Struct ShellTool 

pub struct ShellTool { /* private fields */ }

The confined shell tool.

Registers under "shell". Accepts either argv form (program + args) or a free-form cmd string parsed by the safe-subset engine. Leash refusals (out-of-scope exec/fs, a refused construct) are returned as a structured denied envelope (denied: true), not a hard error.

Implementations

impl ShellTool

pub fn new() -> ShellTool

Construct the tool with the real OS spawner, environment, and dir lister, and the default LimitsPolicy.

pub fn with_config(limits: LimitsPolicy) -> ShellTool

Construct with the real seams and a caller-supplied LimitsPolicy — the configurability seam (agent-bridle#143): tune timeouts / output / glob caps.

pub fn with_output_observer( self, observer: Arc<dyn ShellOutputObserver>, ) -> ShellTool

Attach a presentation-only observer for bounded stdout/stderr chunks.

The observer is queued only after leash admission. It receives at most the configured output cap per stream and cannot change authorization or the final result envelope. Delivery may finish asynchronously after the invocation returns; on_finish marks the queue-drained boundary.

pub fn with_sandbox_policy(self, sandbox: SandboxPolicy) -> ShellTool

Set the sandbox mechanism policy (read/exec allow-lists, ABI floors) the L3 backend enforces (I5-B, #144). The default is today’s built-in allow-lists.

pub fn with_private_hosts( self, hosts: impl IntoIterator<Item = String>, ) -> Result<ShellTool, Error>

Approve exact names for RFC1918/ULA resolution by the existing fenced egress proxy. The owning harness supplies explicit operator approvals; command text and remote metadata are not authority. The invocation’s ordinary network scope must independently allow every requested host.

Empty by default. This does not start a proxy where no kernel fence exists, permit forbidden address ranges, or change filesystem/exec scope.

Trait Implementations

impl Clone for ShellTool

fn clone(&self) -> ShellTool

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ShellTool

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for ShellTool

fn default() -> ShellTool

Returns the “default value” for a type.

impl Tool for ShellTool

fn name(&self) -> &str

The dispatch name (the key in tools/list and in crate::Registry::dispatch).

fn schema(&self) -> Value

The MCP inputSchema (JSON Schema) for this tool’s arguments.

fn invoke<'life0, 'life1, 'async_trait>( &'life0 self, args: Value, cx: &'life1 ToolContext, ) -> Pin<Box<dyn Future<Output = Result<Value, ToolError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, ShellTool: 'async_trait,

Run the tool. The cx proves the leash was passed; the tool enforces per-operation policy by calling cx.check_exec, cx.check_path_*, etc.

fn required(&self) -> Caveats

The authority ceiling this tool promises to stay under.