Pi does the work. Jev guards the shell.

01At a glance

02One question, end to end

1. You ask.The Pi tab sends your prompt (up to 2,000 characters) with the id of your latest Agent run to POST /api/pi/<session>/ask. If you haven't run the Agent yet, the tab starts a run first so Pi has a board to read.
2. Deal Desk checks you.With a pass, the ask counts against its 10 Pi asks and is refunded if the call fails. Without one, a per-network rate limit applies. Then the request goes over the PI service binding to jev-pi-sandbox.
3. The Durable Object commits it.Your session's PiDesk hands the prompt to the Pi harness, which writes it to SQLite before any work starts, and answers right away with 202 Accepted.
4. The model plans.The harness sends the conversation, Pi's instructions and the tool list to Kimi K2.7 Code through AI Gateway. The model replies with text, tool calls, or both.
5. Tools run, one committed step at a time.Each tool call and its result are saved as they happen. Shell commands pass the Jev gate first. The loop repeats until the model writes a final answer.
6. You watch it land.The tab polls GET /api/pi/<session>/state about once a second and draws the transcript and the gate log from what the Durable Object has saved.

03The Durable Object

A Durable Object is a small, single-threaded Cloudflare server with its own SQLite database, addressed by a name. Pi gets one per session: PiDesk, named by your session id. Your browser keeps that id, so a reload, or opening the tab later, brings back the same conversation. New session makes a new id, which means a new Durable Object, an empty transcript and its own sandbox.

The Pi harness stores everything it does in that database: your messages, the model's replies, every tool call and result, and work still pending. That's what "committed before you see it" means. The page only ever shows what is already saved, and a turn that is interrupted, say by a deploy or a restart, resumes from the last saved step instead of starting over. Tools that only read (deal_board, jev_decide, sandbox_read_file) are marked safe to run again during recovery; tools that change something are not.

The same object keeps a desk_gates table with every command the gate has checked, and owns the sandbox container. Nothing about a session lives anywhere else.

04The model

Pi thinks with Kimi K2.7 Code, Moonshot AI's coding model, which Cloudflare hosts on Workers AI. Every call goes through Cloudflare AI Gateway jev-gateway with logging on and the tag app: jev-pi-sandbox, at a low thinking level to keep answers fast.

What the model is told: Jev is a decision model that returns probabilities, so report them rather than rounding them into certainty; do arithmetic in Python in the sandbox, never in your head; you can draft emails into /workspace but cannot send anything or contact anyone; lead with a one-sentence recommendation and cite card numbers.

Any model can misread the board or pick a clumsy tool. That's why the checks don't depend on it: Jev returns calibrated probabilities, the maths runs as code, and the gate decides with fixed thresholds.

05The six tools

The tools that need secrets (the Jev token, the Deal Desk API) run in the Durable Object, never in the container. The sandbox only ever sees the commands and files Pi sends it.

06The Sandbox

Pi's hands are a Cloudflare Sandbox: a Linux container that belongs to the same Durable Object. It starts the first time Pi needs it, on the "lite" container size, from an Alpine Linux image with bash, python3, jq and coreutils.

• No internet. The container starts with internet access turned off, so nothing in it can download code or send data out.
• One folder. Commands start in /workspace. File reads and writes outside it, or with .. in the path, are refused before they reach the container.
• Bounded. A command times out after 30 seconds unless Pi asks for more (120 at most), and output past 6,000 characters is cut.
• Short-lived. After 10 minutes without use the container stops. The transcript stays in the Durable Object; files in /workspace don't survive a stop.

The transcript's top row shows whether your sandbox is running or stopped.

07The Jev command gate

Before any sandbox_bash command runs, the Durable Object sends it to Jev with one question in plain words: a coding agent wants to run this command inside an isolated Linux sandbox with no internet; working directory /workspace. Jev answers three typed questions in a single call, and code applies fixed thresholds:

A blocked command never reaches the container. Pi gets back JEV GATE blocked: destructive 92%. The command was not run. (with the real figure) and is told to say so and pick a safer command. A command that passes runs, and its result starts with the gate's reading, for example JEV GATE passed (safe 97% · remote_exec 2% · exfiltration 1%, 240 ms).

Every check, allowed or not, is written to the Durable Object's desk_gates table. The Jev command gate card shows the last ten: the command, ran or blocked, and the probabilities behind it. These calls reach jev-gateway as consumer jev-pi-sandbox-gate; Pi's own jev_decide calls are jev-pi-sandbox-tool.

The gate covers shell commands. File writes don't go through Jev; they are confined to /workspace by the path check, and the container has no network either way.

08Reading the transcript

The transcript is the Durable Object's saved conversation, drawn in order. The chips above it show your session id, the model that answered, and whether the sandbox is running.

While Pi works you'll see Pi is working… at the bottom. New rows fade in as they are committed; nothing appears that the Durable Object hasn't saved.

09Proof in Cloudflare

Every step leaves a record you can check outside the page:

• Workers Logs and traces for jev-pi-deal-desk (the ask, with your pass id) and jev-pi-sandbox (the Durable Object, the container, the service-binding calls).
• AI Gateway jev-gateway logs: each model call (tagged app: jev-pi-sandbox) and each Jev call, by consumer.
• D1 jev-gateway-audit: one row per Jev call, gate checks included, with status, latency and tokens.
• The gate log in the Durable Object, which is what the gate card shows.

10Limits

• Pi can draft an email into /workspace; it cannot send one, or contact anyone.
• The sandbox has no internet: no package installs, no web lookups.
• The model is there for the demo. Read its answer next to the board and the probabilities it cites.
• Prompts are capped at 2,000 characters. A pass includes 10 Pi asks.
• All companies on the board are fictional sample data.

11Try it

Each prompt on the Pi tab shows a different part:

Sources: jev-pi-sandbox/src/index.ts, its wrangler.jsonc and Dockerfile, and the Deal Desk Worker's /api/pi routes.