# cloudflare-os | Cloudflare | Knowledge Base | Instagit Agent workspace built on Cloudflare Workers for creating documents, building apps, and running agents with your company’s context and systems. GitHub Stars: 9.6k Repository: https://github.com/cloudflare/cloudflare-os --- ## Articles ### [What Is the Restore Forger in Cloudflare OS Agent Execution?](/cloudflare/cloudflare-os/what-is-the-purpose-of-the-restore-forger-in-cloudflare-os-agent-execution) Discover the Cloudflare OS restore forger's purpose. Learn how this transient worker creates persistent RPC stubs for gadget restore methods without direct code invocation. - Tags: deep-dive - Published: 2026-09-05 ### [How Worktree Sessions Overlay Changes on Pinned Base Commits in Cloudflare OS](/cloudflare/cloudflare-os/how-do-worktree-sessions-overlay-changes-on-pinned-base-commits-in-cloudflare-os) Learn how Cloudflare OS worktree sessions overlay changes on pinned base commits using in-memory operational transforms without materializing Git commits. - Tags: internals - Published: 2026-09-05 ### [What Is the role of the code-change.ts Module in Cloudflare OS?](/cloudflare/cloudflare-os/what-is-the-role-of-the-code-change-ts-module-in-cloudflare-os) Discover the vital role of the code-change.ts module in Cloudflare OS. Learn how it manages operational transform and code edit invariants for seamless system operation. - Tags: internals - Published: 2026-09-05 ### [How Gadget Code Changes Are Managed Using isomorphic-git in Cloudflare OS](/cloudflare/cloudflare-os/how-are-gadget-code-changes-managed-using-isomorphic-git-in-cloudflare-os) Discover how Cloudflare OS manages Gadget code changes using isomorphic-git. Learn about its low-level API and custom logic for Git operations. - Tags: internals - Published: 2026-09-05 ### [How the Cloudflare OS Blueprint System Enables Template Sharing](/cloudflare/cloudflare-os/how-does-the-blueprint-system-in-cloudflare-os-enable-template-sharing) Discover how the Cloudflare OS Blueprint system shares gadget templates via KV and R2. Easily instantiate new gadgets from a URL without exposing sensitive data. - Tags: architecture - Published: 2026-09-05 ### [How the Cap'n Web RPC Interface Ensures Runtime Type Validation in Cloudflare OS](/cloudflare/cloudflare-os/how-does-the-capn-web-rpc-interface-ensure-runtime-type-validation-in-cloudflare-os) Discover how Cloudflare OS leverages Cap'n Web RPC for robust runtime type validation, ensuring data integrity across network boundaries with the capnweb-validate transformer. - Tags: internals - Published: 2026-09-05 ### [How Cloudflare OS Implements the Cap'n Web RPC Protocol for Edge-to-Client Communication](/cloudflare/cloudflare-os/what-is-the-capn-web-rpc-protocol-used-in-cloudflare-os) Discover how Cloudflare OS uses the Capn Web RPC protocol for fast, type-safe communication between Workers and clients via WebSockets. Learn about latency elimination and pipelining. - Tags: deep-dive - Published: 2026-09-05 ### [How Agent Compaction Manages Long Conversations in Cloudflare OS](/cloudflare/cloudflare-os/how-does-the-agent-compaction-system-in-cloudflare-os-manage-long-conversations) Discover how Cloudflare OS agent compaction manages long conversations. It intelligently summarizes history to stay within token limits while preserving full state for replay. - Tags: internals - Published: 2026-09-05 ### [How Cloudflare OS Manages Collaboration and Permissions for Gadgets](/cloudflare/cloudflare-os/how-does-cloudflare-os-manage-collaboration-and-permissions-for-gadgets) Discover how Cloudflare OS manages collaboration and permissions for Gadgets using its innovative permission-graph model. Understand role computation and access controls. - Tags: how-to-guide - Published: 2026-09-05 ### [How Cloudflare OS Handles User Data Persistence Using Typed-Storage](/cloudflare/cloudflare-os/how-does-cloudflare-os-handle-user-data-persistence-using-typed-storage) Learn how Cloudflare OS handles user data persistence with Typed-Storage. Explore schema-driven collections, automatic indexing, and atomic transactions for robust data management. - Tags: internals - Published: 2026-09-05 ### [What Is the Overseer in Cloudflare OS Workspace Management?](/cloudflare/cloudflare-os/what-is-the-role-of-the-overseer-in-cloudflare-os-workspace-management) Discover the Overseer role in Cloudflare OS workspace management. Learn how it orchestrates chat, metadata, and RPC coordination for seamless user and agent interaction via Cap'n Proto. - Tags: deep-dive - Published: 2026-09-05 ### [How the Workspace is Managed as a Durable Object in Cloudflare OS](/cloudflare/cloudflare-os/how-is-the-workspace-managed-as-a-durable-object-in-cloudflare-os) Discover how Cloudflare OS manages the workspace as a Durable Object, the WorkspaceGitCache class, ensuring strongly consistent, edge durable storage for Git state and output indexes. - Tags: internals - Published: 2026-09-05 ### [Understanding the Auto-Provisioning Policy for Gatekeepers in Cloudflare OS](/cloudflare/cloudflare-os/what-is-the-auto-provisioning-policy-for-gatekeepers-in-cloudflare-os) Learn about the Cloudflare OS auto-provisioning policy for Gatekeepers. Discover how vendors enable automatic account creation without OAuth when ambient mode is configured. - Tags: deep-dive - Published: 2026-09-05 ### [How Cloudflare OS Enforces Access Control for External Services via Gatekeepers](/cloudflare/cloudflare-os/how-does-cloudflare-os-enforce-access-control-for-external-services-via-gatekeepers) Cloudflare OS secures external services with Gatekeepers, enforcing access control via capability-based adapters, policy-driven provisioning, and runtime authorization for every operation. - Tags: how-to-guide - Published: 2026-09-05 ### [What Is a Gatekeeper Worker in Cloudflare OS? Architecture and Implementation Guide](/cloudflare/cloudflare-os/what-is-the-function-of-a-gatekeeper-worker-in-cloudflare-os) Understand Cloudflare OS Gatekeeper Workers. This Durable Object broker secures RPC calls, manages authentication, authorization, caching, and approval workflows for user Gadgets and third-party services. - Tags: architecture - Published: 2026-09-05 ### [How Cloudflare OS Implements Capability-Based Security with Gatekeepers](/cloudflare/cloudflare-os/how-does-cloudflare-os-implement-capability-based-security-with-gatekeepers) Discover how Cloudflare OS uses Gatekeepers and capability-based security to isolate services and enforce least-privilege access with URL-granular permissions and Durable Object accounts. - Tags: internals - Published: 2026-09-05 ### [File Edit Size Limits for Cloudflare OS Agents: Understanding the 64 MiB RPC Boundary](/cloudflare/cloudflare-os/what-are-the-file-edit-size-limits-for-cloudflare-os-agents) Understand Cloudflare OS agent file edit size limits. Discover the 64 MiB RPC boundary and its importance for preventing DoS attacks and memory exhaustion. - Tags: deep-dive - Published: 2026-09-05 ### [How Cloudflare OS Manages Agent Code State with Worktree Sessions](/cloudflare/cloudflare-os/how-does-cloudflare-os-manage-agent-code-state-with-worktree-sessions) Discover how Cloudflare OS uses worktree sessions to manage agent code state, ensuring isolated and persistent Git repository views for secure code execution. - Tags: internals - Published: 2026-09-05 ### [How Cloudflare OS Powers AI Agents: Deep Dive into Agent Harness Logic](/cloudflare/cloudflare-os/what-is-the-agent-harness-logic-in-cloudflare-os) Explore Cloudflare OS agent harness logic, an orchestration system managing AI agent execution through five stages for secure code execution and deterministic replay. - Tags: deep-dive - Published: 2026-09-05 ### [How Cloudflare OS Agents Are Executed Using Code Mode](/cloudflare/cloudflare-os/how-are-cloudflare-os-agents-executed-using-code-mode) Learn how Cloudflare OS agents use Code Mode to execute user JavaScript or TypeScript in sandboxed Workers via pipelined Cap'n Proto RPC for immediate edge processing. - Tags: internals - Published: 2026-09-05 ### [Understanding Durable Objects in Cloudflare OS Gadgets: Architecture and Implementation](/cloudflare/cloudflare-os/what-is-the-role-of-durable-objects-in-cloudflare-os-gadgets) Explore Durable Objects in Cloudflare OS Gadgets. Discover how they provide persistent storage, isolation, and RPC for every long-living entity, enabling robust stateful compute. - Tags: architecture - Published: 2026-09-05 ### [Dynamic Worker Isolation in Cloudflare OS: Secure Gadget Sandboxing Explained](/cloudflare/cloudflare-os/what-is-dynamic-worker-isolation-in-cloudflare-os) Discover Dynamic Worker isolation in Cloudflare OS. Learn how Gadgets run securely in isolated facets, restricting external communication for enhanced security. - Tags: deep-dive - Published: 2026-09-05 ### [How Cloudflare OS Sandboxes Gadget Applications: Inside the Double Sandbox Architecture](/cloudflare/cloudflare-os/how-does-cloudflare-os-sandbox-gadget-applications) Discover how Cloudflare OS uses a double sandbox architecture with client-side iframes and server-side Durable Objects to securely isolate Gadget applications with least privilege. - Tags: internals - Published: 2026-09-05 ### [What Is the Trust Boundary in the MCP-Shared Gatekeeper?](/cloudflare/cloudflare-os/what-is-the-trust-boundary-in-the-mcp-shared-gatekeeper-implementation) Understand the trust boundary in the MCP-Shared Gatekeeper. Discover how untrusted tool descriptions become trusted policy decisions at a single point in cloudflare-os. - Tags: deep-dive - Published: 2026-09-04 ### [How Cloudflare OS Manages Gadget Lifecycle and Creation: From Pending State to Runtime Binding](/cloudflare/cloudflare-os/how-does-cloudflare-os-manage-gadget-lifecycle-and-creation) Discover how Cloudflare OS manages Gadget lifecycle and creation. Learn about its three-phase process from pending state to runtime binding using Durable Objects and transaction-safe semantics. - Tags: internals - Published: 2026-09-04 ### [What Is the gatekeeper-kit Package? OAuth Primitives for Cloudflare OS](/cloudflare/cloudflare-os/what-is-the-purpose-of-the-gatekeeper-kit-package) Discover the gatekeeper-kit package, Cloudflare OS's OAuth primitives library. It simplifies authentication, credential management, and policy observation, reducing boilerplate code across gatekeeper implementations. - Tags: deep-dive - Published: 2026-09-04 ### [How Gadget Code Executions Are Harnessed in Cloudflare OS: Inside the Workshop Backend Kernel](/cloudflare/cloudflare-os/how-are-gadget-code-executions-harnessed-in-cloudflare-os) Discover how Cloudflare OS harnesses Gadget code executions within its workshop-backend kernel. Learn about secure RPC, sandboxed Dynamic Workers, and strict isolation for efficient and safe code running. - Tags: internals - Published: 2026-09-04 ### [Critical RPC Patterns Developers Need to Be Aware of in Cloudflare OS](/cloudflare/cloudflare-os/what-are-the-critical-rpc-patterns-developers-need-to-be-aware-of-in-cloudflare-os) Master critical RPC patterns in Cloudflare OS. Learn stub lifecycle management, promise pipelining, and interface validation for efficient capability-based communication. - Tags: deep-dive - Published: 2026-09-04 ### [How Promise Pipelining Works with Cap'n Web RPC in Cloudflare OS](/cloudflare/cloudflare-os/how-is-promise-pipelining-used-with-capn-web-rpc-in-cloudflare-os) Learn how promise pipelining in Capn Web RPC for Cloudflare OS resolves values server-side, eliminating client-side awaits for efficient remote procedure calls. - Tags: deep-dive - Published: 2026-09-04 ### [Understanding the Router Package in Cloudflare OS: Architecture and Routing Logic](/cloudflare/cloudflare-os/what-is-the-function-of-the-router-package-in-cloudflare-os) Explore the Cloudflare OS router package, the public entry point for external traffic. Learn how it routes API requests, gatekeeper traffic, and frontend assets to backend services. - Tags: architecture - Published: 2026-09-04 ### [Understanding the Kernel Metaphor in Cloudflare OS Architecture](/cloudflare/cloudflare-os/what-is-the-kernel-metaphor-in-cloudflare-os-architecture) Discover Cloudflare OS architecture and its kernel metaphor. Learn how workshop-backend acts as the kernel, managing access and security via capability-based sandboxing for apps and services. - Tags: internals - Published: 2026-09-04 ### [How Cloudflare OS Implements a Capability-Based Security Framework](/cloudflare/cloudflare-os/how-does-cloudflare-os-implement-a-capability-based-security-framework) Discover how Cloudflare OS implements object capabilities with Cap n Proto. Learn how possessing a stub equates to authority, removing the need for per-call permission checks. - Tags: internals - Published: 2026-09-04 ### [What Is the Role of Durable Objects in Cloudflare OS? Architecture and Implementation](/cloudflare/cloudflare-os/what-is-the-role-of-durable-objects-in-cloudflare-os) Discover how Cloudflare OS leverages Durable Objects for isolated, strongly consistent stateful storage and compute. Explore their architecture and implementation. - Tags: architecture - Published: 2026-09-04 ### [How the Action Simulation Model Works in Cloudflare OS Gatekeepers](/cloudflare/cloudflare-os/how-does-the-action-simulation-model-work-in-cloudflare-os-gatekeepers) Discover how the action simulation model in Cloudflare OS Gatekeepers allows agents to read external service state, anticipating writes before human approval for efficient operations. - Tags: internals - Published: 2026-09-04 ### [Cloudflare OS Gatekeepers: Complete Guide to Third-Party Service Integrations](/cloudflare/cloudflare-os/which-services-do-the-available-gatekeepers-in-cloudflare-os-integrate-with) Explore Cloudflare OS Gatekeepers and their integrations with Slack, GitHub, Google Workspace, and more. Discover how to connect third-party services seamlessly. - Tags: deep-dive - Published: 2026-09-04 ### [What Are Gatekeepers in Cloudflare OS? A Technical Guide to Capability-Based Adapters](/cloudflare/cloudflare-os/what-are-gatekeepers-in-cloudflare-os-and-what-do-they-do) Discover Cloudflare OS Gatekeepers: capability-based adapters enabling AI gadgets to access external services. Learn about their three-layer architecture, permissions, and audit trails. - Tags: deep-dive - Published: 2026-09-04 ### [How Cloudflare OS Enables Real-Time Multiplayer for Gadgets Using Durable Objects](/cloudflare/cloudflare-os/how-does-cloudflare-os-handle-real-time-multiplayer-for-gadgets) Discover how Cloudflare OS enables real-time multiplayer for Gadgets. Learn how Durable Objects and Cap'n Proto RPC create strongly consistent state and push updates for seamless gaming experiences. - Tags: deep-dive - Published: 2026-09-04 ### [How Gadgets Are Sandboxed in Cloudflare OS: A Dual-Layer Security Model](/cloudflare/cloudflare-os/how-are-gadgets-sandboxed-in-cloudflare-os) Discover how Cloudflare OS sandboxes Gadgets with a dual-layer security model using iframe restrictions and hardened Durable Object runtimes for secure, isolated execution. - Tags: internals - Published: 2026-09-04 ### [What Is Cap'n Web RPC and How Cloudflare OS Uses It for Secure Edge Communication](/cloudflare/cloudflare-os/what-is-capn-web-rpc-and-how-is-it-used-in-cloudflare-os) Discover Capn Web RPC, Cloudflare's protocol for secure, type-safe communication between browser sandboxes and edge Durable Objects. Learn its role in Cloudflare OS. - Tags: deep-dive - Published: 2026-09-04 ### [How the Cloudflare OS Workshop Frontend Communicates with the Backend](/cloudflare/cloudflare-os/how-does-the-workshop-frontend-communicate-with-the-backend) Discover how the Cloudflare OS workshop frontend uses Cap'n Web RPC and WebSockets for type-safe communication with the backend via a shared TypeScript API. - Tags: internals - Published: 2026-09-04 ### [What Is the Role of the Workshop-Backend in Cloudflare OS?](/cloudflare/cloudflare-os/what-is-the-role-of-the-workshop-backend-in-cloudflare-os) Discover the role of the workshop-backend in Cloudflare OS. This core package handles user authentication, policy enforcement, and AI gadget management for the operating system. - Tags: architecture - Published: 2026-09-04 ### [How Cloudflare OS Handles Security with Gatekeepers: A Capability-Based Defense Model](/cloudflare/cloudflare-os/how-is-security-handled-in-cloudflare-os-with-gatekeepers) Discover how Cloudflare OS security leverages Gatekeepers and capability-based defense to isolate integrations, enforce admin controls, and handle OAuth secrets for a trusted backend. - Tags: deep-dive - Published: 2026-09-04 ### [What Are Gadgets in Cloudflare OS? Understanding the Sandboxed Process Model](/cloudflare/cloudflare-os/what-are-gadgets-in-cloudflare-os) Discover Gadgets in Cloudflare OS: private, sandboxed applications running as isolated Durable Objects. Learn how they enforce security boundaries with the Gatekeeper layer for secure software execution. - Tags: deep-dive - Published: 2026-09-04 ### [Cloudflare OS Architecture: A Capability-Based Operating System Built on Workers](/cloudflare/cloudflare-os/what-is-the-architecture-of-cloudflare-os) Explore the Cloudflare OS architecture, a capability-based operating system running on Cloudflare Workers. Discover how it maps OS concepts to serverless primitives for enhanced security and performance. - Tags: architecture - Published: 2026-09-04 ### [How Cloudflare OS Uses Cloudflare Workers: A Modular Full-Stack Architecture](/cloudflare/cloudflare-os/how-does-cloudflare-os-use-cloudflare-workers) Discover how Cloudflare OS leverages Cloudflare Workers for a modular full-stack architecture. Explore its Router, Backend, and Gatekeeper Workers for efficient system design. - Tags: architecture - Published: 2026-09-04 ### [What Is Cloudflare OS? An AI-First Productivity Platform Built on Cloudflare Workers](/cloudflare/cloudflare-os/what-is-cloudflare-os) Discover Cloudflare OS, an AI-first productivity platform built on Cloudflare Workers. This innovative system lets AI agents build and run personal apps called gadgets in a sandboxed environment. - Tags: getting-started - Published: 2026-09-04