190,2180],{"class":1928},[1902,2192,2194,2197,2199,2201,2203,2205],{"class":1904,"line":2193},20,[1902,2195,2196],{"class":1908},"        callback",[1902,2198,1925],{"class":1912},[1902,2200,1955],{"class":1912},[1902,2202,1865],{"class":1928},[1902,2204,1961],{"class":1912},[1902,2206,2207],{"class":1932},"                 # what the provider's redirect must carry (state is always checked)\n",[1902,2209,2211,2214,2216],{"class":1904,"line":2210},21,[1902,2212,2213],{"class":1908},"        exchange",[1902,2215,1925],{"class":1912},[1902,2217,2218],{"class":1932},"                        # made by the edge, server to server\n",[1902,2220,2222,2225,2227],{"class":1904,"line":2221},22,[1902,2223,2224],{"class":1908},"          method",[1902,2226,1925],{"class":1912},[1902,2228,2229],{"class":1928}," POST\n",[1902,2231,2233,2235,2237,2239,2242],{"class":1904,"line":2232},23,[1902,2234,2091],{"class":1908},[1902,2236,1925],{"class":1912},[1902,2238,2038],{"class":1912},[1902,2240,2241],{"class":1928},"{params.api_url}\u002Foauth\u002Ftoken",[1902,2243,2101],{"class":1912},[1902,2245,2247,2250],{"class":1904,"line":2246},24,[1902,2248,2249],{"class":1908},"          form",[1902,2251,1913],{"class":1912},[1902,2253,2255,2258,2260,2262,2265],{"class":1904,"line":2254},25,[1902,2256,2257],{"class":1908},"            code",[1902,2259,1925],{"class":1912},[1902,2261,2038],{"class":1912},[1902,2263,2264],{"class":1928},"{callback.code}",[1902,2266,2101],{"class":1912},[1902,2268,2270,2273,2275,2277,2280],{"class":1904,"line":2269},26,[1902,2271,2272],{"class":1908},"            code_verifier",[1902,2274,1925],{"class":1912},[1902,2276,2038],{"class":1912},[1902,2278,2279],{"class":1928},"{pkce.verifier}",[1902,2281,2101],{"class":1912},[1902,2283,2285,2287,2289,2291,2293],{"class":1904,"line":2284},27,[1902,2286,2130],{"class":1908},[1902,2288,1925],{"class":1912},[1902,2290,2038],{"class":1912},[1902,2292,2137],{"class":1928},[1902,2294,2101],{"class":1912},[1902,2296,2298,2301,2303],{"class":1904,"line":2297},28,[1902,2299,2300],{"class":1908},"          auth",[1902,2302,1925],{"class":1912},[1902,2304,2305],{"class":1928}," basic\n",[1902,2307,2309,2312,2314,2316,2319,2321,2323,2325,2327,2329,2332,2334,2336,2339,2341],{"class":1904,"line":2308},29,[1902,2310,2311],{"class":1908},"          basic",[1902,2313,1925],{"class":1912},[1902,2315,1981],{"class":1912},[1902,2317,2318],{"class":1908},"user",[1902,2320,1925],{"class":1912},[1902,2322,2038],{"class":1912},[1902,2324,2122],{"class":1928},[1902,2326,2044],{"class":1912},[1902,2328,1992],{"class":1912},[1902,2330,2331],{"class":1908}," password",[1902,2333,1925],{"class":1912},[1902,2335,2038],{"class":1912},[1902,2337,2338],{"class":1928},"{secret.FORGE_CLIENT_SECRET}",[1902,2340,2044],{"class":1912},[1902,2342,2014],{"class":1912},[1902,2344,2346,2349,2351,2353,2356,2358,2360,2363,2365,2368],{"class":1904,"line":2345},30,[1902,2347,2348],{"class":1908},"          expect",[1902,2350,1925],{"class":1912},[1902,2352,1981],{"class":1912},[1902,2354,2355],{"class":1908},"ok",[1902,2357,1925],{"class":1912},[1902,2359,2038],{"class":1912},[1902,2361,2362],{"class":1928},"true",[1902,2364,2044],{"class":1912},[1902,2366,2367],{"class":1912},"}",[1902,2369,2370],{"class":1932},"           # the answer must say so, or the step fails with its error\n",[1902,2372,2374,2377],{"class":1904,"line":2373},31,[1902,2375,2376],{"class":1908},"        save",[1902,2378,1913],{"class":1912},[1902,2380,2382,2385,2387,2389,2392,2394,2396,2399,2401,2403],{"class":1904,"line":2381},32,[1902,2383,2384],{"class":1908},"          secrets",[1902,2386,1925],{"class":1912},[1902,2388,1981],{"class":1912},[1902,2390,2391],{"class":1908},"FORGE_BOT_TOKEN",[1902,2393,1925],{"class":1912},[1902,2395,2038],{"class":1912},[1902,2397,2398],{"class":1928},"{answer.access_token}",[1902,2400,2044],{"class":1912},[1902,2402,2367],{"class":1912},[1902,2404,2405],{"class":1932},"   # sealed for the edges\n",[1902,2407,2409,2412,2414,2416,2419,2421,2423,2426,2428,2430],{"class":1904,"line":2408},33,[1902,2410,2411],{"class":1908},"          values",[1902,2413,1925],{"class":1912},[1902,2415,1981],{"class":1912},[1902,2417,2418],{"class":1908},"workspace",[1902,2420,1925],{"class":1912},[1902,2422,2038],{"class":1912},[1902,2424,2425],{"class":1928},"{answer.team.name}",[1902,2427,2044],{"class":1912},[1902,2429,2367],{"class":1912},[1902,2431,2432],{"class":1932},"             # shown on the Connections tab\n",[1902,2434,2436,2439],{"class":1904,"line":2435},34,[1902,2437,2438],{"class":1908},"    token",[1902,2440,1913],{"class":1912},[1902,2442,2444,2447,2449,2452],{"class":1904,"line":2443},35,[1902,2445,2446],{"class":1908},"      kind",[1902,2448,1925],{"class":1912},[1902,2450,2451],{"class":1928}," secret",[1902,2453,2454],{"class":1932},"                       # calls get a tenant secret...\n",[1902,2456,2458,2461,2463,2466],{"class":1904,"line":2457},36,[1902,2459,2460],{"class":1908},"      secret",[1902,2462,1925],{"class":1912},[1902,2464,2465],{"class":1928}," FORGE_BOT_TOKEN",[1902,2467,2468],{"class":1932},"            # ...the one the step saved\n",[1902,2470,2472,2475,2477,2479,2482,2484,2486,2489,2491],{"class":1904,"line":2471},37,[1902,2473,2474],{"class":1908},"      pass",[1902,2476,1925],{"class":1912},[1902,2478,1981],{"class":1912},[1902,2480,2481],{"class":1908},"api_url",[1902,2483,1925],{"class":1912},[1902,2485,2038],{"class":1912},[1902,2487,2488],{"class":1928},"{params.api_url}",[1902,2490,2044],{"class":1912},[1902,2492,2014],{"class":1912},[1902,2494,2496,2499],{"class":1904,"line":2495},38,[1902,2497,2498],{"class":1908},"    scopes",[1902,2500,1913],{"class":1912},[1902,2502,2504,2506,2509,2511,2513,2516,2518,2521],{"class":1904,"line":2503},39,[1902,2505,1978],{"class":1912},[1902,2507,2508],{"class":1908}," functions",[1902,2510,1925],{"class":1912},[1902,2512,1955],{"class":1912},[1902,2514,2515],{"class":1928},"acme_forge.post_message",[1902,2517,1992],{"class":1912},[1902,2519,2520],{"class":1928}," acme_forge.list_channels",[1902,2522,2523],{"class":1912},"]\n",[1855,2525,2526,2527,2530,2531,2534],{},"The admin sets ",[1865,2528,2529],{},"FORGE_CLIENT_SECRET"," once (",[1865,2532,2533],{},"oz0 secret set FORGE_CLIENT_SECRET","), then connects.",[2536,2537,2539],"h3",{"id":2538},"the-fields","The fields",[2541,2542,2543,2556],"table",{},[2544,2545,2546],"thead",{},[2547,2548,2549,2553],"tr",{},[2550,2551,2552],"th",{},"Field",[2550,2554,2555],{},"Meaning",[2557,2558,2559,2572,2582,2617,2627,2643,2657,2676,2690,2745,2762,2813,2827,2841,2855,2904,2923,2933,2962],"tbody",{},[2547,2560,2561,2566],{},[2562,2563,2564],"td",{},[1865,2565,1984],{},[2562,2567,2568,2569,1873],{},"Lowercase letters, digits and dashes; in the callback's URL. The tenant secrets its steps save start with it in capitals: ",[1865,2570,2571],{},"FORGE_*",[2547,2573,2574,2579],{},[2562,2575,2576],{},[1865,2577,2578],{},"tools",[2562,2580,2581],{},"This plugin's tools whose calls may get its token.",[2547,2583,2584,2589],{},[2562,2585,2586],{},[1865,2587,2588],{},"params",[2562,2590,2591,2592,2594,2595,2594,2598,2594,2601,2604,2605,2608,2609,2612,2613,2616],{},"What an admin gives when connecting: ",[1865,2593,1984],{},", ",[1865,2596,2597],{},"description",[1865,2599,2600],{},"default",[1865,2602,2603],{},"required",", and ",[1865,2606,2607],{},"choices"," for a param that is one of a few values, which the console shows as a select. ",[1865,2610,2611],{},"max_length"," limits a param such as an app name; a ",[1865,2614,2615],{},"{tenant}"," default is shortened to fit.",[2547,2618,2619,2624],{},[2562,2620,2621],{},[1865,2622,2623],{},"steps[]",[2562,2625,2626],{},"Done in order, each in the admin's browser and back to the edge's callback.",[2547,2628,2629,2634],{},[2562,2630,2631],{},[1865,2632,2633],{},"steps[].when",[2562,2635,2636,2637,2640,2641,1873],{},"The params and values the step runs with, such as ",[1865,2638,2639],{},"{account: user}",": a flow skips a step whose params differ, so one connection can take another path for another kind of account (ai.oz0\u002Fgithub registers an app on an organization or on a user with two steps). A step needs the params it reads; a param only some steps read need not be ",[1865,2642,2603],{},[2547,2644,2645,2650],{},[2562,2646,2647],{},[1865,2648,2649],{},"steps[].browser",[2562,2651,2652,2653,1873],{},"Redirects or posts a form to the other system. See ",[1870,2654,2656],{"href":2655},"#browser-steps-and-allowed-urls","browser fields and URL checks",[2547,2658,2659,2664],{},[2562,2660,2661],{},[1865,2662,2663],{},"steps[].pkce",[2562,2665,2666,2669,2670,2672,2673,2675],{},[1865,2667,2668],{},"S256"," makes a PKCE pair for the step: ",[1865,2671,2167],{}," for the browser, ",[1865,2674,2279],{}," for the exchange.",[2547,2677,2678,2683],{},[2562,2679,2680],{},[1865,2681,2682],{},"steps[].callback",[2562,2684,2685,2686,2689],{},"The query parameters the provider's redirect must bring. An ",[1865,2687,2688],{},"error"," parameter (OAuth's) fails the step with the provider's words.",[2547,2691,2692,2697],{},[2562,2693,2694],{},[1865,2695,2696],{},"steps[].exchange",[2562,2698,2699,2700,2594,2703,2594,2706,2594,2709,2712,2713,2716,2717,2720,2721,2724,2725,2728,2729,2732,2733,2736,2737,2740,2741,2744],{},"A request the edge makes when the callback came: ",[1865,2701,2702],{},"method",[1865,2704,2705],{},"url",[1865,2707,2708],{},"query",[1865,2710,2711],{},"headers",", and a ",[1865,2714,2715],{},"form"," or ",[1865,2718,2719],{},"json"," body; ",[1865,2722,2723],{},"auth: jwt"," (the token's JWT) or ",[1865,2726,2727],{},"auth: basic",". Its JSON answer is ",[1865,2730,2731],{},"{answer.*}",". ",[1865,2734,2735],{},"expect",", such as ",[1865,2738,2739],{},"{ok: \"true\"}",", are fields the answer must have, for an API that answers 200 with ",[1865,2742,2743],{},"{\"ok\": false, \"error\": ...}",": the step then fails with that error and saves nothing.",[2547,2746,2747,2752],{},[2562,2748,2749],{},[1865,2750,2751],{},"steps[].save",[2562,2753,2754,2757,2758,2761],{},[1865,2755,2756],{},"secrets",": tenant secrets, sealed for the edges, named with the connection's prefix. ",[1865,2759,2760],{},"values",": kept on the connection, where people see them; never put a secret here.",[2547,2763,2764,2769],{},[2562,2765,2766],{},[1865,2767,2768],{},"token.kind",[2562,2770,2771,2774,2775,2732,2778,2781,2782,2785,2786,2594,2789,2792,2793,2796,2797,2800,2801,2804,2805,2808,2809,2812],{},[1865,2772,2773],{},"secret",": calls get the tenant secret ",[1865,2776,2777],{},"token.secret",[1865,2779,2780],{},"jwt-exchange",": the edge signs an RS256 JWT with the saved key ",[1865,2783,2784],{},"token.jwt.key"," (issuer ",[1865,2787,2788],{},"token.jwt.issuer",[1865,2790,2791],{},"ttl"," at most 10m) and asks ",[1865,2794,2795],{},"token.url"," for a token, sending the function's scope in ",[1865,2798,2799],{},"scope_field"," and its resource in ",[1865,2802,2803],{},"resource_field",", and reading ",[1865,2806,2807],{},"token_field"," and ",[1865,2810,2811],{},"expires_field"," of the answer.",[2547,2814,2815,2820],{},[2562,2816,2817],{},[1865,2818,2819],{},"token.kind: client-credentials",[2562,2821,2822,2823,1873],{},"The edge requests a service token with a client ID and secret bound to the destination. See ",[1870,2824,2826],{"href":2825},"#client-credentials-grants","grant fields and restrictions",[2547,2828,2829,2834],{},[2562,2830,2831],{},[1865,2832,2833],{},"token.kind: identity",[2562,2835,2836,2837,1873],{},"An OIDC token from the tenant issuer, without setup steps or a stored secret. See ",[1870,2838,2840],{"href":2839},"#identity-token-fields","identity fields",[2547,2842,2843,2848],{},[2562,2844,2845],{},[1865,2846,2847],{},"token.kind: on_behalf_of",[2562,2849,2850,2851,1873],{},"Exchanges a delegated identity token for the service token needed by a call. See ",[1870,2852,2854],{"href":2853},"#on-behalf-of-token-fields","exchange fields",[2547,2856,2857,2862],{},[2562,2858,2859],{},[1865,2860,2861],{},"token.refresh",[2562,2863,2864,2865,2868,2869,2871,2872,2716,2875,2878,2879,2881,2882,2878,2885,2888,2889,2892,2893,2808,2896,2899,2900,1873],{},"Renews a ",[1865,2866,2867],{},"kind: secret"," token a step saved, before it expires: ",[1865,2870,2705],{}," (the token endpoint, a literal ",[1865,2873,2874],{},"https:\u002F\u002F\u003Chost>\u002F",[1865,2876,2877],{},"https:\u002F\u002F{params.\u003Cname>}\u002F","), ",[1865,2880,2773],{}," (the tenant secret a step saves the refresh token in, such as ",[1865,2883,2884],{},"{answer.refresh_token}",[1865,2886,2887],{},"client_id",", optionally ",[1865,2890,2891],{},"client_secret"," (a confidential client's secret; leave it out for a public client with PKCE), ",[1865,2894,2895],{},"scope",[1865,2897,2898],{},"resource"," (RFC 8707, such as the MCP server's URL). See ",[1870,2901,2903],{"href":2902},"\u002Fbuild\u002Fparts\u002Fconnections\u002Ftoken-lifecycle#refresh-tokens","Refresh tokens",[2547,2905,2906,2911],{},[2562,2907,2908],{},[1865,2909,2910],{},"token.fallback_secret",[2562,2912,2913,2914,2917,2918,2920,2921,1873],{},"A tenant secret calls get while the steps are not done, such as ",[1865,2915,2916],{},"GITHUB_TOKEN",": one an admin sets by hand, so no step may save it. Like ",[1865,2919,2777],{},", it is named with the connection's prefix, and neither may be ",[1865,2922,2784],{},[2547,2924,2925,2930],{},[2562,2926,2927],{},[1865,2928,2929],{},"token.pass",[2562,2931,2932],{},"Values the tool gets with the token, such as the API's address. Never secrets.",[2547,2934,2935,2940],{},[2562,2936,2937],{},[1865,2938,2939],{},"after[]",[2562,2941,2942,2943,2946,2947,2950,2951,2954,2955,2808,2958,2961],{},"Functions of the connection's tools that run once each time its last step is done: ",[1865,2944,2945],{},"call"," (",[1865,2948,2949],{},"\u003Ctool>.\u003Cfunction>",") and ",[1865,2952,2953],{},"arguments"," (templates of ",[1865,2956,2957],{},"{params.*}",[1865,2959,2960],{},"{values.*}","). The edge starts each as a tool job, through the node's policy, hooks and approvals, with the new token; the Connections tab shows the jobs. Use it to check what was connected, or to register a bot's commands.",[2547,2963,2964,2969],{},[2562,2965,2966],{},[1865,2967,2968],{},"scopes[]",[2562,2970,2971,2972,2946,2975,2978,2979,2981,2982,2984,2985,2987],{},"Which functions get a token: ",[1865,2973,2974],{},"functions",[1865,2976,2977],{},"\u003Ctool>.*"," for every function of a remote tool on the connection, which its server lists), and for ",[1865,2980,2780],{}," the ",[1865,2983,2895],{}," (an object, such as GitHub's permissions) and the ",[1865,2986,2898],{}," its arguments name, such as `\"{arguments.repo",[2536,2989,2991],{"id":2990},"browser-steps-and-allowed-urls","Browser steps and allowed URLs",[1855,2993,2994,2995,2808,2997,2999,3000,3003,3004,2808,3007,3010,3011,3014],{},"A browser step uses ",[1865,2996,2705],{},[1865,2998,2708],{}," for a redirect. With ",[1865,3001,3002],{},"method: POST",", it uses ",[1865,3005,3006],{},"fields",[1865,3008,3009],{},"json_fields"," for a form posted by the edge's page. A JSON field contains a JSON document made from the object, such as a GitHub App's manifest. The step's ",[1865,3012,3013],{},"state"," is added to the query.",[1855,3016,3017,3018,2594,3021,3024,3025,2594,3028,2808,3031,3034],{},"The browser URL, exchange URL, check URL and guided step's create link must start with ",[1865,3019,3020],{},"https:\u002F\u002F",[1865,3022,3023],{},"http:\u002F\u002F",", or a param holding such an address. Lint refuses other schemes, including ",[1865,3026,3027],{},"javascript:",[1865,3029,3030],{},"data:",[1865,3032,3033],{},"file:",", because they could run in or leave the edge's page instead of reaching the other system. The edge also refuses a filled-in address that is not a web URL.",[2536,3036,3038],{"id":3037},"client-credentials-grants","Client credentials grants",[1855,3040,3041,3042,3045,3046,3048,3049,2594,3052,3054,3055,3058,3059,2604,3062,3054,3064,3067,3068,1873],{},"The edge makes an OAuth 2.0 client credentials grant (RFC 6749 section 4.4). It sends a form ",[1865,3043,3044],{},"POST"," to ",[1865,3047,2795],{}," with ",[1865,3050,3051],{},"grant_type=client_credentials",[1865,3053,2887],{}," from ",[1865,3056,3057],{},"token.client_id"," (a template of params and values), the client secret named by ",[1865,3060,3061],{},"token.client_secret",[1865,3063,2895],{},[1865,3065,3066],{},"token.scope",". The tenant secret uses the connection's prefix, stays with the edge rather than reaching the node, and cannot be listed in ",[1865,3069,1867],{},[1855,3071,3072,3073,3076,3077,3079,3080,3083,3084,3086],{},"The answer's ",[1865,3074,3075],{},"access_token",", or ",[1865,3078,2807],{},", is the call's token until ",[1865,3081,3082],{},"expires_in"," seconds, or ",[1865,3085,2811],{},", have elapsed. The edge caches it while more than ten minutes remain.",[1855,3088,3089,3091,3092,3094,3095,3097,3098,3101,3102,3105],{},[1865,3090,2795],{}," starts with a literal ",[1865,3093,2874],{},". For a customer's own instance, it may use ",[1865,3096,2877],{},", such as a ServiceNow instance's ",[1865,3099,3100],{},"\u002Foauth_token.do",", when a guided step pastes the secret. The edge records the instance's origin at that paste and sends the secret only there. Every guided check using ",[1865,3103,3104],{},"{paste.\u003Cfield>}"," sends it to the same origin.",[1855,3107,3108,3109,3111,3112,3115,3116,1873],{},"Changing the host param, or installing a plugin version whose ",[1865,3110,2795],{}," names another host, requires pasting the secret again before another grant. Only the grant reads the saved secret: lint and the edge refuse ",[1865,3113,3114],{},"{secret.\u003Cclient secret>}"," in any template, and refuse that secret as ",[1865,3117,3118],{},"fallback_secret",[1855,3120,3121],{},"ai.oz0\u002Fteams gets its bot token from Microsoft Entra this way.",[2536,3123,3125],{"id":3124},"identity-token-fields","Identity token fields",[1855,3127,3128,3129,3131],{},"For ",[1865,3130,2833],{},", the edge creates an OIDC identity token for the call from the tenant's issuer. There is no step, secret or admin setting.",[1855,3133,3134,3137,3138,3141,3142,3145,3146,3149,3150,3152,3153,2716,3156,3159],{},[1865,3135,3136],{},"token.profile"," is ",[1865,3139,3140],{},"workload",", whose subject is the agent, or ",[1865,3143,3144],{},"delegated",", whose subject is the person or routine's team the job runs for and whose actor is the agent. ",[1865,3147,3148],{},"token.audience"," names the one service: an ",[1865,3151,3020],{}," URL, ",[1865,3154,3155],{},"urn:",[1865,3157,3158],{},"api:\u002F\u002F"," name. It can use params so an admin can name the service.",[1855,3161,3162,3163,2594,3165,3167,3168,1873],{},"This kind takes no ",[1865,3164,2705],{},[1865,3166,2895],{},", client or fallback. See ",[1870,3169,3171],{"href":3170},"\u002Fbuild\u002Fparts\u002Fconnections\u002Ftoken-lifecycle#identity-tokens","Identity tokens",[2536,3173,3175],{"id":3174},"on-behalf-of-token-fields","On-behalf-of token fields",[1855,3177,3128,3178,3180,3181,3183,3184,3186],{},[1865,3179,2847],{},", the edge exchanges a delegated identity token for a service's own token on each call. The exchange uses ",[1865,3182,2795],{},", the service's RFC 8693 token endpoint, as a literal ",[1865,3185,2874],{},". The agent's workload token is the actor.",[1855,3188,3189,3191,3192,3194,3195,2808,3197,3199],{},[1865,3190,3148],{}," sets the delegated token's audience, defaulting to the endpoint URL. ",[1865,3193,3066],{}," sets the requested scope. If the endpoint needs client credentials, ",[1865,3196,3057],{},[1865,3198,3061],{}," supply them. As with client credentials grants, the secret goes only to the origin for which it was pasted.",[2536,3201,3203],{"id":3202},"a-private-key-instead-of-a-client-secret","A private key instead of a client secret",[1855,3205,3206,3207,3210,3211,3214,3215,3217,3218,2808,3221,3224,3225,3228,3229,2732,3232,3235,3236,3239,3240,3242],{},"Some directories take no client secret for their management scopes, only a client assertion signed with the client's private key (RFC 7523, ",[1865,3208,3209],{},"private_key_jwt","). With ",[1865,3212,3213],{},"client_auth: private_key_jwt",", the edge signs one for each grant with the RSA key in the tenant secret ",[1865,3216,3061],{}," names, and sends the assertion instead of a secret: ",[1865,3219,3220],{},"iss",[1865,3222,3223],{},"sub"," the client ID, ",[1865,3226,3227],{},"aud"," the token endpoint, five minutes, and a fresh ",[1865,3230,3231],{},"jti",[1865,3233,3234],{},"client_key_id"," is its ",[1865,3237,3238],{},"kid",", a template of params and values; a pasted JWK's own ",[1865,3241,3238],{}," is used without one.",[1855,3244,3245,3246,3248,3249,3252],{},"The key may be a PEM file (PKCS #1 or #8), a PEM pasted into a one-line field, or a private JWK as a directory's console hands it out; it must be at least 2048 bits. Since the key itself goes nowhere, ",[1865,3247,2795],{}," may name its host with one param (a customer's own domain, ",[1865,3250,3251],{},"https:\u002F\u002F{params.domain}\u002Foauth2\u002Fv1\u002Ftoken","); the edge records the origin when the key is pasted and signs nothing for another one until it is pasted again, and no guided check may send the pasted key anywhere.",[1855,3254,3255,3256,3259,3260,3262,3263,3265,3266,3269],{},"A directory whose certificate credentials name the key by its certificate takes the key and its certificate pasted together, both PEM blocks in one field (in either order). The edge then signs the assertion PS256 (RSASSA-PSS), puts the certificate's ",[1865,3257,3258],{},"x5t#S256"," thumbprint (the base64url SHA-256 of its DER) in the header, beside ",[1865,3261,3238],{}," when ",[1865,3264,3234],{}," names one, and adds ",[1865,3267,3268],{},"nbf",". A certificate of another key fails the grant with an error that says so. The directory holds only the certificate, and no secret travels with any grant.",[1893,3271,3273],{"className":1895,"code":3272,"filename":1727,"language":1897,"meta":1898,"style":1898},"token:\n  kind: client-credentials\n  url: \"https:\u002F\u002F{params.domain}\u002Foauth2\u002Fv1\u002Ftoken\"\n  client_id: \"{values.client_id}\"\n  client_secret: DIRECTORY_PRIVATE_KEY\n  client_auth: private_key_jwt\n  scope: \"directory.manage\"\n",[1865,3274,3275,3282,3292,3305,3319,3329,3339],{"__ignoreMap":1898},[1902,3276,3277,3280],{"class":1904,"line":1905},[1902,3278,3279],{"class":1908},"token",[1902,3281,1913],{"class":1912},[1902,3283,3284,3287,3289],{"class":1904,"line":1916},[1902,3285,3286],{"class":1908},"  kind",[1902,3288,1925],{"class":1912},[1902,3290,3291],{"class":1928}," client-credentials\n",[1902,3293,3294,3297,3299,3301,3303],{"class":1904,"line":1936},[1902,3295,3296],{"class":1908},"  url",[1902,3298,1925],{"class":1912},[1902,3300,2038],{"class":1912},[1902,3302,3251],{"class":1928},[1902,3304,2101],{"class":1912},[1902,3306,3307,3310,3312,3314,3317],{"class":1904,"line":1947},[1902,3308,3309],{"class":1908},"  client_id",[1902,3311,1925],{"class":1912},[1902,3313,2038],{"class":1912},[1902,3315,3316],{"class":1928},"{values.client_id}",[1902,3318,2101],{"class":1912},[1902,3320,3321,3324,3326],{"class":1904,"line":1967},[1902,3322,3323],{"class":1908},"  client_secret",[1902,3325,1925],{"class":1912},[1902,3327,3328],{"class":1928}," DIRECTORY_PRIVATE_KEY\n",[1902,3330,3331,3334,3336],{"class":1904,"line":1975},[1902,3332,3333],{"class":1908},"  client_auth",[1902,3335,1925],{"class":1912},[1902,3337,3338],{"class":1928}," private_key_jwt\n",[1902,3340,3341,3344,3346,3348,3351],{"class":1904,"line":2017},[1902,3342,3343],{"class":1908},"  scope",[1902,3345,1925],{"class":1912},[1902,3347,2038],{"class":1912},[1902,3349,3350],{"class":1928},"directory.manage",[1902,3352,2101],{"class":1912},[1885,3354,3356],{"id":3355},"read-the-token-in-a-call","Read the token in a call",[1855,3358,3359,3360,3048,3363,3366,3367,3370,3371,2946,3374,3378,3379,3381,3382,3385,3386,3389],{},"A remote tool on the connection (",[1865,3361,3362],{},"url:",[1865,3364,3365],{},"connection:",") gets the token in each call's ",[1865,3368,3369],{},"Authorization"," header instead, and nothing in ",[1865,3372,3373],{},"_meta",[1870,3375,3377],{"href":3376},"\u002Fbuild\u002Fparts\u002Ftools#remote-servers-on-connections","Remote servers on connections","). Every other call of a function that a scope lists carries its connection's token in the MCP request's ",[1865,3380,3373],{},", under ",[1865,3383,3384],{},"oz0\u002Fconnections",": ",[1865,3387,3388],{},"{\"\u003Cconnection>\": {\"token\": \"...\", \"kind\": \"app\" | \"secret\" | \"identity\" | \"on_behalf_of\" | \"federated\", \"expires_at\": \"...\", ...pass}}",". With the Python MCP SDK:",[1893,3391,3396],{"className":3392,"code":3393,"filename":3394,"language":3395,"meta":1898,"style":1898},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","from mcp.server import MCPServer\nfrom mcp.server.mcpserver import Context\n\nserver = MCPServer(\"acme_forge\")\n\n\ndef token(ctx: Context) -> tuple[str, str]:\n    meta = ctx.request_context.meta or {}\n    forge = (meta.get(\"oz0\u002Fconnections\") or {}).get(\"forge\") or {}\n    return forge.get(\"token\", \"\"), forge.get(\"api_url\", \"https:\u002F\u002Fapi.forge.example\")\n\n\n@server.tool()\ndef post_message(channel: str, text: str, ctx: Context) -> str:\n    \"\"\"Post a message to a channel.\"\"\"\n    bearer, api = token(ctx)\n    ...\n","src\u002Facme_forge\u002Fserver.py","python",[1865,3397,3398,3403,3408,3414,3419,3423,3427,3432,3437,3442,3447,3451,3455,3460,3465,3470,3475],{"__ignoreMap":1898},[1902,3399,3400],{"class":1904,"line":1905},[1902,3401,3402],{},"from mcp.server import MCPServer\n",[1902,3404,3405],{"class":1904,"line":1916},[1902,3406,3407],{},"from mcp.server.mcpserver import Context\n",[1902,3409,3410],{"class":1904,"line":1936},[1902,3411,3413],{"emptyLinePlaceholder":3412},true,"\n",[1902,3415,3416],{"class":1904,"line":1947},[1902,3417,3418],{},"server = MCPServer(\"acme_forge\")\n",[1902,3420,3421],{"class":1904,"line":1967},[1902,3422,3413],{"emptyLinePlaceholder":3412},[1902,3424,3425],{"class":1904,"line":1975},[1902,3426,3413],{"emptyLinePlaceholder":3412},[1902,3428,3429],{"class":1904,"line":2017},[1902,3430,3431],{},"def token(ctx: Context) -> tuple[str, str]:\n",[1902,3433,3434],{"class":1904,"line":2049},[1902,3435,3436],{},"    meta = ctx.request_context.meta or {}\n",[1902,3438,3439],{"class":1904,"line":2057},[1902,3440,3441],{},"    forge = (meta.get(\"oz0\u002Fconnections\") or {}).get(\"forge\") or {}\n",[1902,3443,3444],{"class":1904,"line":2069},[1902,3445,3446],{},"    return forge.get(\"token\", \"\"), forge.get(\"api_url\", \"https:\u002F\u002Fapi.forge.example\")\n",[1902,3448,3449],{"class":1904,"line":2080},[1902,3450,3413],{"emptyLinePlaceholder":3412},[1902,3452,3453],{"class":1904,"line":2088},[1902,3454,3413],{"emptyLinePlaceholder":3412},[1902,3456,3457],{"class":1904,"line":2104},[1902,3458,3459],{},"@server.tool()\n",[1902,3461,3462],{"class":1904,"line":2112},[1902,3463,3464],{},"def post_message(channel: str, text: str, ctx: Context) -> str:\n",[1902,3466,3467],{"class":1904,"line":2127},[1902,3468,3469],{},"    \"\"\"Post a message to a channel.\"\"\"\n",[1902,3471,3472],{"class":1904,"line":2142},[1902,3473,3474],{},"    bearer, api = token(ctx)\n",[1902,3476,3477],{"class":1904,"line":2157},[1902,3478,3479],{},"    ...\n",[1855,3481,3482,3483,2808,3486,3489,3490,3492,3493,3495],{},"In ",[1865,3484,3485],{},"oz0 dev",[1865,3487,3488],{},"oz0 plugin test",", a connection's ",[1865,3491,3118],{}," that is set in your environment, such as ",[1865,3494,2916],{},", is copied into the dev server's tenant, as declared secrets are, so your tools get it in each call there too.",[1855,3497,3498],{},"The token is in no environment variable and never reaches the job's history. A call whose connection gives it no token (not connected, no fallback secret set) is not made: the agent reads that an admin connects it, and how.",[1885,3500,3502],{"id":3501},"related-tasks","Related tasks",[3504,3505,3506,3512],"ul",{},[3507,3508,3509,3511],"li",{},[1870,3510,784],{"href":785},": Refresh credentials, request identity tokens and handle long calls.",[3507,3513,3514,3516],{},[1870,3515,788],{"href":789},": Build guided connection steps and understand edge enforcement.",[3518,3519,3520],"legacy-sections",{},[3504,3521,3522,3531,3540,3548,3557,3565,3574],{},[3507,3523,3524,3385,3528],{},[1902,3525,3527],{"id":3526},"clouds","Section",[1870,3529,3526],{"href":3530},"\u002Fbuild\u002Fparts\u002Fconnections\u002Ftoken-lifecycle#clouds",[3507,3532,3533,3385,3536],{},[1902,3534,3527],{"id":3535},"guided-steps",[1870,3537,3539],{"href":3538},"\u002Fbuild\u002Fparts\u002Fconnections\u002Fsetup-and-security#guided-steps","guided steps",[3507,3541,3542,3385,3545],{},[1902,3543,3527],{"id":3544},"identity-tokens",[1870,3546,3547],{"href":3170},"identity tokens",[3507,3549,3550,3385,3553],{},[1902,3551,3527],{"id":3552},"long-calls-as-tasks",[1870,3554,3556],{"href":3555},"\u002Fbuild\u002Fparts\u002Fconnections\u002Ftoken-lifecycle#long-calls-as-tasks","long calls as tasks",[3507,3558,3559,3385,3562],{},[1902,3560,3527],{"id":3561},"refresh-tokens",[1870,3563,3564],{"href":2902},"refresh tokens",[3507,3566,3567,3385,3570],{},[1902,3568,3527],{"id":3569},"rules-the-edge-keeps",[1870,3571,3573],{"href":3572},"\u002Fbuild\u002Fparts\u002Fconnections\u002Fsetup-and-security#rules-the-edge-keeps","rules the edge keeps",[3507,3575,3576,3385,3579],{},[1902,3577,3527],{"id":3578},"templates",[1870,3580,3578],{"href":3581},"\u002Fbuild\u002Fparts\u002Fconnections\u002Fsetup-and-security#templates",[3583,3584,3585],"style",{},"html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":1898,"searchDepth":1916,"depth":1916,"links":3587},[3588,3596,3597],{"id":1887,"depth":1916,"text":1888,"children":3589},[3590,3591,3592,3593,3594,3595],{"id":2538,"depth":1936,"text":2539},{"id":2990,"depth":1936,"text":2991},{"id":3037,"depth":1936,"text":3038},{"id":3124,"depth":1936,"text":3125},{"id":3174,"depth":1936,"text":3175},{"id":3202,"depth":1936,"text":3203},{"id":3355,"depth":1916,"text":3356},{"id":3501,"depth":1916,"text":3502},"Define per-call credentials for a plugin and read them in tools.","md",null,{"audience":3602,"doc_type":3603},"plugin authors","how-to",{"icon":782},{"title":777,"description":3598},"V3takqn21EFXZwA_QbXk9SH6YAtc-NvWUifOvLDVglo",[3608,3610],{"title":773,"path":774,"stem":775,"description":3609,"icon":767,"children":-1},"Connect chat channels, inventory changes and granted plugin results.",{"title":784,"path":785,"stem":786,"description":3611,"icon":782,"children":-1},"Refresh credentials, request identity tokens and handle long calls.",1794443003175]