pub fn run_tool(program: &str, args: &[&str], cwd: &Path) -> ToolResultExpand description
Run a command in a sandboxed environment.
- Working directory set to
cwd - Timeout enforced (default 30s)
- Sensitive env vars stripped (any *API_KEY, *SECRET, *TOKEN, etc.)