Struct Shell 

pub struct Shell { /* private fields */ }

Runs commands, confined by whatever Sandbox it was built with.

The policy lives on the tool rather than in ToolCtx because it decides the tool’s capabilities, and capabilities() has no context to consult. The workspace still comes from the context at call time, so per-run jails — an eval case’s private copy of a fixture — are confined to that copy.

Implementations

impl Shell

pub fn new(sandbox: Arc<Sandbox>) -> Self

Trait Implementations

impl Tool for Shell

fn name(&self) -> &str

fn description(&self) -> &str

fn input_schema(&self) -> Value

fn capabilities(&self) -> Capabilities

Declared risk surface. The default is the conservative one for a tool nobody has classified: assume it does nothing special.

fn denial_remedy(&self) -> Option<String>

How the operator could make a call like the one just refused safe — one sentence appended to a trifecta denial, or None when nothing short of policy would change the answer.

fn call<'life0, 'life1, 'async_trait>( &'life0 self, input: Value, ctx: &'life1 ToolCtx, ) -> Pin<Box<dyn Future<Output = Result<ToolOutput>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn read_only(&self) -> bool

Read-only tools skip the approval gate and are safe to run in parallel.

fn carried_state(&self) -> Option<CarriedState>

State this tool holds that a compaction must not lose.

fn fixed_workspace(&self) -> Option<PathBuf>

The root this tool’s relative paths actually resolve against, when the tool was constructed over a fixed directory rather than following the per-run ToolCtx workspace.

fn narrows_surface_to(&self) -> Option<Vec<String>>

Tool names this tool is currently restricting the surface to, if it is restricting it at all.

fn forget_conversation_state(&self)

Drop state that belonged to the conversation that just ended.

fn spec(&self) -> ToolSpec