Module seed_command 

Execution of seed = { command = "..." } region seeds.

A command seed runs a shell command in the run’s workdir at spawn and puts its combined stdout/stderr into the region - but only when the command succeeds; a non-zero exit is reported as an error so a diagnostic never masquerades as data. It is the only seed source that executes anything, and it does so before the first inference - therefore before any tool-approval prompt - so it is deliberately hemmed in:

it is skipped entirely unless SeedCommandPolicy::allowed (the [security] allow_seed_commands config switch and the --no-seed-commands launch flag); - it runs inside the entry stage’s sandbox when the agent declares one, using the same ShellExecutor::build_command routing as the built-in shell tool, so a seed can’t escape the isolation the stage asked for; - it is capped in wall-clock time ([limits] script_shell_timeout_secs) and in output size (cap_script_io); - it never runs on restart - crate::daemon::spawn only resolves seeds on a fresh spawn.

Structs

SeedCommandPolicy

How command seeds are executed for one spawn.

Type Aliases

SeedCommandRunner

Runs one seed command: (command, workdir, timeout) -> combined output.