Struct Shell 

pub struct Shell { /* private fields */ }

Runs commands, confined by whatever Sandbox it was built with.

The policy lives on the tool rather than in ToolCtx because it decides the tool’s capabilities, and capabilities() has no context to consult. The workspace still comes from the context at call time, so per-run jails — an eval case’s private copy of a fixture — are confined to that copy.

Implementations

impl Shell

pub fn new(sandbox: Arc<Sandbox>) -> Self

Trait Implementations

impl Tool for Shell

fn name(&self) -> &str

fn description(&self) -> &str

fn input_schema(&self) -> Value

fn capabilities(&self) -> Capabilities

Declared risk surface. The default is the conservative one for a tool nobody has classified: assume it does nothing special.

fn call<'life0, 'life1, 'async_trait>( &'life0 self, input: Value, ctx: &'life1 ToolCtx, ) -> Pin<Box<dyn Future<Output = Result<ToolOutput>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn read_only(&self) -> bool

Read-only tools skip the approval gate and are safe to run in parallel.

fn carried_state(&self) -> Option<CarriedState>

State this tool holds that a compaction must not lose.

fn spec(&self) -> ToolSpec